/**
 * AWS Helper Utilities
 *
 * Shared functions for AWS SDK operations used across all AWS scanfix files.
 * Uses AWS SDK v3 clients instead of AWS CLI.
 */
import type * as Ec2 from '@aws-sdk/client-ec2';
import type * as Sts from '@aws-sdk/client-sts';
import type * as Iam from '@aws-sdk/client-iam';
import type * as Rds from '@aws-sdk/client-rds';
import type * as S3 from '@aws-sdk/client-s3';
import type * as Ecr from '@aws-sdk/client-ecr';
import type * as Ses from '@aws-sdk/client-ses';
import type * as Route53 from '@aws-sdk/client-route-53';
import type * as Ec2Ic from '@aws-sdk/client-ec2-instance-connect';
export declare function ec2Sdk(): typeof Ec2;
export declare function stsSdk(): typeof Sts;
export declare function iamSdk(): typeof Iam;
export declare function rdsSdk(): typeof Rds;
export declare function s3Sdk(): typeof S3;
export declare function ecrSdk(): typeof Ecr;
export declare function sesSdk(): typeof Ses;
export declare function route53Sdk(): typeof Route53;
export declare function ec2IcSdk(): typeof Ec2Ic;
import type { FactiiiConfig } from '../../../../types/index.js';
/**
 * Mark credential sync as failed — all subsequent AWS fixes should skip.
 */
export declare function setCredentialsSyncFailed(): void;
/**
 * Check if credential sync failed — if so, other AWS fixes should not run.
 */
export declare function didCredentialsSyncFail(): boolean;
interface LoadedCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    region: string;
}
export declare function getLoadedCredentials(): LoadedCredentials;
export declare function setLoadedCredentials(creds: LoadedCredentials): void;
export declare function clearLoadedCredentials(): void;
export declare function verifyCredentialsWithSts(accessKeyId: string, secretAccessKey: string, region: string): Promise<string | null>;
/**
 * Load AWS credentials from this repo's vault into the in-memory cache.
 *
 * - Idempotent: returns early if already loaded.
 * - Throws when ansible vault is not configured.
 * - Throws when vault has no AWS credentials (caller should run bootstrap fix).
 * - Does NOT prompt the user — pure read. Mismatch resolution lives in the
 *   aws-credentials-sync scanfix.
 */
export declare function loadAwsCredentials(config: FactiiiConfig, rootDir: string): Promise<void>;
/**
 * Clear all cached AWS SDK clients.
 * Call after swapping credentials (e.g. writing new ~/.aws/credentials)
 * so new clients pick up the updated credentials.
 */
export declare function clearClientCache(): void;
export declare function getEC2Client(region: string): Ec2.EC2Client;
export declare function getSTSClient(region: string): Sts.STSClient;
export declare function getIAMClient(region: string): Iam.IAMClient;
export declare function getRDSClient(region: string): Rds.RDSClient;
export declare function getS3Client(region: string): S3.S3Client;
export declare function getECRClient(region: string): Ecr.ECRClient;
export declare function getSESClient(region: string): Ses.SESClient;
export declare function getRoute53Client(region: string): Route53.Route53Client;
export declare function getEC2ICClient(region: string): Ec2Ic.EC2InstanceConnectClient;
/**
 * Build standard tags array for AWS resources
 */
export declare function buildTags(projectName: string, extraTags?: Record<string, string>): Ec2.Tag[];
/**
 * Build TagSpecification for resource creation
 */
export declare function tagSpec(resourceType: string, projectName: string, extraTags?: Record<string, string>): Ec2.TagSpecification;
/**
 * Build a filter for factiii:project tag
 */
export declare function projectFilter(projectName: string): Ec2.Filter;
/**
 * Extract AWS configuration from a FactiiiConfig
 */
export declare function getAwsConfig(config: FactiiiConfig): {
    region: string;
    configType: string;
    accessKeyId?: string;
};
/**
 * Check if running on server (skip AWS provisioning)
 */
export declare function isOnServer(): boolean;
/**
 * Confirm before running an AWS-mutating action (create/modify resource).
 *
 * Auto-approves and returns true in any of these contexts (where prompting
 * is impossible or undesirable):
 *   - STACK_AWS_AUTO_APPROVE=1
 *   - GITHUB_ACTIONS=true / FACTIII_ON_SERVER=true
 *   - non-interactive (no TTY)
 *
 * Otherwise prints the description block and prompts y/N. Default is N to
 * stop accidental provisioning during fix runs.
 *
 * Description format suggestion (multi-line is OK):
 *   "Create S3 bucket 'factiii-prod' (us-east-1, encrypted, public access blocked)"
 */
export declare function confirmAwsAction(description: string): Promise<boolean>;
/**
 * Get project name for tagging
 */
export declare function getProjectName(config: FactiiiConfig): string;
/**
 * Resource name overrides — let users adopt pre-existing AWS resources whose
 * names don't follow stack's `factiii-{project}-X` convention, without having
 * to rename them in AWS.
 *
 * Sources, by precedence (override wins):
 *   - `config.aws.<field>`
 *   - top-level `config.<field>` (legacy spot: ecr_repository)
 *   - convention default
 */
export interface ResourceNames {
    /** null means "use the auto-resolve flow" (try simple name, then accountId-scoped). */
    s3Bucket: string | null;
    rdsInstanceId: string;
    ecrRepository: string;
    ec2SecurityGroup: string;
    rdsSecurityGroup: string;
}
export declare function getResourceNames(config: FactiiiConfig): ResourceNames;
/**
 * Get AWS account ID via STS
 */
export declare function getAwsAccountId(region: string): Promise<string | null>;
/**
 * Get a human-readable identity string for the current AWS caller.
 * Shows access_key_id + user name instead of ARN, since ARNs are
 * unreadable without looking them up in the AWS console.
 */
export declare function getCallerArn(region: string): Promise<string | null>;
/**
 * Check if current AWS credentials have IAM management permissions
 */
export declare function canManageIam(region: string): Promise<boolean>;
/**
 * Get ECR authorization token via SDK (runs on dev machine).
 * Returns credentials for docker login — no AWS CLI needed on server.
 * Token is valid for 12 hours.
 */
export declare function getEcrAuthToken(region: string): Promise<{
    username: string;
    password: string;
    proxyEndpoint: string;
} | null>;
/**
 * Find VPC by factiii:project tag, or return `aws.vpc_id` override.
 */
export declare function findVpc(projectName: string, region: string, config?: FactiiiConfig): Promise<string | null>;
/**
 * Find subnet by tag and type, or return the corresponding override
 * (`aws.subnet_public_id` for type=public).
 */
export declare function findSubnet(projectName: string, region: string, type: string, config?: FactiiiConfig): Promise<string | null>;
/**
 * Find private subnets by tag, or return `aws.subnet_private_ids` override.
 */
export declare function findPrivateSubnets(projectName: string, region: string, config?: FactiiiConfig): Promise<string[]>;
/**
 * Find security group by name and VPC
 */
export declare function findSecurityGroup(groupName: string, vpcId: string, region: string): Promise<string | null>;
/**
 * Find EC2 key pair by name
 */
export declare function findKeyPair(keyName: string, region: string): Promise<boolean>;
/**
 * Find running/stopped EC2 instance by tag
 */
export declare function findInstance(projectName: string, region: string): Promise<string | null>;
/**
 * Get the public IP of the running EC2 instance for a project.
 * Falls back to Elastic IP if available. Used as DNS fallback when domain hasn't propagated.
 */
export declare function findInstancePublicIp(projectName: string, region: string): Promise<string | null>;
/**
 * Push a temporary SSH public key to an EC2 instance via EC2 Instance Connect.
 * The key is valid for 60 seconds — SSH must connect within that window.
 * Requires ec2-instance-connect agent on the instance (pre-installed on Ubuntu 22.04+).
 *
 * @returns true if the key was pushed successfully
 */
export declare function pushSshPublicKey(instanceId: string, osUser: string, sshPublicKey: string, region: string, availabilityZone?: string): Promise<boolean>;
/**
 * Find Elastic IP associated with an instance
 */
export declare function findElasticIp(instanceId: string, region: string): Promise<string | null>;
/**
 * Find internet gateway attached to VPC
 */
export declare function findIgw(vpcId: string, region: string): Promise<string | null>;
/**
 * Find DB subnet group
 */
export declare function findDbSubnetGroup(groupName: string, region: string): Promise<boolean>;
/**
 * Find RDS instance by identifier
 */
export declare function findRdsInstance(dbInstanceId: string, region: string): Promise<{
    status: string;
    endpoint: string | null;
} | null>;
/**
 * Find RDS instance endpoint
 */
export declare function findRdsEndpoint(projectName: string, region: string): Promise<string | null>;
/**
 * Check if ECR repository exists
 */
export declare function findEcrRepo(repoName: string, region: string): Promise<boolean>;
/**
 * Check if S3 bucket exists
 */
export declare function findBucket(bucketName: string, region: string): Promise<boolean>;
/**
 * Check if IAM user exists
 */
export declare function findIamUser(userName: string, region: string): Promise<boolean>;
/**
 * Check if domain is verified in SES
 */
export declare function isDomainVerified(domain: string, region: string): Promise<boolean>;
/**
 * Check if DKIM is configured for domain
 */
export declare function hasDkim(domain: string, region: string): Promise<boolean>;
/**
 * Check if S3 bucket has CORS configured
 */
export declare function hasCors(bucketName: string, region: string): Promise<boolean>;
/**
 * Check if AWS is configured for this project (shared guard)
 */
export declare function isAwsConfigured(config: FactiiiConfig): boolean;
/**
 * Find Route53 hosted zone for a domain
 * Returns the hosted zone ID if found, null otherwise
 */
export declare function findHostedZone(domain: string, region: string): Promise<string | null>;
/**
 * Find an A record in a hosted zone
 */
export declare function findARecord(domain: string, hostedZoneId: string, region: string): Promise<string | null>;
export {};
//# sourceMappingURL=aws-helpers.d.ts.map