import * as core from "@terrascript/core";
export interface ReplicaExternalKeyArgs extends core.ResourceArgs {
    /**
     * (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
     */
    bypassPolicyLockoutSafetyCheck?: boolean | core.BooleanOut;
    /**
     * (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS d
     * eletes the KMS key.
     */
    deletionWindowInDays?: number | core.NumberOut;
    /**
     * (Optional) A description of the KMS key.
     */
    description?: string | core.StringOut;
    /**
     * (Optional) Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptog
     * raphic operations. Keys pending import can only be `false`. Imported keys default to `true` unless e
     * xpired.
     */
    enabled?: boolean | core.BooleanOut;
    /**
     * (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The KMS key is perman
     * ently associated with this key material. The same key material can be [reimported](https://docs.aws.
     * amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material), but you cannot impo
     * rt different key material.
     */
    keyMaterialBase64?: string | core.StringOut;
    /**
     * (Optional) The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS atta
     * ches the [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.htm
     * l#key-policy-default) to the KMS key.
     */
    policy?: string | core.StringOut;
    /**
     * (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a differ
     * ent AWS Region of the same AWS Partition. You can create only one replica of a given primary key in
     * each AWS Region.
     */
    primaryKeyArn: string | core.StringOut;
    /**
     * (Optional) A map of tags to assign to the replica key. If configured with a provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags
     * configuration-block) present, tags with matching keys will overwrite those defined at the provider-
     * level.
     */
    tags?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * A map of tags assigned to the resource, including those inherited from the provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-
     * configuration-block).
     */
    tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS d
     * eletes the key material and the key becomes unusable. If not specified, key material does not expire
     * . Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDT
     * HH:MM:SSZ`)
     */
    validTo?: string | core.StringOut;
}
export declare class ReplicaExternalKey extends core.Resource<ReplicaExternalKeyArgs> {
    /**
     * The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ
     * only in the Region value.
     */
    arn: string | core.StringOut;
    /**
     * (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
     */
    bypassPolicyLockoutSafetyCheck?: boolean | core.BooleanOut;
    /**
     * (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS d
     * eletes the KMS key.
     */
    deletionWindowInDays?: number | core.NumberOut;
    /**
     * (Optional) A description of the KMS key.
     */
    description?: string | core.StringOut;
    /**
     * (Optional) Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptog
     * raphic operations. Keys pending import can only be `false`. Imported keys default to `true` unless e
     * xpired.
     */
    enabled?: boolean | core.BooleanOut;
    /**
     * Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EX
     * PIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
     */
    expirationModel: string | core.StringOut;
    id: string | core.StringOut;
    /**
     * The key ID of the replica key. Related multi-Region keys have the same key ID.
     */
    keyId: string | core.StringOut;
    /**
     * (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The KMS key is perman
     * ently associated with this key material. The same key material can be [reimported](https://docs.aws.
     * amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material), but you cannot impo
     * rt different key material.
     */
    keyMaterialBase64?: string | core.StringOut;
    /**
     * The state of the replica key.
     */
    keyState: string | core.StringOut;
    /**
     * The [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#c
     * ryptographic-operations) for which you can use the KMS key. This is a shared property of multi-Regio
     * n keys.
     */
    keyUsage: string | core.StringOut;
    /**
     * (Optional) The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS atta
     * ches the [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.htm
     * l#key-policy-default) to the KMS key.
     */
    policy?: string | core.StringOut;
    /**
     * (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a differ
     * ent AWS Region of the same AWS Partition. You can create only one replica of a given primary key in
     * each AWS Region.
     */
    primaryKeyArn: string | core.StringOut;
    /**
     * (Optional) A map of tags to assign to the replica key. If configured with a provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags
     * configuration-block) present, tags with matching keys will overwrite those defined at the provider-
     * level.
     */
    tags?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * A map of tags assigned to the resource, including those inherited from the provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-
     * configuration-block).
     */
    tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS d
     * eletes the key material and the key becomes unusable. If not specified, key material does not expire
     * . Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDT
     * HH:MM:SSZ`)
     */
    validTo?: string | core.StringOut;
    constructor(name: string, args?: ReplicaExternalKeyArgs);
    getNamespace(): string;
}
//# sourceMappingURL=replica_external_key.d.ts.map