import * as core from "@terrascript/core";
export interface ExternalKeyArgs extends core.ResourceArgs {
    /**
     * (Optional) Specifies whether to disable the policy lockout check performed when creating or updating
     * the key's policy. Setting this value to `true` increases the risk that the key becomes unmanageable
     * . For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.co
     * m/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in t
     * he AWS Key Management Service Developer Guide. Defaults to `false`.
     */
    bypassPolicyLockoutSafetyCheck?: boolean | core.BooleanOut;
    /**
     * (Optional) Duration in days after which the key is deleted after destruction of the resource. Must b
     * e between `7` and `30` days. Defaults to `30`.
     */
    deletionWindowInDays?: number | core.NumberOut;
    /**
     * (Optional) Description of the key.
     */
    description?: string | core.StringOut;
    /**
     * (Optional) Specifies whether the key is enabled. Keys pending import can only be `false`. Imported k
     * eys default to `true` unless expired.
     */
    enabled?: boolean | core.BooleanOut;
    /**
     * (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanentl
     * y associated with this key material. The same key material can be reimported, but you cannot import
     * different key material.
     */
    keyMaterialBase64?: string | core.StringOut;
    /**
     * (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defau
     * lts to `false`.
     */
    multiRegion?: boolean | core.BooleanOut;
    /**
     * (Optional) A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a defaul
     * t key policy to the CMK.
     */
    policy?: string | core.StringOut;
    /**
     * (Optional) A key-value map of tags to assign to the key. If configured with a provider [`default_tag
     * s` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_ta
     * gs-configuration-block) present, tags with matching keys will overwrite those defined at the provide
     * r-level.
     */
    tags?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * A map of tags assigned to the resource, including those inherited from the provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-
     * configuration-block).
     */
    tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS d
     * eletes the key material and the CMK becomes unusable. If not specified, key material does not expire
     * . Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDT
     * HH:MM:SSZ`)
     */
    validTo?: string | core.StringOut;
}
export declare class ExternalKey extends core.Resource<ExternalKeyArgs> {
    /**
     * The Amazon Resource Name (ARN) of the key.
     */
    arn: string | core.StringOut;
    /**
     * (Optional) Specifies whether to disable the policy lockout check performed when creating or updating
     * the key's policy. Setting this value to `true` increases the risk that the key becomes unmanageable
     * . For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.co
     * m/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in t
     * he AWS Key Management Service Developer Guide. Defaults to `false`.
     */
    bypassPolicyLockoutSafetyCheck?: boolean | core.BooleanOut;
    /**
     * (Optional) Duration in days after which the key is deleted after destruction of the resource. Must b
     * e between `7` and `30` days. Defaults to `30`.
     */
    deletionWindowInDays?: number | core.NumberOut;
    /**
     * (Optional) Description of the key.
     */
    description?: string | core.StringOut;
    /**
     * (Optional) Specifies whether the key is enabled. Keys pending import can only be `false`. Imported k
     * eys default to `true` unless expired.
     */
    enabled?: boolean | core.BooleanOut;
    /**
     * Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EX
     * PIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
     */
    expirationModel: string | core.StringOut;
    /**
     * The unique identifier for the key.
     */
    id: string | core.StringOut;
    /**
     * (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanentl
     * y associated with this key material. The same key material can be reimported, but you cannot import
     * different key material.
     */
    keyMaterialBase64?: string | core.StringOut;
    /**
     * The state of the CMK.
     */
    keyState: string | core.StringOut;
    /**
     * The cryptographic operations for which you can use the CMK.
     */
    keyUsage: string | core.StringOut;
    /**
     * (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defau
     * lts to `false`.
     */
    multiRegion?: boolean | core.BooleanOut;
    /**
     * (Optional) A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a defaul
     * t key policy to the CMK.
     */
    policy?: string | core.StringOut;
    /**
     * (Optional) A key-value map of tags to assign to the key. If configured with a provider [`default_tag
     * s` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_ta
     * gs-configuration-block) present, tags with matching keys will overwrite those defined at the provide
     * r-level.
     */
    tags?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * A map of tags assigned to the resource, including those inherited from the provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-
     * configuration-block).
     */
    tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS d
     * eletes the key material and the CMK becomes unusable. If not specified, key material does not expire
     * . Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDT
     * HH:MM:SSZ`)
     */
    validTo?: string | core.StringOut;
    constructor(name: string, args?: ExternalKeyArgs);
    getNamespace(): string;
}
//# sourceMappingURL=external_key.d.ts.map