Skip to main content

policy_stores

Creates, updates, deletes, gets or lists a policy_stores resource.

Overview​

Namepolicy_stores
TypeResource
Idaws.verifiedpermissions.policy_stores

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
arnstringThe Amazon Resource Name (ARN) of the policy store. (pattern: <code>arn:[^:]:[^:]:[^:]:[^:]:.*</code>)
cedar_versionstringThe version of the Cedar language used with policies, policy templates, and schemas in this policy store. For more information, see Amazon Verified Permissions upgrade to Cedar v4 FAQ. (CEDAR_2, CEDAR_4)
created_datestring (date-time)The date and time that the policy store was originally created.
deletion_protectionstringSpecifies whether the policy store can be deleted. If enabled, the policy store can't be deleted. The default state is DISABLED. (ENABLED, DISABLED)
descriptionstringDescriptive text that you can provide to help with identification of the current policy store.
encryption_stateobjectA structure that contains the encryption configuration for the policy store.
last_updated_datestring (date-time)The date and time that the policy store was last updated.
policy_store_idstringThe ID of the policy store; (pattern: <code>[a-zA-Z0-9-/_]*</code>)
tagsobjectThe list of tags associated with the policy store.
validation_settingsobjectThe current validation settings for the policy store.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
get_policy_storeselectregionRetrieves details about a policy store.
list_policy_storesselectregionReturns a paginated list of all policy stores in the calling Amazon Web Services account.
create_policy_storeinsertregion, validationSettingsCreates a policy store. A policy store is a container for policy resources. As of May 2026, Verified Permissions has aligned with Cedar and now supports multiple namespaces. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.
update_policy_storeupdateregion, policyStoreId, validationSettingsModifies the validation setting for a policy store. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.
delete_policy_storedeleteregionDeletes the specified policy store. This operation is idempotent. If you specify a policy store that does not exist, the request response will still return a successful HTTP 200 status code.
batch_is_authorizedexecregion, policyStoreId, requestsMakes a series of decisions about multiple authorization requests for one principal or resource. Each request contains the equivalent content of an IsAuthorized request: principal, action, resource, and context. Either the principal or the resource parameter must be identical across all requests. For example, Verified Permissions won't evaluate a pair of requests where bob views photo1 and alice views photo2. Authorization of bob to view photo1 and photo2, or bob and alice to view photo1, are valid batches. The request is evaluated against all policies in the specified policy store that match the entities that you declare. The result of the decisions is a series of Allow or Deny responses, along with the IDs of the policies that produced each decision. The entities of a BatchIsAuthorized API request can contain up to 100 principals and up to 100 resources. The requests of a BatchIsAuthorized API request can contain up to 30 requests. The BatchIsAuthorized operation doesn't have its own IAM permission. To authorize this operation for Amazon Web Services principals, include the permission verifiedpermissions:IsAuthorized in their IAM policies.
batch_is_authorized_with_tokenexecregion, policyStoreId, requestsMakes a series of decisions about multiple authorization requests for one token. The principal in this request comes from an external identity source in the form of an identity or access token, formatted as a JSON web token (JWT). The information in the parameters can also define additional context that Verified Permissions can include in the evaluations. The request is evaluated against all policies in the specified policy store that match the entities that you provide in the entities declaration and in the token. The result of the decisions is a series of Allow or Deny responses, along with the IDs of the policies that produced each decision. The entities of a BatchIsAuthorizedWithToken API request can contain up to 100 resources and up to 99 user groups. The requests of a BatchIsAuthorizedWithToken API request can contain up to 30 requests. The BatchIsAuthorizedWithToken operation doesn't have its own IAM permission. To authorize this operation for Amazon Web Services principals, include the permission verifiedpermissions:IsAuthorizedWithToken in their IAM policies.
is_authorizedexecregion, policyStoreIdMakes an authorization decision about a service request described in the parameters. The information in the parameters can also define additional context that Verified Permissions can include in the evaluation. The request is evaluated against all matching policies in the specified policy store. The result of the decision is either Allow or Deny, along with a list of the policies that resulted in the decision.
is_authorized_with_tokenexecregion, policyStoreIdMakes an authorization decision about a service request described in the parameters. The principal in this request comes from an external identity source in the form of an identity token formatted as a JSON web token (JWT). The information in the parameters can also define additional context that Verified Permissions can include in the evaluation. The request is evaluated against all matching policies in the specified policy store. The result of the decision is either Allow or Deny, along with a list of the policies that resulted in the decision. Verified Permissions validates each token that is specified in a request by checking its expiration date and its signature. Tokens from an identity source user continue to be usable until they expire. Token revocation and resource deletion have no effect on the validity of a token in your policy store

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Retrieves details about a policy store.

SELECT
arn,
cedar_version,
created_date,
deletion_protection,
description,
encryption_state,
last_updated_date,
policy_store_id,
tags,
validation_settings
FROM aws.verifiedpermissions.policy_stores
WHERE region = '{{ region }}' -- required
;

INSERT examples​

Creates a policy store. A policy store is a container for policy resources. As of May 2026, Verified Permissions has aligned with Cedar and now supports multiple namespaces. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.

INSERT INTO aws.verifiedpermissions.policy_stores (
clientToken,
validationSettings,
description,
deletionProtection,
encryptionSettings,
tags,
region
)
SELECT 
'{{ clientToken }}',
'{{ validationSettings }}' /* required */,
'{{ description }}',
'{{ deletionProtection }}',
'{{ encryptionSettings }}',
'{{ tags }}',
'{{ region }}'
RETURNING
arn,
created_date,
last_updated_date,
policy_store_id
;

UPDATE examples​

Modifies the validation setting for a policy store. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.

UPDATE aws.verifiedpermissions.policy_stores
SET 
policyStoreId = '{{ policyStoreId }}',
validationSettings = '{{ validationSettings }}',
deletionProtection = '{{ deletionProtection }}',
description = '{{ description }}'
WHERE 
region = '{{ region }}' --required
AND policyStoreId = '{{ policyStoreId }}' --required
AND validationSettings = '{{ validationSettings }}' --required
RETURNING
arn,
created_date,
last_updated_date,
policy_store_id;

DELETE examples​

Deletes the specified policy store. This operation is idempotent. If you specify a policy store that does not exist, the request response will still return a successful HTTP 200 status code.

DELETE FROM aws.verifiedpermissions.policy_stores
WHERE region = '{{ region }}' --required
;

Lifecycle Methods​

Makes a series of decisions about multiple authorization requests for one principal or resource. Each request contains the equivalent content of an IsAuthorized request: principal, action, resource, and context. Either the principal or the resource parameter must be identical across all requests. For example, Verified Permissions won't evaluate a pair of requests where bob views photo1 and alice views photo2. Authorization of bob to view photo1 and photo2, or bob and alice to view photo1, are valid batches. The request is evaluated against all policies in the specified policy store that match the entities that you declare. The result of the decisions is a series of Allow or Deny responses, along with the IDs of the policies that produced each decision. The entities of a BatchIsAuthorized API request can contain up to 100 principals and up to 100 resources. The requests of a BatchIsAuthorized API request can contain up to 30 requests. The BatchIsAuthorized operation doesn't have its own IAM permission. To authorize this operation for Amazon Web Services principals, include the permission verifiedpermissions:IsAuthorized in their IAM policies.

EXEC aws.verifiedpermissions.policy_stores.batch_is_authorized 
@region='{{ region }}' --required 
@@json=
'{
"policyStoreId": "{{ policyStoreId }}", 
"entities": "{{ entities }}", 
"requests": "{{ requests }}"
}'
;
Last updated on