/**
 * Resolve the EC2 Name tag of the bastion/jumpbox for a given system.
 *
 * - Systems with an explicit ec2Tag in SYSTEM_CONFIGS (e.g. roma → 'bastion-host')
 *   use that verbatim without any STS call.
 * - All other systems (including empty string) derive `${alias}-jumpbox` from the
 *   AWS account ID, matching the lb tunnel behaviour (IOPS-1250 / IOPS-1285).
 *
 * @param system  - System name (e.g. 'roma', 'entity-management', '')
 * @param profile - AWS CLI profile name
 * @param verbose - When true, enables verbose logging
 * @returns EC2 Name tag string
 * @throws Error when the resolved account ID is not in the alias map
 */
export declare function resolveBastionTag(system: string, profile: string, verbose?: boolean): string;
/**
 * Resolve the internal ALB hostname for the account behind the given profile.
 *
 * Resolves the account ID via STS, then derives `<sub-domain>.int.paduasolutions.net`
 * (or the zone apex for production) from the account alias. This replaces the
 * previously hardcoded `dev.int.paduasolutions.net`, which sent every account's
 * lb tunnel to the development environment (IOPS-1312).
 *
 * @param profile - AWS CLI profile name
 * @param verbose - When true, enables verbose logging
 * @returns internal ALB host (e.g. `'preprod.int.paduasolutions.net'`)
 * @throws Error when the account is unknown or has no internal ALB
 */
export declare function resolveInternalAlbHost(profile: string, verbose?: boolean): string;
/**
 * Resolve the AWS account ID for the given profile by calling `aws sts get-caller-identity`.
 *
 * @param profile - AWS CLI profile name
 * @param verbose - when true, prints the resolved account ID to stdout
 * @returns 12-digit AWS account ID string
 * @throws Error if the STS call exits non-zero or output cannot be parsed
 */
export declare function resolveAccountId(profile: string, verbose?: boolean): string;
/**
 * Get EC2 instance ID by Name tag
 */
export declare function getInstanceIdByTag(tagName: string, profile: string, verbose?: boolean): string;
/**
 * Get RDS cluster endpoint (Aurora)
 */
export declare function getRdsClusterEndpoint(clusterName: string, profile: string, endpointType?: 'reader' | 'writer', verbose?: boolean): RdsEndpointInfo | null;
/**
 * Get RDS instance endpoint (non-Aurora)
 */
export declare function getRdsInstanceEndpoint(instanceName: string, profile: string, verbose?: boolean): RdsEndpointInfo | null;
/**
 * Get RDS endpoint - tries cluster first, then instance
 */
export declare function getRdsEndpoint(name: string, profile: string, verbose?: boolean): RdsEndpointInfo;
/**
 * RDS endpoint information including engine type
 */
export interface RdsEndpointInfo {
    endpoint: string;
    engine?: string;
}
/**
 * RDS database info for selection
 */
export interface RdsDatabase {
    name: string;
    type: 'cluster' | 'instance';
    engine?: string;
}
/**
 * OpenSearch domain info for selection
 */
export interface OpenSearchDomain {
    name: string;
    engineType: string;
}
/**
 * List all available OpenSearch domains
 */
export declare function listOpenSearchDomains(profile: string, verbose?: boolean): OpenSearchDomain[];
/**
 * Resolve the endpoint for an OpenSearch domain.
 * Prefers the VPC endpoint when available.
 */
export declare function getOpenSearchEndpoint(domainName: string, profile: string, verbose?: boolean): string;
/**
 * List all available RDS clusters and instances
 */
export declare function listRdsDatabases(profile: string, verbose?: boolean): RdsDatabase[];
//# sourceMappingURL=aws.d.ts.map