import * as core from "@terrascript/core";
export interface ConstraintsArgs extends core.SchemaArgs {
    encryptionContextEquals?: core.Map<string, string> | core.MapOut<core.StringOut>;
    encryptionContextSubset?: core.Map<string, string> | core.MapOut<core.StringOut>;
}
export declare class Constraints extends core.Schema<ConstraintsArgs> {
    encryptionContextEquals?: core.Map<string, string> | core.MapOut<core.StringOut>;
    encryptionContextSubset?: core.Map<string, string> | core.MapOut<core.StringOut>;
}
export interface GrantArgs extends core.ResourceArgs {
    /**
     * (Optional, Forces new resources) A structure that you can use to allow certain operations in the gra
     * nt only when the desired encryption context is present. For more information about encryption contex
     * t, see [Encryption Context](http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.
     * html).
     */
    constraints?: core.Array<Constraints> | core.ArrayOut<Constraints>;
    /**
     * (Optional, Forces new resources) A list of grant tokens to be used when creating the grant. See [Gra
     * nt Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token) for more
     * information about grant tokens.
     */
    grantCreationTokens?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Required, Forces new resources) The principal that is given permission to perform the operations th
     * at the grant permits in ARN format. Note that due to eventual consistency issues around IAM principa
     * ls, terraform's state may not always be refreshed to reflect what is true in AWS.
     */
    granteePrincipal: string | core.StringOut;
    /**
     * (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the gr
     * ant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in
     * a different AWS account, you must use the key ARN.
     */
    keyId: string | core.StringOut;
    /**
     * (Optional, Forces new resources) A friendly name for identifying the grant.
     */
    name?: string | core.StringOut;
    /**
     * (Required, Forces new resources) A list of operations that the grant permits. The permitted values a
     * re: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncryptFrom`, `Re
     * EncryptTo`, `Sign`, `Verify`, `GetPublicKey`, `CreateGrant`, `RetireGrant`, `DescribeKey`, `Generate
     * DataKeyPair`, or `GenerateDataKeyPairWithoutPlaintext`.
     */
    operations: core.Array<string> | core.ArrayOut<core.StringOut>;
    retireOnDelete?: boolean | core.BooleanOut;
    /**
     * (Optional, Forces new resources) The principal that is given permission to retire the grant by using
     * RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM princi
     * pals, terraform's state may not always be refreshed to reflect what is true in AWS.
     */
    retiringPrincipal?: string | core.StringOut;
}
export declare class Grant extends core.Resource<GrantArgs> {
    /**
     * (Optional, Forces new resources) A structure that you can use to allow certain operations in the gra
     * nt only when the desired encryption context is present. For more information about encryption contex
     * t, see [Encryption Context](http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.
     * html).
     */
    constraints?: core.Array<Constraints> | core.ArrayOut<Constraints>;
    /**
     * (Optional, Forces new resources) A list of grant tokens to be used when creating the grant. See [Gra
     * nt Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token) for more
     * information about grant tokens.
     */
    grantCreationTokens?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * The unique identifier for the grant.
     */
    grantId: string | core.StringOut;
    /**
     * The grant token for the created grant. For more information, see [Grant Tokens](http://docs.aws.amaz
     * on.com/kms/latest/developerguide/concepts.html#grant_token).
     */
    grantToken: string | core.StringOut;
    /**
     * (Required, Forces new resources) The principal that is given permission to perform the operations th
     * at the grant permits in ARN format. Note that due to eventual consistency issues around IAM principa
     * ls, terraform's state may not always be refreshed to reflect what is true in AWS.
     */
    granteePrincipal: string | core.StringOut;
    id: string | core.StringOut;
    /**
     * (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the gr
     * ant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in
     * a different AWS account, you must use the key ARN.
     */
    keyId: string | core.StringOut;
    /**
     * (Optional, Forces new resources) A friendly name for identifying the grant.
     */
    name?: string | core.StringOut;
    /**
     * (Required, Forces new resources) A list of operations that the grant permits. The permitted values a
     * re: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncryptFrom`, `Re
     * EncryptTo`, `Sign`, `Verify`, `GetPublicKey`, `CreateGrant`, `RetireGrant`, `DescribeKey`, `Generate
     * DataKeyPair`, or `GenerateDataKeyPairWithoutPlaintext`.
     */
    operations: core.Array<string> | core.ArrayOut<core.StringOut>;
    retireOnDelete?: boolean | core.BooleanOut;
    /**
     * (Optional, Forces new resources) The principal that is given permission to retire the grant by using
     * RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM princi
     * pals, terraform's state may not always be refreshed to reflect what is true in AWS.
     */
    retiringPrincipal?: string | core.StringOut;
    constructor(name: string, args?: GrantArgs);
    getNamespace(): string;
}
//# sourceMappingURL=grant.d.ts.map