import { ConstructFactoryGetInstanceProps, SsmEnvironmentEntry } from '@aws-amplify/plugin-types';
import { StorageAccessBuilder, StorageAccessGenerator } from './types.js';
import { StorageAccessPolicyFactory } from './storage_access_policy_factory.js';
import { StorageAccessConfig } from './private_types.js';
/**
 * Orchestrates the process of converting customer-defined storage access rules into corresponding IAM policies
 * and attaching those policies to the corresponding IAM roles
 */
export declare class StorageAccessOrchestrator {
    private readonly storageAccessGenerator;
    private readonly getInstanceProps;
    private readonly ssmEnvironmentEntries;
    private readonly policyFactory;
    private readonly validateStorageAccessPaths;
    private readonly roleAccessBuilder;
    /**
     * Maintains a mapping from a resource access acceptor to all of the access grants it has been configured with
     * Each entry of this map is fed into the policy generator to create a single policy for each acceptor
     */
    private acceptorAccessMap;
    /**
     * Maintains pointers to the "deny" StoragePath Set for each access entry in the map above
     * This map is used during a final pass over all the StoragePaths to deny access on any paths where explicit allow rules were not specified
     */
    private prefixDenyMap;
    /**
     * Instantiate with the access generator and other dependencies necessary for evaluating and constructing access policies
     * @param storageAccessGenerator The access callback defined by the customer
     * @param getInstanceProps props for fetching construct instances from the construct container
     * @param ssmEnvironmentEntries SSM context that should be passed to the ResourceAccessAcceptors when configuring access
     * @param policyFactory factory that generates IAM policies for various access control definitions
     * @param validateStorageAccessPaths validator function for checking access definition paths
     * @param roleAccessBuilder builder instance that is injected into the storageAccessGenerator to evaluate the rules
     */
    constructor(storageAccessGenerator: StorageAccessGenerator, getInstanceProps: ConstructFactoryGetInstanceProps, ssmEnvironmentEntries: SsmEnvironmentEntry[], policyFactory: StorageAccessPolicyFactory, validateStorageAccessPaths?: (storagePaths: string[]) => void, roleAccessBuilder?: StorageAccessBuilder);
    /**
     * Orchestrates the process of translating the customer-provided storage access rules into IAM policies and attaching those policies to the appropriate roles.
     *
     * The high level steps are:
     * 1. Invokes the storageAccessGenerator to produce a storageAccessDefinition
     * 2. Validates the paths in the storageAccessDefinition
     * 3. Organizes the storageAccessDefinition into internally managed maps to facilitate translation into allow / deny rules on IAM policies
     * 4. Invokes the policy generator to produce a policy with appropriate allow / deny rules
     * 5. Invokes the resourceAccessAcceptors for each entry in the storageAccessDefinition to accept the corresponding IAM policy
     */
    orchestrateStorageAccess: () => Record<string, StorageAccessConfig>;
    /**
     * Add an entry to the internal acceptorAccessMap and prefixDenyMap.
     * This entry defines a set of actions on a single s3 prefix that should be attached to a given ResourceAccessAcceptor
     */
    private addAccessDefinition;
    /**
     * Iterates over all of the access definitions that have been added to the orchestrator,
     * generates a policy for each accessMap,
     * and attaches the policy to the corresponding ResourceAccessAcceptor
     *
     * After this method is called, the existing access definition state is cleared.
     * This prevents multiple calls to this method from producing duplicate policies.
     * The class can continue to be used to build up state for a new set of policies if desired.
     * @param ssmEnvironmentEntries Additional SSM context that is passed to each ResourceAccessAcceptor
     */
    private attachPolicies;
    private setPrefixDenyMapEntry;
}
/**
 * This factory is really only necessary for allowing us to mock the StorageAccessOrchestrator in tests
 */
export declare class StorageAccessOrchestratorFactory {
    getInstance: (storageAccessGenerator: StorageAccessGenerator, getInstanceProps: ConstructFactoryGetInstanceProps, ssmEnvironmentEntries: SsmEnvironmentEntry[], policyFactory: StorageAccessPolicyFactory) => StorageAccessOrchestrator;
}
//# sourceMappingURL=storage_access_orchestrator.d.ts.map