Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. AWS
  4. API Docs
  5. bedrock
  6. AgentcorePolicyEngine
Viewing docs for AWS v7.32.0
published on Friday, May 29, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.bedrock.AgentcorePolicyEngine

aws logo
Viewing docs for AWS v7.32.0
published on Friday, May 29, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages an AWS Bedrock AgentCore Policy Engine. A Policy Engine controls what actions and resources an agent runtime can use.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcorePolicyEngine("example", {name: "example_policy_engine"});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcorePolicyEngine("example", name="example_policy_engine")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcorePolicyEngine(ctx, "example", &bedrock.AgentcorePolicyEngineArgs{
			Name: pulumi.String("example_policy_engine"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcorePolicyEngine("example", new()
    {
        Name = "example_policy_engine",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcorePolicyEngine;
import com.pulumi.aws.bedrock.AgentcorePolicyEngineArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcorePolicyEngine("example", AgentcorePolicyEngineArgs.builder()
            .name("example_policy_engine")
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcorePolicyEngine
    properties:
      name: example_policy_engine

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_bedrock_agentcorepolicyengine" "example" {
  name = "example_policy_engine"
}

    With Description

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcorePolicyEngine("example", {
    name: "example_policy_engine",
    description: "Policy engine for customer service agent",
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcorePolicyEngine("example",
    name="example_policy_engine",
    description="Policy engine for customer service agent")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcorePolicyEngine(ctx, "example", &bedrock.AgentcorePolicyEngineArgs{
			Name:        pulumi.String("example_policy_engine"),
			Description: pulumi.String("Policy engine for customer service agent"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcorePolicyEngine("example", new()
    {
        Name = "example_policy_engine",
        Description = "Policy engine for customer service agent",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcorePolicyEngine;
import com.pulumi.aws.bedrock.AgentcorePolicyEngineArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcorePolicyEngine("example", AgentcorePolicyEngineArgs.builder()
            .name("example_policy_engine")
            .description("Policy engine for customer service agent")
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcorePolicyEngine
    properties:
      name: example_policy_engine
      description: Policy engine for customer service agent

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_bedrock_agentcorepolicyengine" "example" {
  name        = "example_policy_engine"
  description = "Policy engine for customer service agent"
}

    With Custom Encryption

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.kms.Key("example", {
    description: "KMS key for Bedrock AgentCore Policy Engine",
    deletionWindowInDays: 7,
});
const exampleAgentcorePolicyEngine = new aws.bedrock.AgentcorePolicyEngine("example", {
    name: "example_policy_engine",
    description: "Policy engine for customer service agent",
    encryptionKeyArn: example.arn,
});

    import pulumi
import pulumi_aws as aws

example = aws.kms.Key("example",
    description="KMS key for Bedrock AgentCore Policy Engine",
    deletion_window_in_days=7)
example_agentcore_policy_engine = aws.bedrock.AgentcorePolicyEngine("example",
    name="example_policy_engine",
    description="Policy engine for customer service agent",
    encryption_key_arn=example.arn)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := kms.NewKey(ctx, "example", &kms.KeyArgs{
			Description:          pulumi.String("KMS key for Bedrock AgentCore Policy Engine"),
			DeletionWindowInDays: pulumi.Int(7),
		})
		if err != nil {
			return err
		}
		_, err = bedrock.NewAgentcorePolicyEngine(ctx, "example", &bedrock.AgentcorePolicyEngineArgs{
			Name:             pulumi.String("example_policy_engine"),
			Description:      pulumi.String("Policy engine for customer service agent"),
			EncryptionKeyArn: example.Arn,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Kms.Key("example", new()
    {
        Description = "KMS key for Bedrock AgentCore Policy Engine",
        DeletionWindowInDays = 7,
    });

    var exampleAgentcorePolicyEngine = new Aws.Bedrock.AgentcorePolicyEngine("example", new()
    {
        Name = "example_policy_engine",
        Description = "Policy engine for customer service agent",
        EncryptionKeyArn = example.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.kms.Key;
import com.pulumi.aws.kms.KeyArgs;
import com.pulumi.aws.bedrock.AgentcorePolicyEngine;
import com.pulumi.aws.bedrock.AgentcorePolicyEngineArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Key("example", KeyArgs.builder()
            .description("KMS key for Bedrock AgentCore Policy Engine")
            .deletionWindowInDays(7)
            .build());

        var exampleAgentcorePolicyEngine = new AgentcorePolicyEngine("exampleAgentcorePolicyEngine", AgentcorePolicyEngineArgs.builder()
            .name("example_policy_engine")
            .description("Policy engine for customer service agent")
            .encryptionKeyArn(example.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:kms:Key
    properties:
      description: KMS key for Bedrock AgentCore Policy Engine
      deletionWindowInDays: 7
  exampleAgentcorePolicyEngine:
    type: aws:bedrock:AgentcorePolicyEngine
    name: example
    properties:
      name: example_policy_engine
      description: Policy engine for customer service agent
      encryptionKeyArn: ${example.arn}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_kms_key" "example" {
  description             = "KMS key for Bedrock AgentCore Policy Engine"
  deletion_window_in_days = 7
}
resource "aws_bedrock_agentcorepolicyengine" "example" {
  name               = "example_policy_engine"
  description        = "Policy engine for customer service agent"
  encryption_key_arn = aws_kms_key.example.arn
}

    Create AgentcorePolicyEngine Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AgentcorePolicyEngine(name: string, args?: AgentcorePolicyEngineArgs, opts?: CustomResourceOptions);
    @overload
def AgentcorePolicyEngine(resource_name: str,
                          args: Optional[AgentcorePolicyEngineArgs] = None,
                          opts: Optional[ResourceOptions] = None)

@overload
def AgentcorePolicyEngine(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          description: Optional[str] = None,
                          encryption_key_arn: Optional[str] = None,
                          name: Optional[str] = None,
                          region: Optional[str] = None,
                          tags: Optional[Mapping[str, str]] = None,
                          timeouts: Optional[AgentcorePolicyEngineTimeoutsArgs] = None)
    func NewAgentcorePolicyEngine(ctx *Context, name string, args *AgentcorePolicyEngineArgs, opts ...ResourceOption) (*AgentcorePolicyEngine, error)
    public AgentcorePolicyEngine(string name, AgentcorePolicyEngineArgs? args = null, CustomResourceOptions? opts = null)
    public AgentcorePolicyEngine(String name, AgentcorePolicyEngineArgs args)
public AgentcorePolicyEngine(String name, AgentcorePolicyEngineArgs args, CustomResourceOptions options)

    type: aws:bedrock:AgentcorePolicyEngine
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_bedrock_agentcorepolicyengine" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AgentcorePolicyEngineArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AgentcorePolicyEngineArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AgentcorePolicyEngineArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AgentcorePolicyEngineArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AgentcorePolicyEngineArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var agentcorePolicyEngineResource = new Aws.Bedrock.AgentcorePolicyEngine("agentcorePolicyEngineResource", new()
{
    Description = "string",
    EncryptionKeyArn = "string",
    Name = "string",
    Region = "string",
    Tags = 
    {
        { "string", "string" },
    },
    Timeouts = new Aws.Bedrock.Inputs.AgentcorePolicyEngineTimeoutsArgs
    {
        Create = "string",
        Delete = "string",
        Update = "string",
    },
});

    example, err := bedrock.NewAgentcorePolicyEngine(ctx, "agentcorePolicyEngineResource", &bedrock.AgentcorePolicyEngineArgs{
	Description:      pulumi.String("string"),
	EncryptionKeyArn: pulumi.String("string"),
	Name:             pulumi.String("string"),
	Region:           pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Timeouts: &bedrock.AgentcorePolicyEngineTimeoutsArgs{
		Create: pulumi.String("string"),
		Delete: pulumi.String("string"),
		Update: pulumi.String("string"),
	},
})

    resource "aws_bedrock_agentcorepolicyengine" "agentcorePolicyEngineResource" {
  description        = "string"
  encryption_key_arn = "string"
  name               = "string"
  region             = "string"
  tags = {
    "string" = "string"
  }
  timeouts = {
    create = "string"
    delete = "string"
    update = "string"
  }
}

    var agentcorePolicyEngineResource = new AgentcorePolicyEngine("agentcorePolicyEngineResource", AgentcorePolicyEngineArgs.builder()
    .description("string")
    .encryptionKeyArn("string")
    .name("string")
    .region("string")
    .tags(Map.of("string", "string"))
    .timeouts(AgentcorePolicyEngineTimeoutsArgs.builder()
        .create("string")
        .delete("string")
        .update("string")
        .build())
    .build());

    agentcore_policy_engine_resource = aws.bedrock.AgentcorePolicyEngine("agentcorePolicyEngineResource",
    description="string",
    encryption_key_arn="string",
    name="string",
    region="string",
    tags={
        "string": "string",
    },
    timeouts={
        "create": "string",
        "delete": "string",
        "update": "string",
    })

    const agentcorePolicyEngineResource = new aws.bedrock.AgentcorePolicyEngine("agentcorePolicyEngineResource", {
    description: "string",
    encryptionKeyArn: "string",
    name: "string",
    region: "string",
    tags: {
        string: "string",
    },
    timeouts: {
        create: "string",
        "delete": "string",
        update: "string",
    },
});

    type: aws:bedrock:AgentcorePolicyEngine
properties:
    description: string
    encryptionKeyArn: string
    name: string
    region: string
    tags:
        string: string
    timeouts:
        create: string
        delete: string
        update: string

    AgentcorePolicyEngine Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AgentcorePolicyEngine resource accepts the following input properties:

    Description string
    Description of the policy engine.
    EncryptionKeyArn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    Name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags Dictionary<string, string>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    Timeouts AgentcorePolicyEngineTimeouts
    Description string
    Description of the policy engine.
    EncryptionKeyArn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    Name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags map[string]string
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    Timeouts AgentcorePolicyEngineTimeoutsArgs
    description string
    Description of the policy engine.
    encryption_key_arn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags map(string)
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts object
    description String
    Description of the policy engine.
    encryptionKeyArn String
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name String

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String,String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts AgentcorePolicyEngineTimeouts
    description string
    Description of the policy engine.
    encryptionKeyArn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags {[key: string]: string}
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts AgentcorePolicyEngineTimeouts
    description str
    Description of the policy engine.
    encryption_key_arn str
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name str

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Mapping[str, str]
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts AgentcorePolicyEngineTimeoutsArgs
    description String
    Description of the policy engine.
    encryptionKeyArn String
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name String

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts Property Map

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AgentcorePolicyEngine resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    PolicyEngineArn string
    ARN of the Policy Engine.
    PolicyEngineId string
    Unique identifier of the Policy Engine.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    Id string
    The provider-assigned unique ID for this managed resource.
    PolicyEngineArn string
    ARN of the Policy Engine.
    PolicyEngineId string
    Unique identifier of the Policy Engine.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    id string
    The provider-assigned unique ID for this managed resource.
    policy_engine_arn string
    ARN of the Policy Engine.
    policy_engine_id string
    Unique identifier of the Policy Engine.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    id String
    The provider-assigned unique ID for this managed resource.
    policyEngineArn String
    ARN of the Policy Engine.
    policyEngineId String
    Unique identifier of the Policy Engine.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    id string
    The provider-assigned unique ID for this managed resource.
    policyEngineArn string
    ARN of the Policy Engine.
    policyEngineId string
    Unique identifier of the Policy Engine.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    id str
    The provider-assigned unique ID for this managed resource.
    policy_engine_arn str
    ARN of the Policy Engine.
    policy_engine_id str
    Unique identifier of the Policy Engine.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    id String
    The provider-assigned unique ID for this managed resource.
    policyEngineArn String
    ARN of the Policy Engine.
    policyEngineId String
    Unique identifier of the Policy Engine.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Look up Existing AgentcorePolicyEngine Resource

    Get an existing AgentcorePolicyEngine resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AgentcorePolicyEngineState, opts?: CustomResourceOptions): AgentcorePolicyEngine
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        description: Optional[str] = None,
        encryption_key_arn: Optional[str] = None,
        name: Optional[str] = None,
        policy_engine_arn: Optional[str] = None,
        policy_engine_id: Optional[str] = None,
        region: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None,
        timeouts: Optional[AgentcorePolicyEngineTimeoutsArgs] = None) -> AgentcorePolicyEngine
    func GetAgentcorePolicyEngine(ctx *Context, name string, id IDInput, state *AgentcorePolicyEngineState, opts ...ResourceOption) (*AgentcorePolicyEngine, error)
    public static AgentcorePolicyEngine Get(string name, Input<string> id, AgentcorePolicyEngineState? state, CustomResourceOptions? opts = null)
    public static AgentcorePolicyEngine get(String name, Output<String> id, AgentcorePolicyEngineState state, CustomResourceOptions options)
    resources:  _:    type: aws:bedrock:AgentcorePolicyEngine    get:      id: ${id}
    import {
  to = aws_bedrock_agentcorepolicyengine.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Description string
    Description of the policy engine.
    EncryptionKeyArn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    Name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    PolicyEngineArn string
    ARN of the Policy Engine.
    PolicyEngineId string
    Unique identifier of the Policy Engine.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags Dictionary<string, string>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    Timeouts AgentcorePolicyEngineTimeouts
    Description string
    Description of the policy engine.
    EncryptionKeyArn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    Name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    PolicyEngineArn string
    ARN of the Policy Engine.
    PolicyEngineId string
    Unique identifier of the Policy Engine.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags map[string]string
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    Timeouts AgentcorePolicyEngineTimeoutsArgs
    description string
    Description of the policy engine.
    encryption_key_arn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    policy_engine_arn string
    ARN of the Policy Engine.
    policy_engine_id string
    Unique identifier of the Policy Engine.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags map(string)
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    timeouts object
    description String
    Description of the policy engine.
    encryptionKeyArn String
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name String

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    policyEngineArn String
    ARN of the Policy Engine.
    policyEngineId String
    Unique identifier of the Policy Engine.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String,String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    timeouts AgentcorePolicyEngineTimeouts
    description string
    Description of the policy engine.
    encryptionKeyArn string
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name string

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    policyEngineArn string
    ARN of the Policy Engine.
    policyEngineId string
    Unique identifier of the Policy Engine.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags {[key: string]: string}
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    timeouts AgentcorePolicyEngineTimeouts
    description str
    Description of the policy engine.
    encryption_key_arn str
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name str

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    policy_engine_arn str
    ARN of the Policy Engine.
    policy_engine_id str
    Unique identifier of the Policy Engine.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Mapping[str, str]
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    timeouts AgentcorePolicyEngineTimeoutsArgs
    description String
    Description of the policy engine.
    encryptionKeyArn String
    ARN of the KMS key used to encrypt the policy engine. If not set, AWS uses an AWS managed key.
    name String

    Name of the policy engine. Must start with a letter and contain only letters, numbers, and underscores. Maximum length of 48 characters.

    The following arguments are optional:

    policyEngineArn String
    ARN of the Policy Engine.
    policyEngineId String
    Unique identifier of the Policy Engine.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    timeouts Property Map

    Supporting Types

    AgentcorePolicyEngineTimeouts, AgentcorePolicyEngineTimeoutsArgs

    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

    Import

    Identity Schema

    Required

    • policyEngineId (String) Policy engine ID.

    Optional

    • accountId (String) AWS account ID for this resource.
    • region (String) AWS Region for this resource.

    Using pulumi import, import a Bedrock AgentCore Policy Engine by policy engine ID. For example:

    $ pulumi import aws:bedrock/agentcorePolicyEngine:AgentcorePolicyEngine example policy-engine-id-12345678

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo
    Viewing docs for AWS v7.32.0
    published on Friday, May 29, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial