`maqpna policy push`

Compile policies for an AWS Bedrock AgentCore policy engine and show the changes; --apply writes them

Govern-o json | yaml

Synopsis#

maqpna policy push --to agentcore --manifest GATEWAY.json --engine ID FILE|DIR... [--owner NAME] [--apply [--wait] [--ledger FILE]]
                   [--enforcement-mode ACTIVE|LOG_ONLY] [--region R] [--endpoint URL] [-o json]

Description#

From the help of maqpna policy:

Policy files: ToolPolicy custom resources (YAML or JSON, several per file, or a List) and the operator-rendered policies.json bundle are both accepted. ToolPolicies are rendered with the operator's own renderer (pkg/policyload), so a test evaluates exactly what the gateway would load. A ToolPolicy that the operator would refuse to publish (bad regex, timezone, Cedar, ...) is an error.

Suite mode: policy test DIR runs every maqpna-test.yaml under DIR (FILE runs that suite). A suite is:

  apiVersion: maqpna.com/v1alpha1
  kind: PolicyTest
  name: coder                      # optional
  policies: [../policies/]         # files or dirs, relative to the suite
  defaults: {namespace: team-a, agent: coder, user: [email protected]}
  cases:                           # one tool call each
    - name: prod writes blocked
      server: kubernetes
      tool: delete
      args: {namespace: prod-eu}
      expect: deny
      expectRule: k8s-no-prod-mutations
  tasks: []                        # optional multi-step tasks (maqpna eval format)

Exit status 3 when a case fails (or, with --require-tests, a policy file is not covered by any suite).

compile translates the policies to Cedar (MAQPNA's Cedar schema, config/cedar/maqpna.cedarschema) or to one CEL expression over a "request" map that evaluates to allow, require_approval or deny, so other platforms can enforce the same decisions. The result decides exactly as MAQPNA does, or compile refuses: a construct the target cannot express (when, schedule, sinks, scopes, toolLabels, toolPins, embedded Cedar; for Cedar also '?' globs and globs over groups or taints) is an error naming the rule. What the target does not enforce (rate limits; for CEL, approval requirements; argMatch type caveats) is printed as a warning.

--to rego compiles to one Rego v1 module for OPA whose "decision" rule is the object MAQPNA's own Rego backend reads ({"action", "policy", "rule", "reason", "approval"}), over the input the gateway sends its OPA sidecar (policy.ExternalInput): run it with OPA standalone, or as the gateway's OPA sidecar (gateway.json policy.rego.url .../v1/data/maqpna/authz/decision). Approval requirements are carried. Rego also compiles character classes that cannot match '/'. --bundle-out DIR writes an OPA bundle (.manifest rooted at the package).

--to agentcore compiles for AWS Bedrock AgentCore Policy: one Cedar statement per AgentCore policy (-o json lists name, description and statement for CreatePolicy), against AgentCore's schema (OAuthUser principal with JWT claims as tags, one action per gateway tool, the gateway ARN as resource, the tool's typed input as context.input). The manifest gives the gateway ARN and, per MAQPNA server, the AgentCore target and its MCP tools with input schemas; server and tool conditions are decided per tool at compile time. Session taints, the substrate and (unless "approvalAsDeny") require_approval have no AgentCore counterpart and are refused.

push --to agentcore compiles the same way and reconciles the result into an AgentCore policy engine (AWS credentials from the environment, IRSA or EKS Pod Identity). It lists the engine's policies, plans creates, updates and deletes for the ones this owner pushed (name prefix maqpna_ and an owner marker in the description), and prints the plan with each statement's SHA-256. Policies MAQPNA did not create are never changed; a name taken by one is reported as a conflict. --apply executes the plan, tightening changes first; a rerun with the same policies changes nothing.

Flags#

Flag	Type	Description	Default
`--apply`	switch	execute the plan (default: print it)	none
`--dry-run`	switch	print the plan without changing anything (the default; `--apply` executes)	`true`
`--endpoint`	string	control-plane URL (default https://bedrock-agentcore-control.REGION.amazonaws.com)	none
`--enforcement-mode`	string	ACTIVE or LOG_ONLY for the pushed policies (default: AgentCore's, ACTIVE; drift from a given mode is updated)	none
`--engine`	string	AgentCore policy engine ID (policyEngineId)	none
`--ledger`	string	with `--apply`: also append one audit record per change to this ledger FILE (not one a running gateway writes)	none
`--manifest`	string	the gateway manifest (gatewayArn, targets with their MCP tools; see docs/integrations/policy-export.md)	none
`--namespace`	string	namespace of ToolPolicies without metadata.namespace	`default`
`--owner`	string	owner label marking the policies this push manages (several MAQPNA installations can share an engine)	`default`
`--region`	string	AWS region (default: the gateway ARN's, then AWS_REGION)	none
`--to`	string	target: agentcore	none
`--wait`	switch	with `--apply`: wait for each phase to become ACTIVE (or deleted) before the next	none
`--wait-timeout`	duration	with `--wait`: how long each phase may take	`5m0s`

The global flags (--context, -o, --no-color, ...) work with every command.

What happens when you run it#

Reads the audit ledger offline with --ledger FILE: with --apply: also append one audit record per change to this ledger FILE (not one a running gateway writes).
--dry-run: print the plan without changing anything (the default; --apply executes).
--wait: with --apply: wait for each phase to become ACTIVE (or deleted) before the next.
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna policy push