import * as pulumi from "@pulumi/pulumi";
/**
 * Access state from an AWS S3 bucket.
 */
export declare function getS3Reference(args: GetS3ReferenceArgs, opts?: pulumi.InvokeOptions): Promise<GetS3ReferenceResult>;
export interface GetS3ReferenceArgs {
    /**
     * AWS access key.
     */
    accessKey?: string;
    /**
     * The duration, in seconds, of the assume role session.
     */
    assumeRoleDurationSeconds?: number;
    /**
     * IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
     */
    assumeRolePolicy?: string;
    /**
     * Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
     */
    assumeRolePolicyArns?: string[];
    /**
     * Assume role session tags.
     */
    assumeRoleTags?: {
        [key: string]: string;
    };
    /**
     * Assume role session tag keys to pass to any subsequent sessions.
     */
    assumeRoleTransitiveTagKeys?: string[];
    /**
     * The name of the S3 bucket.
     */
    bucket: string;
    /**
     * Whether to enable server side encryption of the state file.
     */
    encrypt?: boolean;
    /**
     * A custom endpoint for the S3 API.
     */
    endpoint?: string;
    /**
     * The external ID to use when assuming the role.
     */
    externalId?: string;
    /**
     * Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
     */
    forcePathStyle?: boolean;
    /**
     * A custom endpoint for the IAM API.
     */
    iamEndpoint?: string;
    /**
     * The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
     */
    key: string;
    /**
     * The ARN of a KMS Key to use for encrypting the state.
     */
    kmsKeyId?: string;
    /**
     * The maximum number of times an AWS API request is retried on retryable failure.
     */
    maxRetries?: number;
    /**
     * AWS profile name as set in the shared credentials file.
     */
    profile?: string;
    /**
     * AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
     */
    region?: string;
    /**
     * The ARN of an IAM Role to be assumed in order to read the state.
     */
    roleArn?: string;
    /**
     * AWS secret key.
     */
    secretKey?: string;
    /**
     * The session name to use when assuming the role.
     */
    sessionName?: string;
    /**
     * Path to a shared credentials file.
     */
    sharedCredentialsFile?: string;
    /**
     * Skip the credentials validation via the STS API.
     */
    skipCredentialsValidation?: boolean;
    /**
     * Skip the AWS Metadata API check.
     */
    skipMetadataApiCheck?: boolean;
    /**
     * Skip static validation of region name.
     */
    skipRegionValidation?: boolean;
    /**
     * The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
     */
    sseCustomerKey?: string;
    /**
     * A custom endpoint for the STS API.
     */
    stsEndpoint?: string;
    /**
     * AWS session token.
     */
    token?: string;
    /**
     * The Terraform workspace to read state from.
     */
    workspace?: string;
    /**
     * The prefix applied to the non-default state path inside the bucket.
     */
    workspaceKeyPrefix?: string;
}
/**
 * The result of fetching from a Terraform state store.
 */
export interface GetS3ReferenceResult {
    /**
     * The outputs displayed from Terraform state.
     */
    readonly outputs: {
        [key: string]: any;
    };
}
/**
 * Access state from an AWS S3 bucket.
 */
export declare function getS3ReferenceOutput(args: GetS3ReferenceOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetS3ReferenceResult>;
export interface GetS3ReferenceOutputArgs {
    /**
     * AWS access key.
     */
    accessKey?: pulumi.Input<string | undefined>;
    /**
     * The duration, in seconds, of the assume role session.
     */
    assumeRoleDurationSeconds?: pulumi.Input<number | undefined>;
    /**
     * IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
     */
    assumeRolePolicy?: pulumi.Input<string | undefined>;
    /**
     * Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
     */
    assumeRolePolicyArns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * Assume role session tags.
     */
    assumeRoleTags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
    /**
     * Assume role session tag keys to pass to any subsequent sessions.
     */
    assumeRoleTransitiveTagKeys?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * The name of the S3 bucket.
     */
    bucket: pulumi.Input<string>;
    /**
     * Whether to enable server side encryption of the state file.
     */
    encrypt?: pulumi.Input<boolean | undefined>;
    /**
     * A custom endpoint for the S3 API.
     */
    endpoint?: pulumi.Input<string | undefined>;
    /**
     * The external ID to use when assuming the role.
     */
    externalId?: pulumi.Input<string | undefined>;
    /**
     * Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
     */
    forcePathStyle?: pulumi.Input<boolean | undefined>;
    /**
     * A custom endpoint for the IAM API.
     */
    iamEndpoint?: pulumi.Input<string | undefined>;
    /**
     * The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
     */
    key: pulumi.Input<string>;
    /**
     * The ARN of a KMS Key to use for encrypting the state.
     */
    kmsKeyId?: pulumi.Input<string | undefined>;
    /**
     * The maximum number of times an AWS API request is retried on retryable failure.
     */
    maxRetries?: pulumi.Input<number | undefined>;
    /**
     * AWS profile name as set in the shared credentials file.
     */
    profile?: pulumi.Input<string | undefined>;
    /**
     * AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
     */
    region?: pulumi.Input<string | undefined>;
    /**
     * The ARN of an IAM Role to be assumed in order to read the state.
     */
    roleArn?: pulumi.Input<string | undefined>;
    /**
     * AWS secret key.
     */
    secretKey?: pulumi.Input<string | undefined>;
    /**
     * The session name to use when assuming the role.
     */
    sessionName?: pulumi.Input<string | undefined>;
    /**
     * Path to a shared credentials file.
     */
    sharedCredentialsFile?: pulumi.Input<string | undefined>;
    /**
     * Skip the credentials validation via the STS API.
     */
    skipCredentialsValidation?: pulumi.Input<boolean | undefined>;
    /**
     * Skip the AWS Metadata API check.
     */
    skipMetadataApiCheck?: pulumi.Input<boolean | undefined>;
    /**
     * Skip static validation of region name.
     */
    skipRegionValidation?: pulumi.Input<boolean | undefined>;
    /**
     * The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
     */
    sseCustomerKey?: pulumi.Input<string | undefined>;
    /**
     * A custom endpoint for the STS API.
     */
    stsEndpoint?: pulumi.Input<string | undefined>;
    /**
     * AWS session token.
     */
    token?: pulumi.Input<string | undefined>;
    /**
     * The Terraform workspace to read state from.
     */
    workspace?: pulumi.Input<string | undefined>;
    /**
     * The prefix applied to the non-default state path inside the bucket.
     */
    workspaceKeyPrefix?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=getS3Reference.d.ts.map