import * as pulumi from "@pulumi/pulumi";
/**
 * Use this resource to link an Oracle Cloud Infrastructure (OCI) account to New Relic.
 *
 * This setup is used to create a provider account with OCI credentials, establishing a relationship between Oracle and New Relic. Additionally, as part of this integration, we store WIF (Workload Identity Federation) credentials which are further used for fetching data and validations, and vault OCIDs corresponding to the vault resource where the New Relic ingest and user keys are stored in the OCI console.
 *
 * ## Prerequisites
 *
 * For the `newrelic.cloud.OciLinkAccount` resource to work properly, you need an OCI tenancy with IAM permissions to create and manage the identity artifacts (client/application, secrets, compartments, and service user) referenced below. OCI provides enterprise-grade cloud services across multiple global regions.
 *
 * > NOTE: Before using this resource, ensure the New Relic provider is configured with valid credentials.\
 * See Getting Started: New Relic provider guide
 *
 * If you encounter issues or bugs, please open an issue in the GitHub repository.
 *
 * ### Workload Identity Federation (WIF) Attributes
 *
 * The following arguments rely on an OCI Identity Domain OAuth2 client set up for workload identity federation (identity propagation): `ociClientId`, `ociClientSecret` and `ociDomainUrl`.
 *
 * To create and retrieve these values, follow Oracle's guidance for configuring identity propagation / JWT token exchange:
 *
 * [Oracle documentation: Create an identity propagation trust (JWT token exchange)](https://docs.oracle.com/en-us/iaas/Content/Identity/api-getstarted/json_web_token_exchange.htm#jwt_token_exchange__create-identity-propagation-trust)
 *
 * WIF configuration steps:
 * 1. Create (or identify) an Identity Domain and register an OAuth2 confidential application (client) to represent New Relic ingestion.
 * 2. Generate / record the client ID (`ociClientId`) and client secret (`ociClientSecret`). Store the secret securely (e.g., in OCI Vault; reference its OCID via `ingestVaultOcid` / `userVaultOcid` if desired).
 * 3. Use the Identity Domain base URL as `ociDomainUrl` (format: `https://idcs-<hash>.identity.oraclecloud.com`, with no port and no trailing slash).
 * 4. Ensure the client has the required scopes and the tenancy policies allow the token exchange.
 * 5. On the identity propagation trust, set `clientClaimName` to `aud` and `clientClaimValues` to your Identity Domain base URL. New Relic sets the JWT's `aud` claim to this URL, so this makes OCI reject any token issued for a different domain. The value must match `ociDomainUrl` exactly.
 *
 * > NOTE: `clientClaimValues` is matched as an exact string. If `ociDomainUrl` and the trust's value differ in any way — a trailing slash, a `:443` port — token exchange fails with HTTP 401.
 *
 * > TIP: Rotating the OAuth2 client secret only requires updating `ociClientSecret`; it does not force resource replacement.
 *
 * > TIP: The WIF setup module performs steps 1–5 for you, including the `aud` configuration.
 *
 * ## Example Usage
 *
 * Minimal example (required arguments for creation):
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as newrelic from "@pulumi/newrelic";
 *
 * const example = new newrelic.cloud.OciLinkAccount("example", {
 *     accountId: "1234567",
 *     tenantId: "ocid1.tenancy.oc1..aaaaaaaaexample",
 *     name: "my-oci-link",
 *     compartmentOcid: "ocid1.compartment.oc1..bbbbbbbbexample",
 *     ociClientId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
 *     ociClientSecret: ociClientSecret,
 *     ociDomainUrl: "https://idcs-1234567890abcdef.identity.oraclecloud.com",
 *     ociHomeRegion: "us-ashburn-1",
 * });
 * ```
 *
 * Example including optional secret references and update-only fields:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as newrelic from "@pulumi/newrelic";
 *
 * const full = new newrelic.cloud.OciLinkAccount("full", {
 *     name: "my-oci-link-full",
 *     tenantId: "ocid1.tenancy.oc1..aaaaaaaaexample",
 *     compartmentOcid: "ocid1.compartment.oc1..bbbbbbbbexample",
 *     ociClientId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
 *     ociClientSecret: ociClientSecret,
 *     ociDomainUrl: "https://idcs-1234567890abcdef.identity.oraclecloud.com",
 *     ociHomeRegion: "us-ashburn-1",
 *     ingestVaultOcid: "ocid1.vaultsecret.oc1..ccccccccexample",
 *     userVaultOcid: "ocid1.vaultsecret.oc1..ddddddddexample",
 *     instrumentationType: "METRICS,LOGS",
 *     ociRegion: "us-phoenix-1",
 *     metricStackOcid: "ocid1.stack.oc1..eeeeeeeeexample",
 *     loggingStackOcid: "ocid1.stack.oc1..ffffffloggingstack",
 * });
 * ```
 *
 * ## Import
 *
 * Linked OCI accounts can be imported using the `id`, e.g.
 *
 * ```sh
 * $ pulumi import newrelic:cloud/ociLinkAccount:OciLinkAccount foo <id>
 * ```
 */
export declare class OciLinkAccount extends pulumi.CustomResource {
    /**
     * Get an existing OciLinkAccount resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: OciLinkAccountState, opts?: pulumi.CustomResourceOptions): OciLinkAccount;
    /**
     * Returns true if the given object is an instance of OciLinkAccount.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is OciLinkAccount;
    /**
     * New Relic account to operate on. Overrides the provider-level `accountId`. If omitted, use the provider default or `NEW_RELIC_ACCOUNT_ID`.
     */
    readonly accountId: pulumi.Output<string>;
    /**
     * OCI compartment OCID representing (or containing) the monitored resources/newrelic compartment.
     */
    readonly compartmentOcid: pulumi.Output<string>;
    /**
     * Vault secret OCID containing an ingest secret.
     */
    readonly ingestVaultOcid: pulumi.Output<string | undefined>;
    /**
     * Specifies the type of integration, such as metrics, logs, or a combination of logs and metrics (e.g., `METRICS`, `LOGS`, `METRICS,LOGS`).
     */
    readonly instrumentationType: pulumi.Output<string | undefined>;
    /**
     * The Logging stack identifier for the OCI account.
     */
    readonly loggingStackOcid: pulumi.Output<string | undefined>;
    /**
     * Metric stack OCID (ignored on create, applied on update).
     */
    readonly metricStackOcid: pulumi.Output<string | undefined>;
    /**
     * Display name for the linked account.
     */
    readonly name: pulumi.Output<string>;
    /**
     * OCI Identity Domain (IDCS) OAuth2 client ID used for workload identity federation.
     */
    readonly ociClientId: pulumi.Output<string>;
    /**
     * OAuth2 client secret. Not displayed in plans or state outputs.
     */
    readonly ociClientSecret: pulumi.Output<string>;
    /**
     * Base URL of the OCI Identity Domain (e.g. `https://idcs-<hash>.identity.oraclecloud.com`).
     */
    readonly ociDomainUrl: pulumi.Output<string>;
    /**
     * Home region of the tenancy (e.g. `us-ashburn-1`).
     */
    readonly ociHomeRegion: pulumi.Output<string>;
    /**
     * OCI region for the linkage (ignored on create, applied on update).
     */
    readonly ociRegion: pulumi.Output<string | undefined>;
    /**
     * A value propagated as the `extResourceTag` claim on the RPST so customer IAM policies can scope authorization on a specific tag value (for example, `env=prod`). Ignored when `trustType = "UPST"`. Cannot be changed after creation.
     */
    readonly resourceTag: pulumi.Output<string | undefined>;
    /**
     * OCI tenancy OCID (root tenancy). Changing forces a new linked account.
     */
    readonly tenantId: pulumi.Output<string>;
    /**
     * The OCI WIF trust type. Allowed values are `UPST` (default) or `RPST`. Set this to `RPST` to use Resource Principal Session Token (claim-based) authorization instead of the default User Principal Session Token (service-user-based) flow. The corresponding identity propagation trust must be configured with the matching trust type in your OCI tenancy. Cannot be changed after creation — re-create the linked account to switch trust types. See the WIF setup module for details.
     */
    readonly trustType: pulumi.Output<string | undefined>;
    /**
     * Vault secret OCID containing a user or auxiliary secret.
     */
    readonly userVaultOcid: pulumi.Output<string | undefined>;
    /**
     * Create a OciLinkAccount resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: OciLinkAccountArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering OciLinkAccount resources.
 */
export interface OciLinkAccountState {
    /**
     * New Relic account to operate on. Overrides the provider-level `accountId`. If omitted, use the provider default or `NEW_RELIC_ACCOUNT_ID`.
     */
    accountId?: pulumi.Input<string | undefined>;
    /**
     * OCI compartment OCID representing (or containing) the monitored resources/newrelic compartment.
     */
    compartmentOcid?: pulumi.Input<string | undefined>;
    /**
     * Vault secret OCID containing an ingest secret.
     */
    ingestVaultOcid?: pulumi.Input<string | undefined>;
    /**
     * Specifies the type of integration, such as metrics, logs, or a combination of logs and metrics (e.g., `METRICS`, `LOGS`, `METRICS,LOGS`).
     */
    instrumentationType?: pulumi.Input<string | undefined>;
    /**
     * The Logging stack identifier for the OCI account.
     */
    loggingStackOcid?: pulumi.Input<string | undefined>;
    /**
     * Metric stack OCID (ignored on create, applied on update).
     */
    metricStackOcid?: pulumi.Input<string | undefined>;
    /**
     * Display name for the linked account.
     */
    name?: pulumi.Input<string | undefined>;
    /**
     * OCI Identity Domain (IDCS) OAuth2 client ID used for workload identity federation.
     */
    ociClientId?: pulumi.Input<string | undefined>;
    /**
     * OAuth2 client secret. Not displayed in plans or state outputs.
     */
    ociClientSecret?: pulumi.Input<string | undefined>;
    /**
     * Base URL of the OCI Identity Domain (e.g. `https://idcs-<hash>.identity.oraclecloud.com`).
     */
    ociDomainUrl?: pulumi.Input<string | undefined>;
    /**
     * Home region of the tenancy (e.g. `us-ashburn-1`).
     */
    ociHomeRegion?: pulumi.Input<string | undefined>;
    /**
     * OCI region for the linkage (ignored on create, applied on update).
     */
    ociRegion?: pulumi.Input<string | undefined>;
    /**
     * A value propagated as the `extResourceTag` claim on the RPST so customer IAM policies can scope authorization on a specific tag value (for example, `env=prod`). Ignored when `trustType = "UPST"`. Cannot be changed after creation.
     */
    resourceTag?: pulumi.Input<string | undefined>;
    /**
     * OCI tenancy OCID (root tenancy). Changing forces a new linked account.
     */
    tenantId?: pulumi.Input<string | undefined>;
    /**
     * The OCI WIF trust type. Allowed values are `UPST` (default) or `RPST`. Set this to `RPST` to use Resource Principal Session Token (claim-based) authorization instead of the default User Principal Session Token (service-user-based) flow. The corresponding identity propagation trust must be configured with the matching trust type in your OCI tenancy. Cannot be changed after creation — re-create the linked account to switch trust types. See the WIF setup module for details.
     */
    trustType?: pulumi.Input<string | undefined>;
    /**
     * Vault secret OCID containing a user or auxiliary secret.
     */
    userVaultOcid?: pulumi.Input<string | undefined>;
}
/**
 * The set of arguments for constructing a OciLinkAccount resource.
 */
export interface OciLinkAccountArgs {
    /**
     * New Relic account to operate on. Overrides the provider-level `accountId`. If omitted, use the provider default or `NEW_RELIC_ACCOUNT_ID`.
     */
    accountId?: pulumi.Input<string | undefined>;
    /**
     * OCI compartment OCID representing (or containing) the monitored resources/newrelic compartment.
     */
    compartmentOcid: pulumi.Input<string>;
    /**
     * Vault secret OCID containing an ingest secret.
     */
    ingestVaultOcid?: pulumi.Input<string | undefined>;
    /**
     * Specifies the type of integration, such as metrics, logs, or a combination of logs and metrics (e.g., `METRICS`, `LOGS`, `METRICS,LOGS`).
     */
    instrumentationType?: pulumi.Input<string | undefined>;
    /**
     * The Logging stack identifier for the OCI account.
     */
    loggingStackOcid?: pulumi.Input<string | undefined>;
    /**
     * Metric stack OCID (ignored on create, applied on update).
     */
    metricStackOcid?: pulumi.Input<string | undefined>;
    /**
     * Display name for the linked account.
     */
    name?: pulumi.Input<string | undefined>;
    /**
     * OCI Identity Domain (IDCS) OAuth2 client ID used for workload identity federation.
     */
    ociClientId: pulumi.Input<string>;
    /**
     * OAuth2 client secret. Not displayed in plans or state outputs.
     */
    ociClientSecret: pulumi.Input<string>;
    /**
     * Base URL of the OCI Identity Domain (e.g. `https://idcs-<hash>.identity.oraclecloud.com`).
     */
    ociDomainUrl: pulumi.Input<string>;
    /**
     * Home region of the tenancy (e.g. `us-ashburn-1`).
     */
    ociHomeRegion: pulumi.Input<string>;
    /**
     * OCI region for the linkage (ignored on create, applied on update).
     */
    ociRegion?: pulumi.Input<string | undefined>;
    /**
     * A value propagated as the `extResourceTag` claim on the RPST so customer IAM policies can scope authorization on a specific tag value (for example, `env=prod`). Ignored when `trustType = "UPST"`. Cannot be changed after creation.
     */
    resourceTag?: pulumi.Input<string | undefined>;
    /**
     * OCI tenancy OCID (root tenancy). Changing forces a new linked account.
     */
    tenantId: pulumi.Input<string>;
    /**
     * The OCI WIF trust type. Allowed values are `UPST` (default) or `RPST`. Set this to `RPST` to use Resource Principal Session Token (claim-based) authorization instead of the default User Principal Session Token (service-user-based) flow. The corresponding identity propagation trust must be configured with the matching trust type in your OCI tenancy. Cannot be changed after creation — re-create the linked account to switch trust types. See the WIF setup module for details.
     */
    trustType?: pulumi.Input<string | undefined>;
    /**
     * Vault secret OCID containing a user or auxiliary secret.
     */
    userVaultOcid?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=ociLinkAccount.d.ts.map