import * as core from "@terrascript/core";

export interface SecretPolicyArgs extends core.ResourceArgs {
  /**
   * (Optional) Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad ac
   * cess to your secret.
   */
  blockPublicPolicy?: boolean | core.BooleanOut;

  /**
   * (Required) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsm
   * anager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about bu
   * ilding AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://lear
   * n.hashicorp.com/terraform/aws/iam-policy). Unlike `aws_secretsmanager_secret`, where `policy` can be
   * set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
   */
  policy: string | core.StringOut;

  /**
   * (Required) Secret ARN.
   */
  secretArn: string | core.StringOut;
}

export class SecretPolicy extends core.Resource<SecretPolicyArgs> {
  /**
   * (Optional) Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad ac
   * cess to your secret.
   */
  @core.attr(Boolean)
  public blockPublicPolicy?: boolean | core.BooleanOut;

  /**
   * Amazon Resource Name (ARN) of the secret.
   */
  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Required) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsm
   * anager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about bu
   * ilding AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://lear
   * n.hashicorp.com/terraform/aws/iam-policy). Unlike `aws_secretsmanager_secret`, where `policy` can be
   * set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
   */
  @core.attr(String)
  public policy!: string | core.StringOut;

  /**
   * (Required) Secret ARN.
   */
  @core.attr(String)
  public secretArn!: string | core.StringOut;

  constructor(name: string, args?: SecretPolicyArgs) {
    super(name, "aws_secretsmanager_secret_policy", args);
  }

  public override getNamespace(): string {
    return "aws_secretsmanager";
  }
}