import * as core from "@terrascript/core";

export interface PermissionArgs extends core.ResourceArgs {
  /**
   * (Required) The AWS Lambda action you want to allow in this statement. (e.g., `lambda:InvokeFunction`
   * )
   */
  action: string | core.StringOut;

  /**
   * (Optional) The Event Source Token to validate.  Used with [Alexa Skills][1].
   */
  eventSourceToken?: string | core.StringOut;

  /**
   * (Required) Name of the Lambda function whose resource policy you are updating
   */
  functionName: string | core.StringOut;

  /**
   * (Optional) Lambda Function URLs [authentication type][3]. Valid values are: `AWS_IAM` or `NONE`.
   */
  functionUrlAuthType?: string | core.StringOut;

  /**
   * (Required) The principal who is getting this permission e.g., `s3.amazonaws.com`, an AWS account ID,
   * or any valid AWS service principal such as `events.amazonaws.com` or `sns.amazonaws.com`.
   */
  principal: string | core.StringOut;

  /**
   * (Optional) The identifier for your organization in AWS Organizations. Use this to grant permissions
   * to all the AWS accounts under this organization.
   */
  principalOrgId?: string | core.StringOut;

  /**
   * (Optional) Query parameter to specify function version or alias name. The permission will then apply
   * to the specific qualified ARN e.g., `arn:aws:lambda:aws-region:acct-id:function:function-name:2`
   */
  qualifier?: string | core.StringOut;

  /**
   * (Optional) This parameter is used for S3 and SES. The AWS account ID (without a hyphen) of the sourc
   * e owner.
   */
  sourceAccount?: string | core.StringOut;

  /**
   * (Optional) When the principal is an AWS service, the ARN of the specific resource within that servic
   * e to grant permission to.
   */
  sourceArn?: string | core.StringOut;

  /**
   * (Optional) A unique statement identifier. By default generated by Terraform.
   */
  statementId?: string | core.StringOut;

  /**
   * (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `s
   * tatement_id`.
   */
  statementIdPrefix?: string | core.StringOut;
}

export class Permission extends core.Resource<PermissionArgs> {
  /**
   * (Required) The AWS Lambda action you want to allow in this statement. (e.g., `lambda:InvokeFunction`
   * )
   */
  @core.attr(String)
  public action!: string | core.StringOut;

  /**
   * (Optional) The Event Source Token to validate.  Used with [Alexa Skills][1].
   */
  @core.attr(String)
  public eventSourceToken?: string | core.StringOut;

  /**
   * (Required) Name of the Lambda function whose resource policy you are updating
   */
  @core.attr(String)
  public functionName!: string | core.StringOut;

  /**
   * (Optional) Lambda Function URLs [authentication type][3]. Valid values are: `AWS_IAM` or `NONE`.
   */
  @core.attr(String)
  public functionUrlAuthType?: string | core.StringOut;

  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Required) The principal who is getting this permission e.g., `s3.amazonaws.com`, an AWS account ID,
   * or any valid AWS service principal such as `events.amazonaws.com` or `sns.amazonaws.com`.
   */
  @core.attr(String)
  public principal!: string | core.StringOut;

  /**
   * (Optional) The identifier for your organization in AWS Organizations. Use this to grant permissions
   * to all the AWS accounts under this organization.
   */
  @core.attr(String)
  public principalOrgId?: string | core.StringOut;

  /**
   * (Optional) Query parameter to specify function version or alias name. The permission will then apply
   * to the specific qualified ARN e.g., `arn:aws:lambda:aws-region:acct-id:function:function-name:2`
   */
  @core.attr(String)
  public qualifier?: string | core.StringOut;

  /**
   * (Optional) This parameter is used for S3 and SES. The AWS account ID (without a hyphen) of the sourc
   * e owner.
   */
  @core.attr(String)
  public sourceAccount?: string | core.StringOut;

  /**
   * (Optional) When the principal is an AWS service, the ARN of the specific resource within that servic
   * e to grant permission to.
   */
  @core.attr(String)
  public sourceArn?: string | core.StringOut;

  /**
   * (Optional) A unique statement identifier. By default generated by Terraform.
   */
  @core.attr(String, { computed: true })
  public statementId?: string | core.StringOut;

  /**
   * (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `s
   * tatement_id`.
   */
  @core.attr(String, { computed: true })
  public statementIdPrefix?: string | core.StringOut;

  constructor(name: string, args?: PermissionArgs) {
    super(name, "aws_lambda_permission", args);
  }

  public override getNamespace(): string {
    return "aws_lambda";
  }
}