update_policy ¶

def update_policy(
    self,
    policy_engine_id: "capo_bedrock_agentcore_control.types.resource_id.ResourceId",
    policy_id: "capo_bedrock_agentcore_control.types.resource_id.ResourceId",
    *,
    config_overrides: Optional[BedrockAgentCoreControlClientConfig] = None,
    description: Optional[
        "capo_bedrock_agentcore_control.types.updated_description.UpdatedDescription"
    ] = None,
    definition: Optional[
        "capo_bedrock_agentcore_control.types.policy_definition.PolicyDefinition"
    ] = None,
    validation_mode: Optional[
        "capo_bedrock_agentcore_control.types.policy_validation_mode.PolicyValidationMode"
    ] = None,
    enforcement_mode: Optional[
        "capo_bedrock_agentcore_control.types.enforcement_mode.EnforcementMode"
    ] = None,
) -> "capo_bedrock_agentcore_control.types.update_policy_response.UpdatePolicyResponse":
    """<p>Updates an existing policy within the AgentCore Policy system. This operation allows modification of the policy description and definition while maintaining the policy's identity. The updated policy is validated against the Cedar schema before being applied. This is an asynchronous operation. Use the <code>GetPolicy</code> operation to poll the <code>status</code> field to track completion.</p> <p>If the updated policy is a temporal policy, the policy engine invalidates all active temporal sessions. If the update adds or removes temporal operators, the policy engine also invalidates active temporal sessions. For more information about temporal policy sessions, see <a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-session-based-temporal.html">session-based temporal policies</a>. The policy engine returns an HTTP 409 <code>ConflictException</code> to in-flight sessions. To resume, you must start a new session with a new session ID.</p>

    Args:
        policy_engine_id: <p>The identifier of the policy engine that manages the policy to be updated. This ensures the policy is updated within the correct policy engine context.</p>
        policy_id: <p>The unique identifier of the policy to be updated. This must be a valid policy ID that exists within the specified policy engine.</p>
        description: <p>The new human-readable description for the policy. This optional field allows updating the policy's documentation while keeping the same policy logic.</p>
        definition: <p>The new Cedar or Dogwood policy statement that defines the access control rules. This replaces the existing policy definition with new logic while maintaining the policy's identity.</p>
        validation_mode: <p>The validation mode for the policy update. Determines how Cedar analyzer validation results are handled during policy updates. FAIL_ON_ANY_FINDINGS runs the Cedar analyzer and fails the update if validation issues are detected, ensuring the policy conforms to the Cedar schema and tool context. IGNORE_ALL_FINDINGS runs the Cedar analyzer but allows updates despite validation warnings. Use FAIL_ON_ANY_FINDINGS to ensure policy correctness during updates, especially when modifying policy logic or conditions.</p>
        enforcement_mode: <p>The enforcement mode for the policy. Run this policy in <code>LOG_ONLY</code> mode to collect data on how it affects your application. Once you are satisfied with the data gathered, switch the policy to <code>ACTIVE</code>. If you omit this field, the policy's existing enforcement mode is unchanged.</p>

    Raises:
        capo_bedrock_agentcore_control.errors.access_denied_exception.AccessDeniedException: <p>This exception is thrown when a request is denied per access permissions</p>
        capo_bedrock_agentcore_control.errors.conflict_exception.ConflictException: <p>This exception is thrown when there is a conflict performing an operation</p>
        capo_bedrock_agentcore_control.errors.internal_server_exception.InternalServerException: <p>This exception is thrown if there was an unexpected error during processing of request</p>
        capo_bedrock_agentcore_control.errors.resource_not_found_exception.ResourceNotFoundException: <p>This exception is thrown when a resource referenced by the operation does not exist</p>
        capo_bedrock_agentcore_control.errors.service_quota_exceeded_exception.ServiceQuotaExceededException: <p>This exception is thrown when a request is made beyond the service quota</p>
        capo_bedrock_agentcore_control.errors.throttling_exception.ThrottlingException: <p>This exception is thrown when the number of requests exceeds the limit</p>
        capo_bedrock_agentcore_control.errors.validation_exception.ValidationException: <p>The input fails to satisfy the constraints specified by the service.</p>
        capo_bedrock_agentcore_control.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_bedrock_agentcore_control.types.update_policy_request.UpdatePolicyRequest]",
    ) -> OperationResponse[
        "capo_bedrock_agentcore_control.types.update_policy_response.UpdatePolicyResponse"
    ]:
        import capo_bedrock_agentcore_control._operations.amazon_bedrock_agent_core_control.update_policy

        output, http_response = (
            capo_bedrock_agentcore_control._operations.amazon_bedrock_agent_core_control.update_policy.update_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_bedrock_agentcore_control.types.update_policy_request.UpdatePolicyRequest",
    ) -> dict[str, Any]:
        import capo_bedrock_agentcore_control.types.update_policy_request

        return capo_bedrock_agentcore_control.types.update_policy_request.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_bedrock_agentcore_control.types.update_policy_response.UpdatePolicyResponse",
    ) -> dict[str, Any]:
        import capo_bedrock_agentcore_control.types.update_policy_response

        return capo_bedrock_agentcore_control.types.update_policy_response.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "UpdatePolicy", redact_input=_redact_input, redact_output=_redact_output
        ),
    )
    input_: capo_bedrock_agentcore_control.types.update_policy_request.UpdatePolicyRequest = {
        "policy_engine_id": policy_engine_id,
        "policy_id": policy_id,
    }
    if description is not None:
        input_["description"] = description
    if definition is not None:
        input_["definition"] = definition
    if validation_mode is not None:
        input_["validation_mode"] = validation_mode
    if enforcement_mode is not None:
        input_["enforcement_mode"] = enforcement_mode

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output