/** Pure parsers for resource identifiers used during failure diagnosis. */
/**
 * Parse an ECS service physical resource ID into cluster and service identifiers.
 *
 * The cluster portion is a name (not an ARN) — `describeServices`/`describeTasks`
 * accept either form for their `cluster` parameter, so this is fine downstream.
 *
 * Recognized formats:
 * - Long ARN: `arn:aws:ecs:region:account:service/cluster-name/service-name` (current default)
 * - Path: `cluster-name/service-name`
 * - Bare service name (uses the default cluster)
 */
export declare function parseEcsServiceIdentifier(physicalId: string): {
    cluster?: string;
    serviceName?: string;
};
/**
 * If a ServiceToken is an `Fn::GetAtt` or `Ref` intrinsic, return the referenced logical ID.
 */
export declare function serviceTokenReferencedLogicalId(serviceToken: any): string | undefined;
/**
 * Extract a Lambda function name from a function ARN or a bare name.
 *
 * Returns `undefined` for non-Lambda ARNs (e.g. an SNS-topic ServiceToken).
 */
export declare function functionNameFromArnOrName(arnOrName: string): string | undefined;
/**
 * Extract the log stream name out of a cfn-response failure reason
 * ("See the details in CloudWatch Log Stream: <name>").
 */
export declare function extractLogStreamName(message: string | undefined): string | undefined;
/**
 * cfn-response defaults the physical ID to the log stream name. Use it only when it looks
 * like a Lambda log stream (`YYYY/MM/DD/...`), so a user-provided physical ID isn't mistaken
 * for one.
 */
export declare function logStreamNameFromPhysicalId(physicalId: string | undefined): string | undefined;
export declare function ecsStoppedTasksConsoleUrl(region: string, cluster: string, serviceName: string): string;
/**
 * The trailing name segment of an ARN-shaped identifier (e.g. the role name out of a role
 * ARN), or `undefined` when the value has no path to strip.
 */
export declare function nameSegment(value: string): string | undefined;
/**
 * The session-name segment of an assumed-role ARN
 * (`arn:...:sts::<account>:assumed-role/<roleName>/<sessionName>`), or `undefined` for any
 * other shape.
 *
 * The session name identifies the actual caller: a Lambda execution role's session name is
 * the function name, while services assuming a role on a resource's behalf generate one
 * (e.g. `awslambda_110_...`).
 */
export declare function assumedRoleSessionName(arn: string): string | undefined;
/**
 * Whether an identity key occurs in an ARN as a whole segment.
 *
 * Segment-anchored on purpose: a bare substring test would let a key that is a prefix of
 * another resource's name (e.g. `my-svc-1` inside `my-svc-10`) claim that resource's events.
 * Single-segment keys (names, physical IDs) must equal a full `:`/`/`-delimited segment;
 * multi-segment keys (ARNs, path-shaped IDs) must be bounded by delimiters or string ends.
 */
export declare function identityMatches(haystack: string, key: string): boolean;
//# sourceMappingURL=resource-identifiers.d.ts.map