policy_summaries

Creates, updates, deletes, gets or lists a policy_summaries resource.

Overview

Name	policy_summaries
Type	Resource
Id	aws.bedrock_agentcore_control.policy_summaries

Fields

The following fields are returned by SELECT queries:

get_policy_summary

Name	Datatype	Description
name	string	The customer-assigned name of the policy. (pattern: <code>[A-Za-z][A-Za-z0-9_]*</code>)
created_at	string (date-time)	The timestamp when the policy was originally created.
enforcement_mode	string	The enforcement mode for a policy. Run this policy in LOG_ONLY mode to collect data on how it affects your application. Once you are satisfied with the data gathered, switch the policy to ACTIVE. (ACTIVE, LOG_ONLY)
policy_arn	string	The Amazon Resource Name (ARN) of the policy. (pattern: <code>arn:aws[-a-z]{0,7}:bedrock-agentcore:[a-z0-9-]{9,15}:[0-9]{12}:policy-engine/[a-zA-Z][a-zA-Z0-9-]{0,47}-[a-zA-Z0-9]{10}/policy/[a-zA-Z][a-zA-Z0-9-]{0,47}-[a-zA-Z0-9]{10}</code>)
policy_engine_id	string	The identifier of the policy engine that manages this policy. (pattern: <code>[A-Za-z][A-Za-z0-9_]*-[a-z0-9_]{10}</code>)
policy_id	string	The unique identifier of the policy. (pattern: <code>[A-Za-z][A-Za-z0-9_]*-[a-z0-9_]{10}</code>)
status	string	The current status of the policy. (CREATING, ACTIVE, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED)
updated_at	string (date-time)	The timestamp when the policy was last modified.

list_policy_summaries

Name	Datatype	Description
name	string	The customer-assigned name of the policy. (pattern: <code>[A-Za-z][A-Za-z0-9_]*</code>)
created_at	string (date-time)	The timestamp when the policy was originally created.
enforcement_mode	string	The enforcement mode for a policy. Run this policy in LOG_ONLY mode to collect data on how it affects your application. Once you are satisfied with the data gathered, switch the policy to ACTIVE. (ACTIVE, LOG_ONLY)
policy_arn	string	The Amazon Resource Name (ARN) of the policy. (pattern: <code>arn:aws[-a-z]{0,7}:bedrock-agentcore:[a-z0-9-]{9,15}:[0-9]{12}:policy-engine/[a-zA-Z][a-zA-Z0-9-]{0,47}-[a-zA-Z0-9]{10}/policy/[a-zA-Z][a-zA-Z0-9-]{0,47}-[a-zA-Z0-9]{10}</code>)
policy_engine_id	string	The identifier of the policy engine that manages this policy. (pattern: <code>[A-Za-z][A-Za-z0-9_]*-[a-z0-9_]{10}</code>)
policy_id	string	The unique identifier for the policy. (pattern: <code>[A-Za-z][A-Za-z0-9_]*-[a-z0-9_]{10}</code>)
status	string	The current status of the policy. (CREATING, ACTIVE, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED)
updated_at	string (date-time)	The timestamp when the policy was last modified.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_policy_summary	select	policy_engine_id, policy_id, region		Retrieves a metadata-only summary of a specific policy without decrypting customer content. This lightweight read operation returns resource identifiers, status, and timestamps, but does not include the policy definition, description, or status reasons. Because this operation does not require access to the customer's KMS key, it is suitable for resource discovery, inventory, and integration scenarios where only metadata is needed.
list_policy_summaries	select	policy_engine_id, region	nextToken, maxResults, targetResourceScope	Retrieves a paginated list of metadata-only policy summaries within a policy engine without decrypting customer content. This lightweight read operation returns resource identifiers, status, and timestamps for each policy, but does not include policy definitions, descriptions, or status reasons. Because this operation does not require access to the customer's KMS key, it is suitable for resource discovery, inventory, and integration scenarios where only metadata is needed.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
policy_engine_id	string	The identifier of the policy engine whose policy summaries to retrieve.
policy_id	string	The unique identifier of the policy to retrieve the summary for. This must be a valid policy ID that exists within the specified policy engine.
region	string	AWS region (default: us-east-1)
maxResults	integer	The maximum number of policy summaries to return in a single response.
nextToken	string	A pagination token returned from a previous ListPolicySummaries call. Use this token to retrieve the next page of results when the response is paginated.
targetResourceScope	string	Optional filter to list policy summaries that apply to a specific resource scope or resource type. This helps narrow down results to those relevant for particular Amazon Web Services resources, agent tools, or operational contexts within the policy engine ecosystem.

SELECT examples

get_policy_summary

Retrieves a metadata-only summary of a specific policy without decrypting customer content. This lightweight read operation returns resource identifiers, status, and timestamps, but does not include the policy definition, description, or status reasons. Because this operation does not require access to the customer's KMS key, it is suitable for resource discovery, inventory, and integration scenarios where only metadata is needed.

SELECT
name,
created_at,
enforcement_mode,
policy_arn,
policy_engine_id,
policy_id,
status,
updated_at
FROM aws.bedrock_agentcore_control.policy_summaries
WHERE policy_engine_id = '{{ policy_engine_id }}' -- required
AND policy_id = '{{ policy_id }}' -- required
AND region = '{{ region }}' -- required
;

list_policy_summaries

Retrieves a paginated list of metadata-only policy summaries within a policy engine without decrypting customer content. This lightweight read operation returns resource identifiers, status, and timestamps for each policy, but does not include policy definitions, descriptions, or status reasons. Because this operation does not require access to the customer's KMS key, it is suitable for resource discovery, inventory, and integration scenarios where only metadata is needed.

SELECT
name,
created_at,
enforcement_mode,
policy_arn,
policy_engine_id,
policy_id,
status,
updated_at
FROM aws.bedrock_agentcore_control.policy_summaries
WHERE policy_engine_id = '{{ policy_engine_id }}' -- required
AND region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
AND targetResourceScope = '{{ targetResourceScope }}'
;