import * as core from "@terrascript/core";

export interface PermissionArgs extends core.ResourceArgs {
  /**
   * (Required) The actions that the specified AWS service principal can use. These include `IssueCertifi
   * cate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate c
   * ertificates issued by a PCA, it must be granted permission on all 3 actions, as per the example abov
   * e.
   */
  actions: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Required) The Amazon Resource Name (ARN) of the CA that grants the permissions.
   */
  certificateAuthorityArn: string | core.StringOut;

  /**
   * (Required) The AWS service or identity that receives the permission. At this time, the only valid pr
   * incipal is `acm.amazonaws.com`.
   */
  principal: string | core.StringOut;

  /**
   * (Optional) The ID of the calling account
   */
  sourceAccount?: string | core.StringOut;
}

export class Permission extends core.Resource<PermissionArgs> {
  /**
   * (Required) The actions that the specified AWS service principal can use. These include `IssueCertifi
   * cate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate c
   * ertificates issued by a PCA, it must be granted permission on all 3 actions, as per the example abov
   * e.
   */
  @core.attr(String, { kind: "array" })
  public actions!: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Required) The Amazon Resource Name (ARN) of the CA that grants the permissions.
   */
  @core.attr(String)
  public certificateAuthorityArn!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * The IAM policy that is associated with the permission.
   */
  @core.attr(String, { computed: true })
  public policy!: string | core.StringOut;

  /**
   * (Required) The AWS service or identity that receives the permission. At this time, the only valid pr
   * incipal is `acm.amazonaws.com`.
   */
  @core.attr(String)
  public principal!: string | core.StringOut;

  /**
   * (Optional) The ID of the calling account
   */
  @core.attr(String, { computed: true })
  public sourceAccount?: string | core.StringOut;

  constructor(name: string, args?: PermissionArgs) {
    super(name, "aws_acmpca_permission", args);
  }

  public override getNamespace(): string {
    return "aws_acmpca";
  }
}