import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * A Regional Secret is a logical secret whose value and versions can be created and accessed within a region only.
 *
 * To get more information about RegionalSecret, see:
 *
 * * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.locations.secrets)
 * * How-to Guides
 *     * [Create and deploy a Regional Secret](https://cloud.google.com/secret-manager/regional-secrets/create-regional-secret)
 *
 * ## Example Usage
 *
 * ### Regional Secret Config Basic
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const regional_secret_basic = new gcp.secretmanager.RegionalSecret("regional-secret-basic", {
 *     secretId: "tf-reg-secret",
 *     location: "us-central1",
 *     labels: {
 *         label: "my-label",
 *     },
 *     annotations: {
 *         key1: "value1",
 *         key2: "value2",
 *         key3: "value3",
 *     },
 *     deletionProtection: false,
 * });
 * ```
 * ### Regional Secret With Cmek
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const project = gcp.organizations.getProject({});
 * const kms_secret_binding = new gcp.kms.CryptoKeyIAMMember("kms-secret-binding", {
 *     cryptoKeyId: "kms-key",
 *     role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
 *     member: project.then(project => `serviceAccount:service-${project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com`),
 * });
 * const regional_secret_with_cmek = new gcp.secretmanager.RegionalSecret("regional-secret-with-cmek", {
 *     secretId: "tf-reg-secret",
 *     location: "us-central1",
 *     customerManagedEncryption: {
 *         kmsKeyName: "kms-key",
 *     },
 * }, {
 *     dependsOn: [kms_secret_binding],
 * });
 * ```
 * ### Regional Secret With Rotation
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const project = gcp.organizations.getProject({});
 * const topic = new gcp.pubsub.Topic("topic", {name: "tf-topic"});
 * const secretsManagerAccess = new gcp.pubsub.TopicIAMMember("secrets_manager_access", {
 *     topic: topic.name,
 *     role: "roles/pubsub.publisher",
 *     member: project.then(project => `serviceAccount:service-${project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com`),
 * });
 * const regional_secret_with_rotation = new gcp.secretmanager.RegionalSecret("regional-secret-with-rotation", {
 *     secretId: "tf-reg-secret",
 *     location: "us-central1",
 *     topics: [{
 *         name: topic.id,
 *     }],
 *     rotation: {
 *         rotationPeriod: "3600s",
 *         nextRotationTime: "2045-11-30T00:00:00Z",
 *     },
 * }, {
 *     dependsOn: [secretsManagerAccess],
 * });
 * ```
 * ### Regional Secret With Ttl
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const regional_secret_with_ttl = new gcp.secretmanager.RegionalSecret("regional-secret-with-ttl", {
 *     secretId: "tf-reg-secret",
 *     location: "us-central1",
 *     labels: {
 *         label: "my-label",
 *     },
 *     annotations: {
 *         key1: "value1",
 *         key2: "value2",
 *         key3: "value3",
 *     },
 *     ttl: "36000s",
 * });
 * ```
 * ### Regional Secret With Expire Time
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const regional_secret_with_expire_time = new gcp.secretmanager.RegionalSecret("regional-secret-with-expire-time", {
 *     secretId: "tf-reg-secret",
 *     location: "us-central1",
 *     labels: {
 *         label: "my-label",
 *     },
 *     annotations: {
 *         key1: "value1",
 *         key2: "value2",
 *         key3: "value3",
 *     },
 *     expireTime: "2055-11-30T00:00:00Z",
 * });
 * ```
 * ### Regional Secret With Version Destroy Ttl
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const regional_secret_with_version_destroy_ttl = new gcp.secretmanager.RegionalSecret("regional-secret-with-version-destroy-ttl", {
 *     secretId: "tf-reg-secret",
 *     location: "us-central1",
 *     labels: {
 *         label: "my-label",
 *     },
 *     annotations: {
 *         key1: "value1",
 *         key2: "value2",
 *         key3: "value3",
 *     },
 *     versionDestroyTtl: "86400s",
 * });
 * ```
 *
 * ## Import
 *
 * RegionalSecret can be imported using any of these accepted formats:
 *
 * * `projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}`
 *
 * * `{{project}}/{{location}}/{{secret_id}}`
 *
 * * `{{location}}/{{secret_id}}`
 *
 * When using the `pulumi import` command, RegionalSecret can be imported using one of the formats above. For example:
 *
 * ```sh
 * $ pulumi import gcp:secretmanager/regionalSecret:RegionalSecret default projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}
 * ```
 *
 * ```sh
 * $ pulumi import gcp:secretmanager/regionalSecret:RegionalSecret default {{project}}/{{location}}/{{secret_id}}
 * ```
 *
 * ```sh
 * $ pulumi import gcp:secretmanager/regionalSecret:RegionalSecret default {{location}}/{{secret_id}}
 * ```
 */
export declare class RegionalSecret extends pulumi.CustomResource {
    /**
     * Get an existing RegionalSecret resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: RegionalSecretState, opts?: pulumi.CustomResourceOptions): RegionalSecret;
    /**
     * Returns true if the given object is an instance of RegionalSecret.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is RegionalSecret;
    /**
     * Custom metadata about the regional secret.
     * Annotations are distinct from various forms of labels. Annotations exist to allow
     * client tools to store their own state information without requiring a database.
     * Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
     * maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
     * may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
     * symbols.
     * The total size of annotation keys and values must be less than 16KiB.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     *
     * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
     * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource.
     */
    readonly annotations: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * The time at which the regional secret was created.
     */
    readonly createTime: pulumi.Output<string>;
    /**
     * The customer-managed encryption configuration of the regional secret.
     * Structure is documented below.
     */
    readonly customerManagedEncryption: pulumi.Output<outputs.secretmanager.RegionalSecretCustomerManagedEncryption | undefined>;
    readonly deletionProtection: pulumi.Output<boolean | undefined>;
    readonly effectiveAnnotations: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
     */
    readonly effectiveLabels: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on
     * output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with
     * nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and
     * "2014-10-02T15:01:23.045123456Z". Only one of `expireTime` or `ttl` can be provided.
     */
    readonly expireTime: pulumi.Output<string>;
    /**
     * The labels assigned to this regional secret.
     * Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
     * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
     * Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
     * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
     * No more than 64 labels can be assigned to a given resource.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field `effectiveLabels` for all of the labels present on the resource.
     */
    readonly labels: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * The location of the regional secret. eg us-central1
     */
    readonly location: pulumi.Output<string>;
    /**
     * The resource name of the regional secret. Format:
     * `projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}`
     */
    readonly name: pulumi.Output<string>;
    /**
     * The ID of the project in which the resource belongs.
     * If it is not provided, the provider project is used.
     */
    readonly project: pulumi.Output<string>;
    /**
     * The combination of labels configured directly on the resource
     * and default labels configured on the provider.
     */
    readonly pulumiLabels: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * The rotation time and period for a regional secret. At `nextRotationTime`, Secret Manager
     * will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be
     * set to configure rotation.
     * Structure is documented below.
     */
    readonly rotation: pulumi.Output<outputs.secretmanager.RegionalSecretRotation | undefined>;
    /**
     * This must be unique within the project.
     */
    readonly secretId: pulumi.Output<string>;
    /**
     * A map of resource manager tags.
     * Resource manager tag keys and values have the same definition as resource manager tags.
     * Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}.
     */
    readonly tags: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * A list of up to 10 Pub/Sub topics to which messages are published when control plane
     * operations are called on the regional secret or its versions.
     * Structure is documented below.
     */
    readonly topics: pulumi.Output<outputs.secretmanager.RegionalSecretTopic[] | undefined>;
    /**
     * The TTL for the regional secret. A duration in seconds with up to nine fractional digits,
     * terminated by 's'. Example: "3.5s". Only one of `ttl` or `expireTime` can be provided.
     */
    readonly ttl: pulumi.Output<string | undefined>;
    /**
     * Mapping from version alias to version name.
     * A version alias is a string with a maximum length of 63 characters and can contain
     * uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
     * characters. An alias string must start with a letter and cannot be the string
     * 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     */
    readonly versionAliases: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * Secret Version TTL after destruction request.
     * This is a part of the delayed delete feature on Secret Version.
     * For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
     * on calling destroy instead the version goes to a disabled state and
     * the actual destruction happens after this TTL expires. It must be atleast 24h.
     */
    readonly versionDestroyTtl: pulumi.Output<string | undefined>;
    /**
     * Create a RegionalSecret resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: RegionalSecretArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering RegionalSecret resources.
 */
export interface RegionalSecretState {
    /**
     * Custom metadata about the regional secret.
     * Annotations are distinct from various forms of labels. Annotations exist to allow
     * client tools to store their own state information without requiring a database.
     * Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
     * maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
     * may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
     * symbols.
     * The total size of annotation keys and values must be less than 16KiB.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     *
     * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
     * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource.
     */
    annotations?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * The time at which the regional secret was created.
     */
    createTime?: pulumi.Input<string>;
    /**
     * The customer-managed encryption configuration of the regional secret.
     * Structure is documented below.
     */
    customerManagedEncryption?: pulumi.Input<inputs.secretmanager.RegionalSecretCustomerManagedEncryption>;
    deletionProtection?: pulumi.Input<boolean>;
    effectiveAnnotations?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
     */
    effectiveLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on
     * output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with
     * nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and
     * "2014-10-02T15:01:23.045123456Z". Only one of `expireTime` or `ttl` can be provided.
     */
    expireTime?: pulumi.Input<string>;
    /**
     * The labels assigned to this regional secret.
     * Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
     * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
     * Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
     * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
     * No more than 64 labels can be assigned to a given resource.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field `effectiveLabels` for all of the labels present on the resource.
     */
    labels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * The location of the regional secret. eg us-central1
     */
    location?: pulumi.Input<string>;
    /**
     * The resource name of the regional secret. Format:
     * `projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}`
     */
    name?: pulumi.Input<string>;
    /**
     * The ID of the project in which the resource belongs.
     * If it is not provided, the provider project is used.
     */
    project?: pulumi.Input<string>;
    /**
     * The combination of labels configured directly on the resource
     * and default labels configured on the provider.
     */
    pulumiLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * The rotation time and period for a regional secret. At `nextRotationTime`, Secret Manager
     * will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be
     * set to configure rotation.
     * Structure is documented below.
     */
    rotation?: pulumi.Input<inputs.secretmanager.RegionalSecretRotation>;
    /**
     * This must be unique within the project.
     */
    secretId?: pulumi.Input<string>;
    /**
     * A map of resource manager tags.
     * Resource manager tag keys and values have the same definition as resource manager tags.
     * Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * A list of up to 10 Pub/Sub topics to which messages are published when control plane
     * operations are called on the regional secret or its versions.
     * Structure is documented below.
     */
    topics?: pulumi.Input<pulumi.Input<inputs.secretmanager.RegionalSecretTopic>[]>;
    /**
     * The TTL for the regional secret. A duration in seconds with up to nine fractional digits,
     * terminated by 's'. Example: "3.5s". Only one of `ttl` or `expireTime` can be provided.
     */
    ttl?: pulumi.Input<string>;
    /**
     * Mapping from version alias to version name.
     * A version alias is a string with a maximum length of 63 characters and can contain
     * uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
     * characters. An alias string must start with a letter and cannot be the string
     * 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     */
    versionAliases?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Secret Version TTL after destruction request.
     * This is a part of the delayed delete feature on Secret Version.
     * For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
     * on calling destroy instead the version goes to a disabled state and
     * the actual destruction happens after this TTL expires. It must be atleast 24h.
     */
    versionDestroyTtl?: pulumi.Input<string>;
}
/**
 * The set of arguments for constructing a RegionalSecret resource.
 */
export interface RegionalSecretArgs {
    /**
     * Custom metadata about the regional secret.
     * Annotations are distinct from various forms of labels. Annotations exist to allow
     * client tools to store their own state information without requiring a database.
     * Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
     * maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
     * may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
     * symbols.
     * The total size of annotation keys and values must be less than 16KiB.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     *
     * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
     * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource.
     */
    annotations?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * The customer-managed encryption configuration of the regional secret.
     * Structure is documented below.
     */
    customerManagedEncryption?: pulumi.Input<inputs.secretmanager.RegionalSecretCustomerManagedEncryption>;
    deletionProtection?: pulumi.Input<boolean>;
    /**
     * Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on
     * output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with
     * nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and
     * "2014-10-02T15:01:23.045123456Z". Only one of `expireTime` or `ttl` can be provided.
     */
    expireTime?: pulumi.Input<string>;
    /**
     * The labels assigned to this regional secret.
     * Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
     * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
     * Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
     * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
     * No more than 64 labels can be assigned to a given resource.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field `effectiveLabels` for all of the labels present on the resource.
     */
    labels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * The location of the regional secret. eg us-central1
     */
    location: pulumi.Input<string>;
    /**
     * The ID of the project in which the resource belongs.
     * If it is not provided, the provider project is used.
     */
    project?: pulumi.Input<string>;
    /**
     * The rotation time and period for a regional secret. At `nextRotationTime`, Secret Manager
     * will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be
     * set to configure rotation.
     * Structure is documented below.
     */
    rotation?: pulumi.Input<inputs.secretmanager.RegionalSecretRotation>;
    /**
     * This must be unique within the project.
     */
    secretId: pulumi.Input<string>;
    /**
     * A map of resource manager tags.
     * Resource manager tag keys and values have the same definition as resource manager tags.
     * Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * A list of up to 10 Pub/Sub topics to which messages are published when control plane
     * operations are called on the regional secret or its versions.
     * Structure is documented below.
     */
    topics?: pulumi.Input<pulumi.Input<inputs.secretmanager.RegionalSecretTopic>[]>;
    /**
     * The TTL for the regional secret. A duration in seconds with up to nine fractional digits,
     * terminated by 's'. Example: "3.5s". Only one of `ttl` or `expireTime` can be provided.
     */
    ttl?: pulumi.Input<string>;
    /**
     * Mapping from version alias to version name.
     * A version alias is a string with a maximum length of 63 characters and can contain
     * uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
     * characters. An alias string must start with a letter and cannot be the string
     * 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
     * An object containing a list of "key": value pairs. Example:
     * { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     */
    versionAliases?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Secret Version TTL after destruction request.
     * This is a part of the delayed delete feature on Secret Version.
     * For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
     * on calling destroy instead the version goes to a disabled state and
     * the actual destruction happens after this TTL expires. It must be atleast 24h.
     */
    versionDestroyTtl?: pulumi.Input<string>;
}