import { Instance, InstanceProfile, Role, SecurityGroup } from "../generated/index.js";
/**
 * One inbound rule for the instance's security group. Exactly one of `cidr`,
 * `cidrIpv6`, or `sourceSecurityGroupId` selects the traffic source — the same
 * constraint CloudFormation enforces on `AWS::EC2::SecurityGroup.Ingress`.
 */
export interface Ec2InstanceBundleIngressRule {
    /** Starting port (or the only port, when `toPort` is omitted). */
    fromPort: number;
    /** Ending port of the range. Defaults to `fromPort` (a single port). */
    toPort?: number;
    /** IP protocol. Default: `"tcp"`. */
    protocol?: string;
    /** IPv4 CIDR source. */
    cidr?: string;
    /** IPv6 CIDR source. */
    cidrIpv6?: string;
    /** Security-group source (allow traffic from another SG rather than a CIDR). */
    sourceSecurityGroupId?: string;
    description?: string;
}
export interface Ec2InstanceBundleProps {
    /** AMI id to launch. */
    imageId: string;
    /** VPC the instance and its security group live in. */
    vpcId: string;
    /** Subnet the instance launches into — fixes its AZ and public/private placement. */
    subnetId: string;
    /** EC2 instance type. Default: `"t3.micro"`. */
    instanceType?: string;
    /** SSH key pair name. Omit for keyless access (e.g. SSM Session Manager only). */
    keyName?: string;
    /** Plain-text user-data script; wrapped in `Fn::Base64` for the instance. */
    userData?: string;
    /** Inbound security-group rules. Default: none (no inbound traffic). */
    ingress?: Ec2InstanceBundleIngressRule[];
    /** IAM managed policy ARNs attached to the instance role. */
    ManagedPolicyArns?: string[];
    /** Inline IAM policies attached to the instance role. */
    Policies?: ConstructorParameters<typeof Role>[0]["Policies"];
    defaults?: {
        role?: Partial<ConstructorParameters<typeof Role>[0]>;
        instanceProfile?: Partial<ConstructorParameters<typeof InstanceProfile>[0]>;
        sg?: Partial<ConstructorParameters<typeof SecurityGroup>[0]>;
        instance?: Partial<ConstructorParameters<typeof Instance>[0]>;
    };
}
/**
 * EC2 instance bundle — instance + security group + role/profile + subnet
 * placement, the hand-rolled unit the aws-bench corpus showed 25 times
 * (`ec2.Instance`) alongside 79 `ec2.SecurityGroup` instantiations (#1139).
 * `Ec2InstanceRole` already covers the role/profile half; this composite adds
 * the instance and its security group, wired to that same role.
 */
export declare const Ec2InstanceBundle: import("@intentius/chant").CompositeDefinition<Ec2InstanceBundleProps, {
    role: import("@intentius/chant").Declarable & Record<string, string>;
    instanceProfile: import("@intentius/chant").Declarable & Record<string, string>;
    sg: import("@intentius/chant").Declarable & Record<string, string>;
    instance: import("@intentius/chant").Declarable & Record<string, string>;
}>;
//# sourceMappingURL=ec2-instance-bundle.d.ts.map