import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages an AWS Bedrock AgentCore API Key Credential Provider. API Key credential providers enable secure authentication with external services that use API key-based authentication for agent runtimes.
 *
 * > **Note:** Write-Only argument `apiKeyWo` is available to use in place of `apiKey`. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.
 *
 * ## Example Usage
 *
 * ### Basic Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
 *     name: "example-api-key-provider",
 *     apiKey: "your-api-key-here",
 * });
 * ```
 *
 * ### Write-Only API Key (Recommended for Production)
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
 *     name: "example-api-key-provider",
 *     apiKeyWo: "your-api-key-here",
 *     apiKeyWoVersion: 1,
 * });
 * ```
 *
 * ### Customer-Managed Secret
 *
 * Reference an API key already stored in a customer-managed AWS Secrets Manager secret instead of having AgentCore create and manage one.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
 *     apiKeySecretConfig: {
 *         secretId: exampleAwsSecretsmanagerSecret.id,
 *         jsonKey: "apiKey",
 *     },
 *     name: "example-api-key-provider",
 *     apiKeySecretSource: "EXTERNAL",
 * });
 * ```
 *
 * ## Import
 *
 * ### Identity Schema
 *
 * #### Required
 *
 * * `name` (String) API key credential provider name.
 *
 * #### Optional
 *
 * * `accountId` (String) AWS Account where this resource is managed.
 * * `region` (String) Region where this resource is managed.
 *
 * Using `pulumi import`, import Bedrock AgentCore API Key Credential Provider using the provider name. For example:
 *
 * ```sh
 * $ pulumi import aws:bedrock/agentcoreApiKeyCredentialProvider:AgentcoreApiKeyCredentialProvider example example-api-key-provider
 * ```
 */
export declare class AgentcoreApiKeyCredentialProvider extends pulumi.CustomResource {
    /**
     * Get an existing AgentcoreApiKeyCredentialProvider resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AgentcoreApiKeyCredentialProviderState, opts?: pulumi.CustomResourceOptions): AgentcoreApiKeyCredentialProvider;
    /**
     * Returns true if the given object is an instance of AgentcoreApiKeyCredentialProvider.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is AgentcoreApiKeyCredentialProvider;
    /**
     * API key value. Conflicts with `apiKeyWo` and `apiKeySecretConfig`. This value will be visible in pulumi preview outputs and logs.
     */
    readonly apiKey: pulumi.Output<string | undefined>;
    /**
     * ARN of the AWS Secrets Manager secret containing the API key.
     */
    readonly apiKeySecretArns: pulumi.Output<outputs.bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretArn[]>;
    /**
     * Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires `apiKeySecretSource = "EXTERNAL"`. See below.
     */
    readonly apiKeySecretConfig: pulumi.Output<outputs.bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretConfig | undefined>;
    /**
     * Source of the secret backing the credential provider. Valid values are `MANAGED` (AgentCore creates and manages the secret from the supplied `apiKey`) and `EXTERNAL` (the provider references a customer-managed AWS Secrets Manager secret via `apiKeySecretConfig`). Changing between `MANAGED` and `EXTERNAL` forces replacement of the resource.
     */
    readonly apiKeySecretSource: pulumi.Output<string>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * Write-only API key value. Conflicts with `apiKey` and `apiKeySecretConfig`. If set, requires `apiKeyWoVersion` to be set.
     */
    readonly apiKeyWo: pulumi.Output<string | undefined>;
    /**
     * Required when `apiKeyWo` is set. Changing this value triggers an update to `apiKeyWo`.
     */
    readonly apiKeyWoVersion: pulumi.Output<number | undefined>;
    /**
     * ARN of the API Key credential provider.
     */
    readonly credentialProviderArn: pulumi.Output<string>;
    /**
     * Name of the API Key credential provider. Forces replacement when changed.
     *
     * The following arguments are optional:
     */
    readonly name: pulumi.Output<string>;
    /**
     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
     */
    readonly region: pulumi.Output<string>;
    /**
     * Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
     */
    readonly tags: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
     */
    readonly tagsAll: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * Create a AgentcoreApiKeyCredentialProvider resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: AgentcoreApiKeyCredentialProviderArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering AgentcoreApiKeyCredentialProvider resources.
 */
export interface AgentcoreApiKeyCredentialProviderState {
    /**
     * API key value. Conflicts with `apiKeyWo` and `apiKeySecretConfig`. This value will be visible in pulumi preview outputs and logs.
     */
    apiKey?: pulumi.Input<string | undefined>;
    /**
     * ARN of the AWS Secrets Manager secret containing the API key.
     */
    apiKeySecretArns?: pulumi.Input<pulumi.Input<inputs.bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretArn>[] | undefined>;
    /**
     * Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires `apiKeySecretSource = "EXTERNAL"`. See below.
     */
    apiKeySecretConfig?: pulumi.Input<inputs.bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretConfig | undefined>;
    /**
     * Source of the secret backing the credential provider. Valid values are `MANAGED` (AgentCore creates and manages the secret from the supplied `apiKey`) and `EXTERNAL` (the provider references a customer-managed AWS Secrets Manager secret via `apiKeySecretConfig`). Changing between `MANAGED` and `EXTERNAL` forces replacement of the resource.
     */
    apiKeySecretSource?: pulumi.Input<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * Write-only API key value. Conflicts with `apiKey` and `apiKeySecretConfig`. If set, requires `apiKeyWoVersion` to be set.
     */
    apiKeyWo?: pulumi.Input<string | undefined>;
    /**
     * Required when `apiKeyWo` is set. Changing this value triggers an update to `apiKeyWo`.
     */
    apiKeyWoVersion?: pulumi.Input<number | undefined>;
    /**
     * ARN of the API Key credential provider.
     */
    credentialProviderArn?: pulumi.Input<string | undefined>;
    /**
     * Name of the API Key credential provider. Forces replacement when changed.
     *
     * The following arguments are optional:
     */
    name?: pulumi.Input<string | undefined>;
    /**
     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
     */
    region?: pulumi.Input<string | undefined>;
    /**
     * Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
    /**
     * Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
     */
    tagsAll?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
}
/**
 * The set of arguments for constructing a AgentcoreApiKeyCredentialProvider resource.
 */
export interface AgentcoreApiKeyCredentialProviderArgs {
    /**
     * API key value. Conflicts with `apiKeyWo` and `apiKeySecretConfig`. This value will be visible in pulumi preview outputs and logs.
     */
    apiKey?: pulumi.Input<string | undefined>;
    /**
     * Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires `apiKeySecretSource = "EXTERNAL"`. See below.
     */
    apiKeySecretConfig?: pulumi.Input<inputs.bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretConfig | undefined>;
    /**
     * Source of the secret backing the credential provider. Valid values are `MANAGED` (AgentCore creates and manages the secret from the supplied `apiKey`) and `EXTERNAL` (the provider references a customer-managed AWS Secrets Manager secret via `apiKeySecretConfig`). Changing between `MANAGED` and `EXTERNAL` forces replacement of the resource.
     */
    apiKeySecretSource?: pulumi.Input<string | undefined>;
    /**
     * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
     * Write-only API key value. Conflicts with `apiKey` and `apiKeySecretConfig`. If set, requires `apiKeyWoVersion` to be set.
     */
    apiKeyWo?: pulumi.Input<string | undefined>;
    /**
     * Required when `apiKeyWo` is set. Changing this value triggers an update to `apiKeyWo`.
     */
    apiKeyWoVersion?: pulumi.Input<number | undefined>;
    /**
     * Name of the API Key credential provider. Forces replacement when changed.
     *
     * The following arguments are optional:
     */
    name?: pulumi.Input<string | undefined>;
    /**
     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
     */
    region?: pulumi.Input<string | undefined>;
    /**
     * Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
}
//# sourceMappingURL=agentcoreApiKeyCredentialProvider.d.ts.map