import * as core from "@terrascript/core";

export interface ConstraintsArgs extends core.SchemaArgs {
  encryptionContextEquals?:
    | core.Map<string, string>
    | core.MapOut<core.StringOut>;

  encryptionContextSubset?:
    | core.Map<string, string>
    | core.MapOut<core.StringOut>;
}

export class Constraints extends core.Schema<ConstraintsArgs> {
  @core.attr(String, { kind: "map" })
  public encryptionContextEquals?:
    | core.Map<string, string>
    | core.MapOut<core.StringOut>;

  @core.attr(String, { kind: "map" })
  public encryptionContextSubset?:
    | core.Map<string, string>
    | core.MapOut<core.StringOut>;
}

export interface GrantArgs extends core.ResourceArgs {
  /**
   * (Optional, Forces new resources) A structure that you can use to allow certain operations in the gra
   * nt only when the desired encryption context is present. For more information about encryption contex
   * t, see [Encryption Context](http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.
   * html).
   */
  constraints?: core.Array<Constraints> | core.ArrayOut<Constraints>;

  /**
   * (Optional, Forces new resources) A list of grant tokens to be used when creating the grant. See [Gra
   * nt Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token) for more
   * information about grant tokens.
   */
  grantCreationTokens?: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Required, Forces new resources) The principal that is given permission to perform the operations th
   * at the grant permits in ARN format. Note that due to eventual consistency issues around IAM principa
   * ls, terraform's state may not always be refreshed to reflect what is true in AWS.
   */
  granteePrincipal: string | core.StringOut;

  /**
   * (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the gr
   * ant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in
   * a different AWS account, you must use the key ARN.
   */
  keyId: string | core.StringOut;

  /**
   * (Optional, Forces new resources) A friendly name for identifying the grant.
   */
  name?: string | core.StringOut;

  /**
   * (Required, Forces new resources) A list of operations that the grant permits. The permitted values a
   * re: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncryptFrom`, `Re
   * EncryptTo`, `Sign`, `Verify`, `GetPublicKey`, `CreateGrant`, `RetireGrant`, `DescribeKey`, `Generate
   * DataKeyPair`, or `GenerateDataKeyPairWithoutPlaintext`.
   */
  operations: core.Array<string> | core.ArrayOut<core.StringOut>;

  retireOnDelete?: boolean | core.BooleanOut;

  /**
   * (Optional, Forces new resources) The principal that is given permission to retire the grant by using
   * RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM princi
   * pals, terraform's state may not always be refreshed to reflect what is true in AWS.
   */
  retiringPrincipal?: string | core.StringOut;
}

export class Grant extends core.Resource<GrantArgs> {
  /**
   * (Optional, Forces new resources) A structure that you can use to allow certain operations in the gra
   * nt only when the desired encryption context is present. For more information about encryption contex
   * t, see [Encryption Context](http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.
   * html).
   */
  @core.attr(Constraints, { kind: "array" })
  public constraints?: core.Array<Constraints> | core.ArrayOut<Constraints>;

  /**
   * (Optional, Forces new resources) A list of grant tokens to be used when creating the grant. See [Gra
   * nt Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token) for more
   * information about grant tokens.
   */
  @core.attr(String, { kind: "array" })
  public grantCreationTokens?:
    | core.Array<string>
    | core.ArrayOut<core.StringOut>;

  /**
   * The unique identifier for the grant.
   */
  @core.attr(String, { computed: true })
  public grantId!: string | core.StringOut;

  /**
   * The grant token for the created grant. For more information, see [Grant Tokens](http://docs.aws.amaz
   * on.com/kms/latest/developerguide/concepts.html#grant_token).
   */
  @core.attr(String, { computed: true })
  public grantToken!: string | core.StringOut;

  /**
   * (Required, Forces new resources) The principal that is given permission to perform the operations th
   * at the grant permits in ARN format. Note that due to eventual consistency issues around IAM principa
   * ls, terraform's state may not always be refreshed to reflect what is true in AWS.
   */
  @core.attr(String)
  public granteePrincipal!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the gr
   * ant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in
   * a different AWS account, you must use the key ARN.
   */
  @core.attr(String)
  public keyId!: string | core.StringOut;

  /**
   * (Optional, Forces new resources) A friendly name for identifying the grant.
   */
  @core.attr(String)
  public name?: string | core.StringOut;

  /**
   * (Required, Forces new resources) A list of operations that the grant permits. The permitted values a
   * re: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncryptFrom`, `Re
   * EncryptTo`, `Sign`, `Verify`, `GetPublicKey`, `CreateGrant`, `RetireGrant`, `DescribeKey`, `Generate
   * DataKeyPair`, or `GenerateDataKeyPairWithoutPlaintext`.
   */
  @core.attr(String, { kind: "array" })
  public operations!: core.Array<string> | core.ArrayOut<core.StringOut>;

  @core.attr(Boolean)
  public retireOnDelete?: boolean | core.BooleanOut;

  /**
   * (Optional, Forces new resources) The principal that is given permission to retire the grant by using
   * RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM princi
   * pals, terraform's state may not always be refreshed to reflect what is true in AWS.
   */
  @core.attr(String)
  public retiringPrincipal?: string | core.StringOut;

  constructor(name: string, args?: GrantArgs) {
    super(name, "aws_kms_grant", args);
  }

  public override getNamespace(): string {
    return "aws_kms";
  }
}