import * as core from "@terrascript/core";
export interface VgwTelemetryArgs extends core.SchemaArgs {
    acceptedRouteCount: number | core.NumberOut;
    certificateArn: string | core.StringOut;
    lastStatusChange: string | core.StringOut;
    outsideIpAddress: string | core.StringOut;
    status: string | core.StringOut;
    statusMessage: string | core.StringOut;
}
export declare class VgwTelemetry extends core.Schema<VgwTelemetryArgs> {
    acceptedRouteCount: number | core.NumberOut;
    certificateArn: string | core.StringOut;
    lastStatusChange: string | core.StringOut;
    outsideIpAddress: string | core.StringOut;
    status: string | core.StringOut;
    statusMessage: string | core.StringOut;
}
export interface RoutesArgs extends core.SchemaArgs {
    destinationCidrBlock: string | core.StringOut;
    source: string | core.StringOut;
    state: string | core.StringOut;
}
export declare class Routes extends core.Schema<RoutesArgs> {
    destinationCidrBlock: string | core.StringOut;
    source: string | core.StringOut;
    state: string | core.StringOut;
}
export interface ConnectionArgs extends core.ResourceArgs {
    /**
     * (Required) The ID of the customer gateway.
     */
    customerGatewayId: string | core.StringOut;
    /**
     * (Optional, Default `false`) Indicate whether to enable acceleration for the VPN connection. Supports
     * only EC2 Transit Gateway.
     */
    enableAcceleration?: boolean | core.BooleanOut;
    /**
     * (Optional, Default `0.0.0.0/0`) The IPv4 CIDR on the customer gateway (on-premises) side of the VPN
     * connection.
     */
    localIpv4NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN conne
     * ction.
     */
    localIpv6NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `PublicIpv4`) Indicates if a Public S2S VPN or Private S2S VPN over AWS Direct Co
     * nnect. Valid values are `PublicIpv4 | PrivateIpv4`
     */
    outsideIpAddressType?: string | core.StringOut;
    /**
     * (Optional, Default `0.0.0.0/0`) The IPv4 CIDR on the AWS side of the VPN connection.
     */
    remoteIpv4NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN conne
     * ction.
     */
    remoteIpv6NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `false`) Whether the VPN connection uses static routes exclusively. Static routes
     * must be used for devices that don't support BGP.
     */
    staticRoutesOnly?: boolean | core.BooleanOut;
    /**
     * (Optional) Tags to apply to the connection. If configured with a provider [`default_tags` configurat
     * ion block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configurat
     * ion-block) present, tags with matching keys will overwrite those defined at the provider-level.
     */
    tags?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * A map of tags assigned to the resource, including those inherited from the provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-
     * configuration-block).
     */
    tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * (Optional) The ID of the EC2 Transit Gateway.
     */
    transitGatewayId?: string | core.StringOut;
    /**
     * (Required when outside_ip_address_type is set to `PrivateIpv4`). The attachment ID of the Transit Ga
     * teway attachment to Direct Connect Gateway. The ID is obtained through a data source only.
     */
    transportTransitGatewayAttachmentId?: string | core.StringOut;
    /**
     * (Optional, Default `clear`) The action to take after DPD timeout occurs for the first VPN tunnel. Sp
     * ecify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are
     * clear | none | restart`.
     */
    tunnel1DpdTimeoutAction?: string | core.StringOut;
    /**
     * (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the first VPN tu
     * nnel. Valid value is equal or higher than `30`.
     */
    tunnel1DpdTimeoutSeconds?: number | core.NumberOut;
    /**
     * (Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are `ikev1 | i
     * kev2`.
     */
    tunnel1IkeVersions?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) The CIDR block of the inside IP addresses for the first VPN tunnel. Valid value is a size
     * /30 CIDR block from the 169.254.0.0/16 range.
     */
    tunnel1InsideCidr?: string | core.StringOut;
    /**
     * (Optional) The range of inside IPv6 addresses for the first VPN tunnel. Supports only EC2 Transit Ga
     * teway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
     */
    tunnel1InsideIpv6Cidr?: string | core.StringOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tun
     * nel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22
     * | 23 | 24`.
     */
    tunnel1Phase1DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for
     * phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel1Phase1EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1
     * IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel1Phase1IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel
     * , in seconds. Valid value is between `900` and `28800`.
     */
    tunnel1Phase1LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tun
     * nel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 |
     * 22 | 23 | 24`.
     */
    tunnel1Phase2DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for
     * phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel1Phase2EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) List of one or more integrity algorithms that are permitted for the first VPN tunnel for
     * phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel1Phase2IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel,
     * in seconds. Valid value is between `900` and `3600`.
     */
    tunnel1Phase2LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) The preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 cha
     * racters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, per
     * iods(.) and underscores(_).
     */
    tunnel1PresharedKey?: string | core.StringOut;
    /**
     * (Optional, Default `100`) The percentage of the rekey window for the first VPN tunnel (determined by
     * tunnel1_rekey_margin_time_seconds`) during which the rekey time is randomly selected. Valid value
     * is between `0` and `100`.
     */
    tunnel1RekeyFuzzPercentage?: number | core.NumberOut;
    /**
     * (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during w
     * hich the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is
     * randomly selected based on the value for `tunnel1_rekey_fuzz_percentage`. Valid value is between `60
     * and half of `tunnel1_phase2_lifetime_seconds`.
     */
    tunnel1RekeyMarginTimeSeconds?: number | core.NumberOut;
    /**
     * (Optional, Default `1024`) The number of packets in an IKE replay window for the first VPN tunnel. V
     * alid value is between `64` and `2048`.
     */
    tunnel1ReplayWindowSize?: number | core.NumberOut;
    /**
     * (Optional, Default `add`) The action to take when the establishing the tunnel for the first VPN conn
     * ection. By default, your customer gateway device must initiate the IKE negotiation and bring up the
     * tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
     */
    tunnel1StartupAction?: string | core.StringOut;
    /**
     * (Optional, Default `clear`) The action to take after DPD timeout occurs for the second VPN tunnel. S
     * pecify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are
     * clear | none | restart`.
     */
    tunnel2DpdTimeoutAction?: string | core.StringOut;
    /**
     * (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the second VPN t
     * unnel. Valid value is equal or higher than `30`.
     */
    tunnel2DpdTimeoutSeconds?: number | core.NumberOut;
    /**
     * (Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are `ikev1 |
     * ikev2`.
     */
    tunnel2IkeVersions?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) The CIDR block of the inside IP addresses for the second VPN tunnel. Valid value is a siz
     * e /30 CIDR block from the 169.254.0.0/16 range.
     */
    tunnel2InsideCidr?: string | core.StringOut;
    /**
     * (Optional) The range of inside IPv6 addresses for the second VPN tunnel. Supports only EC2 Transit G
     * ateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
     */
    tunnel2InsideIpv6Cidr?: string | core.StringOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tu
     * nnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22
     * | 23 | 24`.
     */
    tunnel2Phase1DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel fo
     * r phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel2Phase1EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) One or more integrity algorithms that are permitted for the second VPN tunnel for phase 1
     * IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel2Phase1IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the second VPN tunne
     * l, in seconds. Valid value is between `900` and `28800`.
     */
    tunnel2Phase1LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tu
     * nnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 |
     * 22 | 23 | 24`.
     */
    tunnel2Phase2DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel fo
     * r phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel2Phase2EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for
     * phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel2Phase2IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel
     * , in seconds. Valid value is between `900` and `3600`.
     */
    tunnel2Phase2LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) The preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 ch
     * aracters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, pe
     * riods(.) and underscores(_).
     */
    tunnel2PresharedKey?: string | core.StringOut;
    /**
     * (Optional, Default `100`) The percentage of the rekey window for the second VPN tunnel (determined b
     * y `tunnel2_rekey_margin_time_seconds`) during which the rekey time is randomly selected. Valid value
     * is between `0` and `100`.
     */
    tunnel2RekeyFuzzPercentage?: number | core.NumberOut;
    /**
     * (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during w
     * hich the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is
     * randomly selected based on the value for `tunnel2_rekey_fuzz_percentage`. Valid value is between `6
     * 0` and half of `tunnel2_phase2_lifetime_seconds`.
     */
    tunnel2RekeyMarginTimeSeconds?: number | core.NumberOut;
    /**
     * (Optional, Default `1024`) The number of packets in an IKE replay window for the second VPN tunnel.
     * Valid value is between `64` and `2048`.
     */
    tunnel2ReplayWindowSize?: number | core.NumberOut;
    /**
     * (Optional, Default `add`) The action to take when the establishing the tunnel for the second VPN con
     * nection. By default, your customer gateway device must initiate the IKE negotiation and bring up the
     * tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
     */
    tunnel2StartupAction?: string | core.StringOut;
    /**
     * (Optional, Default `ipv4`) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid valu
     * es are `ipv4 | ipv6`. `ipv6` Supports only EC2 Transit Gateway.
     */
    tunnelInsideIpVersion?: string | core.StringOut;
    /**
     * (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
     */
    type: string | core.StringOut;
    /**
     * (Optional) The ID of the Virtual Private Gateway.
     */
    vpnGatewayId?: string | core.StringOut;
}
export declare class Connection extends core.Resource<ConnectionArgs> {
    /**
     * Amazon Resource Name (ARN) of the VPN Connection.
     */
    arn: string | core.StringOut;
    /**
     * The ARN of the core network.
     */
    coreNetworkArn: string | core.StringOut;
    /**
     * The ARN of the core network attachment.
     */
    coreNetworkAttachmentArn: string | core.StringOut;
    /**
     * The configuration information for the VPN connection's customer gateway (in the native XML format).
     */
    customerGatewayConfiguration: string | core.StringOut;
    /**
     * (Required) The ID of the customer gateway.
     */
    customerGatewayId: string | core.StringOut;
    /**
     * (Optional, Default `false`) Indicate whether to enable acceleration for the VPN connection. Supports
     * only EC2 Transit Gateway.
     */
    enableAcceleration?: boolean | core.BooleanOut;
    /**
     * The amazon-assigned ID of the VPN connection.
     */
    id: string | core.StringOut;
    /**
     * (Optional, Default `0.0.0.0/0`) The IPv4 CIDR on the customer gateway (on-premises) side of the VPN
     * connection.
     */
    localIpv4NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN conne
     * ction.
     */
    localIpv6NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `PublicIpv4`) Indicates if a Public S2S VPN or Private S2S VPN over AWS Direct Co
     * nnect. Valid values are `PublicIpv4 | PrivateIpv4`
     */
    outsideIpAddressType?: string | core.StringOut;
    /**
     * (Optional, Default `0.0.0.0/0`) The IPv4 CIDR on the AWS side of the VPN connection.
     */
    remoteIpv4NetworkCidr?: string | core.StringOut;
    /**
     * (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN conne
     * ction.
     */
    remoteIpv6NetworkCidr?: string | core.StringOut;
    /**
     * The static routes associated with the VPN connection. Detailed below.
     */
    routes: core.Array<Routes> | core.ArrayOut<Routes>;
    /**
     * (Optional, Default `false`) Whether the VPN connection uses static routes exclusively. Static routes
     * must be used for devices that don't support BGP.
     */
    staticRoutesOnly?: boolean | core.BooleanOut;
    /**
     * (Optional) Tags to apply to the connection. If configured with a provider [`default_tags` configurat
     * ion block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configurat
     * ion-block) present, tags with matching keys will overwrite those defined at the provider-level.
     */
    tags?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * A map of tags assigned to the resource, including those inherited from the provider [`default_tags`
     * configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-
     * configuration-block).
     */
    tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
    /**
     * When associated with an EC2 Transit Gateway (`transit_gateway_id` argument), the attachment ID. See
     * also the [`aws_ec2_tag` resource](/docs/providers/aws/r/ec2_tag.html) for tagging the EC2 Transit Ga
     * teway VPN Attachment.
     */
    transitGatewayAttachmentId: string | core.StringOut;
    /**
     * (Optional) The ID of the EC2 Transit Gateway.
     */
    transitGatewayId?: string | core.StringOut;
    /**
     * (Required when outside_ip_address_type is set to `PrivateIpv4`). The attachment ID of the Transit Ga
     * teway attachment to Direct Connect Gateway. The ID is obtained through a data source only.
     */
    transportTransitGatewayAttachmentId?: string | core.StringOut;
    /**
     * The public IP address of the first VPN tunnel.
     */
    tunnel1Address: string | core.StringOut;
    /**
     * The bgp asn number of the first VPN tunnel.
     */
    tunnel1BgpAsn: string | core.StringOut;
    /**
     * The bgp holdtime of the first VPN tunnel.
     */
    tunnel1BgpHoldtime: number | core.NumberOut;
    /**
     * The RFC 6890 link-local address of the first VPN tunnel (Customer Gateway Side).
     */
    tunnel1CgwInsideAddress: string | core.StringOut;
    /**
     * (Optional, Default `clear`) The action to take after DPD timeout occurs for the first VPN tunnel. Sp
     * ecify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are
     * clear | none | restart`.
     */
    tunnel1DpdTimeoutAction?: string | core.StringOut;
    /**
     * (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the first VPN tu
     * nnel. Valid value is equal or higher than `30`.
     */
    tunnel1DpdTimeoutSeconds?: number | core.NumberOut;
    /**
     * (Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are `ikev1 | i
     * kev2`.
     */
    tunnel1IkeVersions?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) The CIDR block of the inside IP addresses for the first VPN tunnel. Valid value is a size
     * /30 CIDR block from the 169.254.0.0/16 range.
     */
    tunnel1InsideCidr?: string | core.StringOut;
    /**
     * (Optional) The range of inside IPv6 addresses for the first VPN tunnel. Supports only EC2 Transit Ga
     * teway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
     */
    tunnel1InsideIpv6Cidr?: string | core.StringOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tun
     * nel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22
     * | 23 | 24`.
     */
    tunnel1Phase1DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for
     * phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel1Phase1EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1
     * IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel1Phase1IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel
     * , in seconds. Valid value is between `900` and `28800`.
     */
    tunnel1Phase1LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tun
     * nel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 |
     * 22 | 23 | 24`.
     */
    tunnel1Phase2DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for
     * phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel1Phase2EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) List of one or more integrity algorithms that are permitted for the first VPN tunnel for
     * phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel1Phase2IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel,
     * in seconds. Valid value is between `900` and `3600`.
     */
    tunnel1Phase2LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) The preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 cha
     * racters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, per
     * iods(.) and underscores(_).
     */
    tunnel1PresharedKey?: string | core.StringOut;
    /**
     * (Optional, Default `100`) The percentage of the rekey window for the first VPN tunnel (determined by
     * tunnel1_rekey_margin_time_seconds`) during which the rekey time is randomly selected. Valid value
     * is between `0` and `100`.
     */
    tunnel1RekeyFuzzPercentage?: number | core.NumberOut;
    /**
     * (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during w
     * hich the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is
     * randomly selected based on the value for `tunnel1_rekey_fuzz_percentage`. Valid value is between `60
     * and half of `tunnel1_phase2_lifetime_seconds`.
     */
    tunnel1RekeyMarginTimeSeconds?: number | core.NumberOut;
    /**
     * (Optional, Default `1024`) The number of packets in an IKE replay window for the first VPN tunnel. V
     * alid value is between `64` and `2048`.
     */
    tunnel1ReplayWindowSize?: number | core.NumberOut;
    /**
     * (Optional, Default `add`) The action to take when the establishing the tunnel for the first VPN conn
     * ection. By default, your customer gateway device must initiate the IKE negotiation and bring up the
     * tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
     */
    tunnel1StartupAction?: string | core.StringOut;
    /**
     * The RFC 6890 link-local address of the first VPN tunnel (VPN Gateway Side).
     */
    tunnel1VgwInsideAddress: string | core.StringOut;
    /**
     * The public IP address of the second VPN tunnel.
     */
    tunnel2Address: string | core.StringOut;
    /**
     * The bgp asn number of the second VPN tunnel.
     */
    tunnel2BgpAsn: string | core.StringOut;
    /**
     * The bgp holdtime of the second VPN tunnel.
     */
    tunnel2BgpHoldtime: number | core.NumberOut;
    /**
     * The RFC 6890 link-local address of the second VPN tunnel (Customer Gateway Side).
     */
    tunnel2CgwInsideAddress: string | core.StringOut;
    /**
     * (Optional, Default `clear`) The action to take after DPD timeout occurs for the second VPN tunnel. S
     * pecify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are
     * clear | none | restart`.
     */
    tunnel2DpdTimeoutAction?: string | core.StringOut;
    /**
     * (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the second VPN t
     * unnel. Valid value is equal or higher than `30`.
     */
    tunnel2DpdTimeoutSeconds?: number | core.NumberOut;
    /**
     * (Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are `ikev1 |
     * ikev2`.
     */
    tunnel2IkeVersions?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) The CIDR block of the inside IP addresses for the second VPN tunnel. Valid value is a siz
     * e /30 CIDR block from the 169.254.0.0/16 range.
     */
    tunnel2InsideCidr?: string | core.StringOut;
    /**
     * (Optional) The range of inside IPv6 addresses for the second VPN tunnel. Supports only EC2 Transit G
     * ateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
     */
    tunnel2InsideIpv6Cidr?: string | core.StringOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tu
     * nnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22
     * | 23 | 24`.
     */
    tunnel2Phase1DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel fo
     * r phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel2Phase1EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) One or more integrity algorithms that are permitted for the second VPN tunnel for phase 1
     * IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel2Phase1IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the second VPN tunne
     * l, in seconds. Valid value is between `900` and `28800`.
     */
    tunnel2Phase1LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tu
     * nnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 |
     * 22 | 23 | 24`.
     */
    tunnel2Phase2DhGroupNumbers?: core.Array<number> | core.ArrayOut<core.NumberOut>;
    /**
     * (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel fo
     * r phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
     */
    tunnel2Phase2EncryptionAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for
     * phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
     */
    tunnel2Phase2IntegrityAlgorithms?: core.Array<string> | core.ArrayOut<core.StringOut>;
    /**
     * (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel
     * , in seconds. Valid value is between `900` and `3600`.
     */
    tunnel2Phase2LifetimeSeconds?: number | core.NumberOut;
    /**
     * (Optional) The preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 ch
     * aracters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, pe
     * riods(.) and underscores(_).
     */
    tunnel2PresharedKey?: string | core.StringOut;
    /**
     * (Optional, Default `100`) The percentage of the rekey window for the second VPN tunnel (determined b
     * y `tunnel2_rekey_margin_time_seconds`) during which the rekey time is randomly selected. Valid value
     * is between `0` and `100`.
     */
    tunnel2RekeyFuzzPercentage?: number | core.NumberOut;
    /**
     * (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during w
     * hich the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is
     * randomly selected based on the value for `tunnel2_rekey_fuzz_percentage`. Valid value is between `6
     * 0` and half of `tunnel2_phase2_lifetime_seconds`.
     */
    tunnel2RekeyMarginTimeSeconds?: number | core.NumberOut;
    /**
     * (Optional, Default `1024`) The number of packets in an IKE replay window for the second VPN tunnel.
     * Valid value is between `64` and `2048`.
     */
    tunnel2ReplayWindowSize?: number | core.NumberOut;
    /**
     * (Optional, Default `add`) The action to take when the establishing the tunnel for the second VPN con
     * nection. By default, your customer gateway device must initiate the IKE negotiation and bring up the
     * tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
     */
    tunnel2StartupAction?: string | core.StringOut;
    /**
     * The RFC 6890 link-local address of the second VPN tunnel (VPN Gateway Side).
     */
    tunnel2VgwInsideAddress: string | core.StringOut;
    /**
     * (Optional, Default `ipv4`) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid valu
     * es are `ipv4 | ipv6`. `ipv6` Supports only EC2 Transit Gateway.
     */
    tunnelInsideIpVersion?: string | core.StringOut;
    /**
     * (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
     */
    type: string | core.StringOut;
    /**
     * Telemetry for the VPN tunnels. Detailed below.
     */
    vgwTelemetry: core.Array<VgwTelemetry> | core.ArrayOut<VgwTelemetry>;
    /**
     * (Optional) The ID of the Virtual Private Gateway.
     */
    vpnGatewayId?: string | core.StringOut;
    constructor(name: string, args?: ConnectionArgs);
    getNamespace(): string;
}
//# sourceMappingURL=connection.d.ts.map