import * as core from "@terrascript/core";

export interface ReplicaArgs extends core.SchemaArgs {
  kmsKeyId?: string | core.StringOut;

  lastAccessedDate: string | core.StringOut;

  region: string | core.StringOut;

  status: string | core.StringOut;

  statusMessage: string | core.StringOut;
}

export class Replica extends core.Schema<ReplicaArgs> {
  @core.attr(String, { computed: true })
  public kmsKeyId?: string | core.StringOut;

  @core.attr(String, { computed: true })
  public lastAccessedDate!: string | core.StringOut;

  @core.attr(String)
  public region!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public status!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public statusMessage!: string | core.StringOut;
}

export interface RotationRulesArgs extends core.SchemaArgs {
  automaticallyAfterDays: number | core.NumberOut;
}

export class RotationRules extends core.Schema<RotationRulesArgs> {
  @core.attr(Number)
  public automaticallyAfterDays!: number | core.NumberOut;
}

export interface SecretArgs extends core.ResourceArgs {
  /**
   * (Optional) Description of the secret.
   */
  description?: string | core.StringOut;

  /**
   * (Optional) Accepts boolean value to specify whether to overwrite a secret with the same name in the
   * destination Region.
   */
  forceOverwriteReplicaSecret?: boolean | core.BooleanOut;

  /**
   * (Optional) ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stor
   * ed in this secret. If you don't specify this value, then Secrets Manager defaults to using the AWS a
   * ccount's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name
   * doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
   */
  kmsKeyId?: string | core.StringOut;

  /**
   * (Optional) Friendly name of the new secret. The secret name can consist of uppercase letters, lowerc
   * ase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `name_prefix`.
   */
  name?: string | core.StringOut;

  /**
   * (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
   */
  namePrefix?: string | core.StringOut;

  /**
   * (Optional) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsm
   * anager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about bu
   * ilding AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://lear
   * n.hashicorp.com/terraform/aws/iam-policy). Removing `policy` from your configuration or setting `pol
   * icy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could ha
   * ve been set by `aws_secretsmanager_secret_policy`. To delete the `policy`, set it to `"{}"` (an empt
   * y JSON document).
   */
  policy?: string | core.StringOut;

  /**
   * (Optional) Number of days that AWS Secrets Manager waits before it can delete the secret. This value
   * can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is
   * 30`.
   */
  recoveryWindowInDays?: number | core.NumberOut;

  /**
   * (Optional) Configuration block to support secret replication. See details below.
   */
  replica?: core.Array<Replica> | core.ArrayOut<Replica>;

  /**
   * (Optional, **DEPRECATED**) ARN of the Lambda function that can rotate the secret. Use the `aws_secre
   * tsmanager_secret_rotation` resource to manage this configuration instead. As of version 2.67.0, remo
   * val of this configuration will no longer remove rotation due to supporting the new resource. Either
   * import the new resource and remove the configuration or manually remove rotation.
   */
  rotationLambdaArn?: string | core.StringOut;

  /**
   * (Optional, **DEPRECATED**) Configuration block for the rotation configuration of this secret. Define
   * d below. Use the `aws_secretsmanager_secret_rotation` resource to manage this configuration instead.
   * As of version 2.67.0, removal of this configuration will no longer remove rotation due to supportin
   * g the new resource. Either import the new resource and remove the configuration or manually remove r
   * otation.
   */
  rotationRules?: RotationRules;

  /**
   * (Optional) Key-value map of user-defined tags that are attached to the secret. If configured with a
   * provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/
   * latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those
   * defined at the provider-level.
   */
  tags?: core.Map<string, string> | core.MapOut<core.StringOut>;

  /**
   * Map of tags assigned to the resource, including those inherited from the provider [`default_tags` co
   * nfiguration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-co
   * nfiguration-block).
   */
  tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;
}

export class Secret extends core.Resource<SecretArgs> {
  /**
   * ARN of the secret.
   */
  @core.attr(String, { computed: true })
  public arn!: string | core.StringOut;

  /**
   * (Optional) Description of the secret.
   */
  @core.attr(String)
  public description?: string | core.StringOut;

  /**
   * (Optional) Accepts boolean value to specify whether to overwrite a secret with the same name in the
   * destination Region.
   */
  @core.attr(Boolean)
  public forceOverwriteReplicaSecret?: boolean | core.BooleanOut;

  /**
   * ARN of the secret.
   */
  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Optional) ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stor
   * ed in this secret. If you don't specify this value, then Secrets Manager defaults to using the AWS a
   * ccount's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name
   * doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
   */
  @core.attr(String)
  public kmsKeyId?: string | core.StringOut;

  /**
   * (Optional) Friendly name of the new secret. The secret name can consist of uppercase letters, lowerc
   * ase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `name_prefix`.
   */
  @core.attr(String, { computed: true })
  public name?: string | core.StringOut;

  /**
   * (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
   */
  @core.attr(String, { computed: true })
  public namePrefix?: string | core.StringOut;

  /**
   * (Optional) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsm
   * anager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about bu
   * ilding AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://lear
   * n.hashicorp.com/terraform/aws/iam-policy). Removing `policy` from your configuration or setting `pol
   * icy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could ha
   * ve been set by `aws_secretsmanager_secret_policy`. To delete the `policy`, set it to `"{}"` (an empt
   * y JSON document).
   */
  @core.attr(String, { computed: true })
  public policy?: string | core.StringOut;

  /**
   * (Optional) Number of days that AWS Secrets Manager waits before it can delete the secret. This value
   * can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is
   * 30`.
   */
  @core.attr(Number)
  public recoveryWindowInDays?: number | core.NumberOut;

  /**
   * (Optional) Configuration block to support secret replication. See details below.
   */
  @core.attr(Replica, { computed: true, kind: "array" })
  public replica?: core.Array<Replica> | core.ArrayOut<Replica>;

  /**
   * Whether automatic rotation is enabled for this secret.
   */
  @core.attr(Boolean, { computed: true })
  public rotationEnabled!: boolean | core.BooleanOut;

  /**
   * (Optional, **DEPRECATED**) ARN of the Lambda function that can rotate the secret. Use the `aws_secre
   * tsmanager_secret_rotation` resource to manage this configuration instead. As of version 2.67.0, remo
   * val of this configuration will no longer remove rotation due to supporting the new resource. Either
   * import the new resource and remove the configuration or manually remove rotation.
   */
  @core.attr(String, { computed: true })
  public rotationLambdaArn?: string | core.StringOut;

  /**
   * (Optional, **DEPRECATED**) Configuration block for the rotation configuration of this secret. Define
   * d below. Use the `aws_secretsmanager_secret_rotation` resource to manage this configuration instead.
   * As of version 2.67.0, removal of this configuration will no longer remove rotation due to supportin
   * g the new resource. Either import the new resource and remove the configuration or manually remove r
   * otation.
   */
  @core.attr(RotationRules, { computed: true })
  public rotationRules?: RotationRules;

  /**
   * (Optional) Key-value map of user-defined tags that are attached to the secret. If configured with a
   * provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/
   * latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those
   * defined at the provider-level.
   */
  @core.attr(String, { kind: "map" })
  public tags?: core.Map<string, string> | core.MapOut<core.StringOut>;

  /**
   * Map of tags assigned to the resource, including those inherited from the provider [`default_tags` co
   * nfiguration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-co
   * nfiguration-block).
   */
  @core.attr(String, { computed: true, kind: "map" })
  public tagsAll?: core.Map<string, string> | core.MapOut<core.StringOut>;

  constructor(name: string, args?: SecretArgs) {
    super(name, "aws_secretsmanager_secret", args);
  }

  public override getNamespace(): string {
    return "aws_secretsmanager";
  }
}