import * as core from "@terrascript/core";

export interface KeySigningKeyArgs extends core.ResourceArgs {
  /**
   * (Required) Identifier of the Route 53 Hosted Zone.
   */
  hostedZoneId: string | core.StringOut;

  /**
   * (Required) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key. This must be unique f
   * or each key-signing key (KSK) in a single hosted zone. This key must be in the `us-east-1` Region an
   * d meet certain requirements, which are described in the [Route 53 Developer Guide](https://docs.aws.
   * amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-cmk-requirements.html) and [Route 53
   * API Reference](https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateKeySigningKey.html
   * ).
   */
  keyManagementServiceArn: string | core.StringOut;

  /**
   * (Required) Name of the key-signing key (KSK). Must be unique for each key-singing key in the same ho
   * sted zone.
   */
  name: string | core.StringOut;

  /**
   * (Optional) Status of the key-signing key (KSK). Valid values: `ACTIVE`, `INACTIVE`. Defaults to `ACT
   * IVE`.
   */
  status?: string | core.StringOut;
}

export class KeySigningKey extends core.Resource<KeySigningKeyArgs> {
  /**
   * A string used to represent the delegation signer digest algorithm. This value must follow the guidel
   * ines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
   */
  @core.attr(String, { computed: true })
  public digestAlgorithmMnemonic!: string | core.StringOut;

  /**
   * An integer used to represent the delegation signer digest algorithm. This value must follow the guid
   * elines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
   */
  @core.attr(Number, { computed: true })
  public digestAlgorithmType!: number | core.NumberOut;

  /**
   * A cryptographic digest of a DNSKEY resource record (RR). DNSKEY records are used to publish the publ
   * ic key that resolvers can use to verify DNSSEC signatures that are used to secure certain kinds of i
   * nformation provided by the DNS system.
   */
  @core.attr(String, { computed: true })
  public digestValue!: string | core.StringOut;

  /**
   * A string that represents a DNSKEY record.
   */
  @core.attr(String, { computed: true })
  public dnskeyRecord!: string | core.StringOut;

  /**
   * A string that represents a delegation signer (DS) record.
   */
  @core.attr(String, { computed: true })
  public dsRecord!: string | core.StringOut;

  /**
   * An integer that specifies how the key is used. For key-signing key (KSK), this value is always 257.
   */
  @core.attr(Number, { computed: true })
  public flag!: number | core.NumberOut;

  /**
   * (Required) Identifier of the Route 53 Hosted Zone.
   */
  @core.attr(String)
  public hostedZoneId!: string | core.StringOut;

  /**
   * Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`).
   */
  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Required) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key. This must be unique f
   * or each key-signing key (KSK) in a single hosted zone. This key must be in the `us-east-1` Region an
   * d meet certain requirements, which are described in the [Route 53 Developer Guide](https://docs.aws.
   * amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-cmk-requirements.html) and [Route 53
   * API Reference](https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateKeySigningKey.html
   * ).
   */
  @core.attr(String)
  public keyManagementServiceArn!: string | core.StringOut;

  /**
   * An integer used to identify the DNSSEC record for the domain name. The process used to calculate the
   * value is described in [RFC-4034 Appendix B](https://tools.ietf.org/rfc/rfc4034.txt).
   */
  @core.attr(Number, { computed: true })
  public keyTag!: number | core.NumberOut;

  /**
   * (Required) Name of the key-signing key (KSK). Must be unique for each key-singing key in the same ho
   * sted zone.
   */
  @core.attr(String)
  public name!: string | core.StringOut;

  /**
   * The public key, represented as a Base64 encoding, as required by [RFC-4034 Page 5](https://tools.iet
   * f.org/rfc/rfc4034.txt).
   */
  @core.attr(String, { computed: true })
  public publicKey!: string | core.StringOut;

  /**
   * A string used to represent the signing algorithm. This value must follow the guidelines provided by
   * [RFC-8624 Section 3.1](https://tools.ietf.org/html/rfc8624#section-3.1).
   */
  @core.attr(String, { computed: true })
  public signingAlgorithmMnemonic!: string | core.StringOut;

  /**
   * An integer used to represent the signing algorithm. This value must follow the guidelines provided b
   * y [RFC-8624 Section 3.1](https://tools.ietf.org/html/rfc8624#section-3.1).
   */
  @core.attr(Number, { computed: true })
  public signingAlgorithmType!: number | core.NumberOut;

  /**
   * (Optional) Status of the key-signing key (KSK). Valid values: `ACTIVE`, `INACTIVE`. Defaults to `ACT
   * IVE`.
   */
  @core.attr(String)
  public status?: string | core.StringOut;

  constructor(name: string, args?: KeySigningKeyArgs) {
    super(name, "aws_route53_key_signing_key", args);
  }

  public override getNamespace(): string {
    return "aws_route53";
  }
}