import * as iam from 'aws-cdk-lib/aws-iam';
import * as kms from 'aws-cdk-lib/aws-kms';
import type { IResource, ITaggableV2, RemovalPolicy, TagManager } from 'aws-cdk-lib/core';
import { Resource } from 'aws-cdk-lib/core';
import type { Construct } from 'constructs';
import { TableBucketPolicy } from './table-bucket-policy';
/**
 * Interface definition for S3 Table Buckets
 */
export interface ITableBucket extends IResource {
    /**
     * The ARN of the table bucket.
     * @attribute
     */
    readonly tableBucketArn: string;
    /**
     * The name of the table bucket.
     * @attribute
     */
    readonly tableBucketName: string;
    /**
     * The accountId containing the table bucket.
     * @attribute
     */
    readonly account?: string;
    /**
     * The region containing the table bucket.
     * @attribute
     */
    readonly region?: string;
    /**
     * Optional KMS encryption key associated with this table bucket.
     */
    readonly encryptionKey?: kms.IKey;
    /**
     * Adds a statement to the resource policy for a principal (i.e.
     * account/role/service) to perform actions on this table bucket and/or its
     * tables.
     *
     * Note that the policy statement may or may not be added to the policy.
     * For example, when an `ITableBucket` is created from an existing table bucket,
     * it's not possible to tell whether the bucket already has a policy
     * attached, let alone to re-use that policy to add more statements to it.
     * So it's safest to do nothing in these cases.
     *
     * @param statement the policy statement to be added to the bucket's
     * policy.
     * @returns metadata about the execution of this method. If the policy
     * was not added, the value of `statementAdded` will be `false`. You
     * should always check this value to make sure that the operation was
     * actually carried out. Otherwise, synthesis and deploy will terminate
     * silently, which may be confusing.
     */
    addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
    /**
     * Grant read permissions for this table bucket and its tables
     * to an IAM principal (Role/Group/User).
     *
     * If encryption is used, permission to use the key to decrypt the contents
     * of the bucket will also be granted to the same principal.
     *
     * @param identity The principal to allow read permissions to
     * @param tableId Allow the permissions to all tables using '*' or to single table by its unique ID.
     */
    grantRead(identity: iam.IGrantable, tableId: string): iam.Grant;
    /**
     * Grant write permissions for this table bucket and its tables
     * to an IAM principal (Role/Group/User).
     *
     * If encryption is used, permission to use the key to encrypt the contents
     * of the bucket will also be granted to the same principal.
     *
     * @param identity The principal to allow write permissions to
     * @param tableId Allow the permissions to all tables using '*' or to single table by its unique ID.
     */
    grantWrite(identity: iam.IGrantable, tableId: string): iam.Grant;
    /**
     * Grant read and write permissions for this table bucket and its tables
     * to an IAM principal (Role/Group/User).
     *
     * If encryption is used, permission to use the key to encrypt/decrypt the contents
     * of the bucket will also be granted to the same principal.
     *
     * @param identity The principal to allow read and write permissions to
     * @param tableId Allow the permissions to all tables using '*' or to single table by its unique ID.
     */
    grantReadWrite(identity: iam.IGrantable, tableId: string): iam.Grant;
}
/**
 * Unreferenced file removal settings for the this table bucket.
 */
export interface UnreferencedFileRemoval {
    /**
     * Duration after which noncurrent files should be removed. Should be at least one day.
     * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-table-buckets-maintenance.html
     *
     * @default - See S3 Tables User Guide
     */
    readonly noncurrentDays?: number;
    /**
     * Status of unreferenced file removal. Can be Enabled or Disabled.
     * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-table-buckets-maintenance.html
     *
     * @default - See S3 Tables User Guide
     */
    readonly status?: UnreferencedFileRemovalStatus;
    /**
     * Duration after which unreferenced files should be removed. Should be at least one day.
     * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-table-buckets-maintenance.html
     *
     * @default - See S3 Tables User Guide
     */
    readonly unreferencedDays?: number;
}
/**
 * Controls whether unreferenced file removal is enabled or disabled.
 */
export declare enum UnreferencedFileRemovalStatus {
    /**
     * Enable unreferenced file removal.
     */
    ENABLED = "Enabled",
    /**
     * Disable unreferenced file removal.
     */
    DISABLED = "Disabled"
}
/**
 * Controls whether CloudWatch request metrics are enabled or disabled for the table bucket.
 */
export declare enum RequestMetricsStatus {
    /**
     * Enable CloudWatch request metrics for the table bucket.
     */
    ENABLED = "Enabled",
    /**
     * Disable CloudWatch request metrics for the table bucket.
     */
    DISABLED = "Disabled"
}
/**
 * Storage class for S3 Tables.
 *
 * Determines the storage tier used for table data, allowing optimization
 * for different access patterns and cost profiles.
 */
export declare enum StorageClass {
    /**
     * Standard storage class for frequently accessed data.
     *
     * Use this for tables with consistent, high-frequency access patterns.
     */
    STANDARD = "STANDARD",
    /**
     * Intelligent-Tiering storage class that automatically moves data between access tiers.
     *
     * Use this for tables with unknown or changing access patterns to optimize costs
     * while maintaining performance for frequently accessed data.
     */
    INTELLIGENT_TIERING = "INTELLIGENT_TIERING"
}
/**
 * Controls Server Side Encryption (SSE) for this TableBucket.
 */
export declare enum TableBucketEncryption {
    /**
     * Use a customer defined KMS key for encryption
     * If `encryptionKey` is specified, this key will be used, otherwise, one will be defined.
     */
    KMS = "aws:kms",
    /**
     * Use S3 managed encryption keys with AES256 encryption
     */
    S3_MANAGED = "AES256"
}
declare abstract class TableBucketBase extends Resource implements ITableBucket {
    abstract readonly tableBucketArn: string;
    abstract readonly tableBucketName: string;
    /**
     * The resource policy associated with this table bucket.
     *
     * If `autoCreatePolicy` is true, a `TableBucketPolicy` will be created upon the
     * first call to addToResourcePolicy(s).
     */
    abstract tableBucketPolicy?: TableBucketPolicy;
    /**
     * Indicates if a table bucket resource policy should automatically created upon
     * the first call to `addToResourcePolicy`.
     */
    protected abstract autoCreatePolicy: boolean;
    abstract encryptionKey?: kms.IKey | undefined;
    /**
     * Adds a statement to the resource policy for a principal (i.e.
     * account/role/service) to perform actions on this table bucket and/or its
     * contents. Use `tableBucketArn` and `arnForObjects(keys)` to obtain ARNs for
     * this bucket or objects.
     *
     * Note that the policy statement may or may not be added to the policy.
     * For example, when an `ITableBucket` is created from an existing table bucket,
     * it's not possible to tell whether the bucket already has a policy
     * attached, let alone to re-use that policy to add more statements to it.
     * So it's safest to do nothing in these cases.
     *
     * @param statement the policy statement to be added to the bucket's
     * policy.
     * @returns metadata about the execution of this method. If the policy
     * was not added, the value of `statementAdded` will be `false`. You
     * should always check this value to make sure that the operation was
     * actually carried out. Otherwise, synthesis and deploy will terminate
     * silently, which may be confusing.
     */
    addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
    /**
     * [disable-awslint:no-grants]
     */
    grantRead(identity: iam.IGrantable, tableId: string): iam.Grant;
    /**
     * [disable-awslint:no-grants]
     */
    grantWrite(identity: iam.IGrantable, tableId: string): iam.Grant;
    /**
     * [disable-awslint:no-grants]
     */
    grantReadWrite(identity: iam.IGrantable, tableId: string): iam.Grant;
    /**
     * Grants the given s3tables permissions to the provided principal
     * @returns Grant object
     */
    private grant;
    private getTableArn;
}
/**
 * Parameters for constructing a TableBucket
 */
export interface TableBucketProps {
    /**
     * Name of the S3 TableBucket.
     * @link https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-buckets-naming.html#table-buckets-naming-rules
     *
     * When omitted, the auto-generated name is derived from the construct path and is
     * therefore not stable across stack or construct renames — pass an explicit name
     * when you need a fixed identifier across deployments.
     *
     * @default - generated by CDK from the stack and construct path.
     */
    readonly tableBucketName?: string;
    /**
     * Unreferenced file removal settings for the S3 TableBucket.
     * @link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3tables-tablebucket-unreferencedfileremoval.html
     * @default Enabled with default values
     * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-table-buckets-maintenance.html
     */
    readonly unreferencedFileRemoval?: UnreferencedFileRemoval;
    /**
     * AWS region that the table bucket exists in.
     *
     * @default - it's assumed the bucket is in the same region as the scope it's being imported into
     */
    readonly region?: string;
    /**
     * AWS Account ID of the table bucket owner.
     *
     * @default - it's assumed the bucket belongs to the same account as the scope it's being imported into
     */
    readonly account?: string;
    /**
     * The kind of server-side encryption to apply to this bucket.
     *
     * If you choose KMS, you can specify a KMS key via `encryptionKey`. If
     * encryption key is not specified, a key will automatically be created.
     *
     * @default - `KMS` if `encryptionKey` is specified, or `S3_MANAGED` otherwise.
     */
    readonly encryption?: TableBucketEncryption;
    /**
     * External KMS key to use for bucket encryption.
     *
     * The `encryption` property must be either not specified or set to `KMS`.
     * An error will be emitted if `encryption` is set to `S3_MANAGED`.
     *
     * @default - If `encryption` is set to `KMS` and this property is undefined,
     * a new KMS key will be created and associated with this bucket.
     */
    readonly encryptionKey?: kms.IKey;
    /**
     * Controls what happens to this table bucket it it stoped being managed by cloudformation.
     *
     * @default RETAIN
     */
    readonly removalPolicy?: RemovalPolicy;
    /**
     * CloudWatch request metrics configuration for the table bucket.
     *
     * When enabled, S3 Tables publishes CloudWatch request metrics for the table bucket.
     * Request metrics provide insight into Amazon S3 Tables requests.
     *
     * @default - Request metrics are disabled
     */
    readonly requestMetricsStatus?: RequestMetricsStatus;
    /**
     * The storage class for the table bucket.
     *
     * Determines the storage tier used for table data, allowing optimization
     * for different access patterns and cost profiles.
     *
     * @default - STANDARD storage class
     */
    readonly storageClass?: StorageClass;
}
/**
 * A reference to a table bucket outside this stack
 *
 * The tableBucketName, region, and account can be provided explicitly
 * or will be inferred from the tableBucketArn
 */
export interface TableBucketAttributes {
    /**
     * AWS region this table bucket exists in
     * @default region inferred from scope
     */
    readonly region?: string;
    /**
     * The accountId containing this table bucket
     * @default account inferred from scope
     */
    readonly account?: string;
    /**
     * The table bucket name, unique per region
     * @default tableBucketName inferred from arn
     */
    readonly tableBucketName?: string;
    /**
     * The table bucket's ARN.
     * @default tableBucketArn constructed from region, account and tableBucketName are provided
     */
    readonly tableBucketArn?: string;
    /**
     * Optional KMS encryption key associated with this bucket.
     * @default - undefined
     */
    readonly encryptionKey?: kms.IKey;
}
/**
 * An S3 table bucket with helpers for associated resource policies
 *
 * This bucket may not yet have all features that exposed by the underlying CfnTableBucket.
 *
 * @stateful
 * @example
 * const sampleTableBucket = new TableBucket(scope, 'ExampleTableBucket', {
 *   tableBucketName: 'example-bucket',
 *   // Optional fields:
 *   unreferencedFileRemoval: {
 *     noncurrentDays: 123,
 *     status: UnreferencedFileRemovalStatus.ENABLED,
 *     unreferencedDays: 123,
 *   },
 * });
 */
export declare class TableBucket extends TableBucketBase implements ITaggableV2 {
    /** Uniquely identifies this class. */
    static readonly PROPERTY_INJECTION_ID: string;
    /**
     * Defines a TableBucket construct from an external table bucket ARN.
     *
     * @param scope The parent creating construct (usually `this`).
     * @param id The construct's name.
     * @param tableBucketArn Amazon Resource Name (arn) of the table bucket
     */
    static fromTableBucketArn(scope: Construct, id: string, tableBucketArn: string): ITableBucket;
    /**
     * Defines a TableBucket construct that represents an external table bucket.
     *
     * @param scope The parent creating construct (usually `this`).
     * @param id The construct's name.
     * @param attrs A `TableBucketAttributes` object. Can be manually created.
     */
    static fromTableBucketAttributes(scope: Construct, id: string, attrs: TableBucketAttributes): ITableBucket;
    /**
     * Throws an exception if the given table bucket name is not valid.
     *
     * @param bucketName name of the bucket.
     */
    static validateTableBucketName(bucketName: string | undefined): void;
    /**
     * Throws an exception if the given unreferencedFileRemovalProperty is not valid.
     * @param unreferencedFileRemoval configuration for the table bucket
     */
    static validateUnreferencedFileRemoval(unreferencedFileRemoval?: UnreferencedFileRemoval): void;
    /**
     * The underlying CfnTableBucket L1 resource
     * @internal
     */
    private readonly resource;
    /**
     * The tag manager for this resource.
     */
    readonly cdkTagManager: TagManager;
    /**
     * The resource policy for this tableBucket.
     */
    readonly tableBucketPolicy?: TableBucketPolicy;
    readonly encryptionKey?: kms.IKey | undefined;
    protected autoCreatePolicy: boolean;
    constructor(scope: Construct, id: string, props?: TableBucketProps);
    /**
     * The name of this table bucket
     */
    get tableBucketName(): string;
    /**
     * The unique Amazon Resource Name (arn) of this table bucket
     */
    get tableBucketArn(): string;
    /**
     * Set up key properties and return the Bucket encryption property from the
     * user's configuration, according to the following table:
     *
     * | props.encryption | props.encryptionKey | bucketEncryption (return value) | encryptionKey (return value)  |
     * |------------------|---------------------|---------------------------------|-------------------------------|
     * | undefined        | undefined           | undefined                       | undefined                     |
     * | undefined        | k                   | aws:kms                         | k                             |
     * | KMS              | undefined           | aws:kms                         | new key (allow maintenance SP)|
     * | KMS              | k                   | aws:kms                         | k                             |
     * | S3_MANAGED       | undefined           | AES256                          | undefined                     |
     * | S3_MANAGED       | k                   | ERROR!                          | ERROR!                        |
     */
    private parseEncryption;
    /**
     * Allowlist S3 Tables Maintenance to access this table bucket's encryption key
     *
     * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-permissions.html
     * @param encryptionKey The key to provide access to
     */
    private allowTablesMaintenanceAccessToKey;
}
export {};