CREATEPOLICYENGINE()`¶

About CreatePolicyEngine¶

Creates a new policy engine within the AgentCore Policy system. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with Gateways (each Gateway can be associated with at most one policy engine, but multiple Gateways can be associated with the same engine), the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.

Method Signature¶

METHODS /AWS1/IF_BDO~CREATEPOLICYENGINE
  IMPORTING
    !IV_NAME TYPE /AWS1/BDOPOLICYENGINENAME OPTIONAL
    !IV_DESCRIPTION TYPE /AWS1/BDODESCRIPTION OPTIONAL
    !IV_CLIENTTOKEN TYPE /AWS1/BDOCLIENTTOKEN OPTIONAL
    !IV_ENCRYPTIONKEYARN TYPE /AWS1/BDOKMSKEYARN OPTIONAL
    !IT_TAGS TYPE /AWS1/CL_BDOTAGSMAP_W=>TT_TAGSMAP OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_bdocreateplyenginersp
  RAISING
    /AWS1/CX_BDOACCESSDENIEDEX
    /AWS1/CX_BDOCONFLICTEXCEPTION
    /AWS1/CX_BDOINTERNALSERVEREX
    /AWS1/CX_BDOSERVICEQUOTAEXCDEX
    /AWS1/CX_BDOTHROTTLINGEX
    /AWS1/CX_BDOVALIDATIONEX
    /AWS1/CX_BDOCLIENTEXC
    /AWS1/CX_BDOSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`iv_name` `TYPE /AWS1/BDOPOLICYENGINENAME` `/AWS1/BDOPOLICYENGINENAME`¶

The customer-assigned immutable name for the policy engine. This name identifies the policy engine and cannot be changed after creation.

Optional arguments:¶

`iv_description` `TYPE /AWS1/BDODESCRIPTION` `/AWS1/BDODESCRIPTION`¶

A human-readable description of the policy engine's purpose and scope (1-4,096 characters). This helps administrators understand the policy engine's role in the overall governance strategy. Document which Gateway this engine will be associated with, what types of tools or workflows it governs, and the team or service responsible for maintaining it. Clear descriptions are essential when managing multiple policy engines across different services or environments.

`iv_clienttoken` `TYPE /AWS1/BDOCLIENTTOKEN` `/AWS1/BDOCLIENTTOKEN`¶

A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request with the same client token, the service returns the same response without creating a duplicate policy engine.

`iv_encryptionkeyarn` `TYPE /AWS1/BDOKMSKEYARN` `/AWS1/BDOKMSKEYARN`¶

The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.

`it_tags` `TYPE /AWS1/CL_BDOTAGSMAP_W=>TT_TAGSMAP` `TT_TAGSMAP`¶

A map of tag keys and values to assign to an AgentCore Policy. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_bdocreateplyenginersp` `/AWS1/CL_BDOCREATEPLYENGINERSP`¶

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->createpolicyengine(
  it_tags = VALUE /aws1/cl_bdotagsmap_w=>tt_tagsmap(
    (
      VALUE /aws1/cl_bdotagsmap_w=>ts_tagsmap_maprow(
        key = |string|
        value = new /aws1/cl_bdotagsmap_w( |string| )
      )
    )
  )
  iv_clienttoken = |string|
  iv_description = |string|
  iv_encryptionkeyarn = |string|
  iv_name = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_resourceid = lo_result->get_policyengineid( ).
  lv_policyenginename = lo_result->get_name( ).
  lv_description = lo_result->get_description( ).
  lv_datetimestamp = lo_result->get_createdat( ).
  lv_datetimestamp = lo_result->get_updatedat( ).
  lv_policyenginearn = lo_result->get_policyenginearn( ).
  lv_policyenginestatus = lo_result->get_status( ).
  LOOP AT lo_result->get_statusreasons( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lv_string = lo_row_1->get_value( ).
    ENDIF.
  ENDLOOP.
  lv_kmskeyarn = lo_result->get_encryptionkeyarn( ).
ENDIF.

/AWS1/IF_BDO=>CREATEPOLICYENGINE()¶