import type * as Duration from "effect/Duration";
import * as Provider from "../../Provider.ts";
import { Resource } from "../../Resource.ts";
import { AWSEnvironment } from "../Environment.ts";
import type { Providers } from "../Providers.ts";
/**
 * The kind of security configuration:
 * - `saml` — SAML federation with an external identity provider.
 * - `iamidentitycenter` — AWS IAM Identity Center integration.
 * - `iamfederation` — IAM federation via session attributes.
 */
export type SecurityConfigType = "saml" | "iamidentitycenter" | "iamfederation";
export interface SamlOptions {
    /**
     * The XML IdP metadata document generated by the identity provider.
     */
    metadata: string;
    /**
     * A user attribute for the SAML assertion.
     */
    userAttribute?: string;
    /**
     * A group attribute for the SAML assertion.
     */
    groupAttribute?: string;
    /**
     * Custom entity ID used as the audience restriction of the SAML assertion.
     */
    openSearchServerlessEntityId?: string;
    /**
     * How long a SAML session remains valid. Accepts any `Duration.Input`
     * (e.g. `"2 hours"`, `Duration.minutes(90)`; a bare number is milliseconds);
     * the wire unit is minutes.
     * @default 60 minutes (maximum 12 hours)
     */
    sessionTimeout?: Duration.Input;
}
export interface IamIdentityCenterOptions {
    /**
     * ARN of the IAM Identity Center instance.
     */
    instanceArn: string;
    /**
     * The user attribute to map (e.g. `UserId`, `UserName`, `Email`).
     */
    userAttribute?: string;
    /**
     * The group attribute to map (e.g. `GroupId`, `GroupName`).
     */
    groupAttribute?: string;
}
export interface IamFederationOptions {
    /**
     * The session attribute that carries the user identity.
     */
    userAttribute?: string;
    /**
     * The session attribute that carries the user's groups.
     */
    groupAttribute?: string;
}
export interface SecurityConfigProps {
    /**
     * Name of the security configuration (3-32 characters, lowercase). Changing
     * the name replaces the configuration.
     * @default a generated physical name
     */
    configName?: string;
    /**
     * The configuration kind (`saml`, `iamidentitycenter`, or `iamfederation`).
     * Changing the type replaces the configuration.
     */
    type: SecurityConfigType;
    /**
     * A human-readable description of the configuration.
     */
    description?: string;
    /**
     * SAML options — required when `type` is `saml`.
     */
    samlOptions?: SamlOptions;
    /**
     * IAM Identity Center options — required when `type` is
     * `iamidentitycenter`. `instanceArn` is create-only.
     */
    iamIdentityCenterOptions?: IamIdentityCenterOptions;
    /**
     * IAM federation options — required when `type` is `iamfederation`.
     */
    iamFederationOptions?: IamFederationOptions;
}
export interface SecurityConfig extends Resource<"AWS.OpenSearchServerless.SecurityConfig", SecurityConfigProps, {
    /**
     * Unique identifier of the security configuration, in the format
     * `{type}/{accountId}/{name}`. Use this as the `Principal` in a data
     * access policy to grant federated identities access.
     */
    configId: string;
    /**
     * Name of the security configuration.
     */
    configName: string;
    /**
     * Configuration type (`saml`, `iamidentitycenter`, or `iamfederation`).
     */
    type: string;
    /**
     * Version of the configuration, used for optimistic-concurrency updates.
     */
    configVersion: string;
    /**
     * Description of the security configuration.
     */
    description?: string;
}, {}, Providers> {
}
/**
 * An Amazon OpenSearch Serverless security configuration. Security
 * configurations federate OpenSearch Dashboards sign-in with SAML identity
 * providers, AWS IAM Identity Center, or IAM federation, so human users can
 * access collections without IAM credentials.
 *
 * The configuration's `configId` (format `saml/{accountId}/{name}`) is what a
 * data {@link AccessPolicy} references as a `Principal` to grant the federated
 * identities index- and collection-level permissions.
 *
 * ### SAML Authentication
 * **Example:** Federate Dashboards with a SAML Identity Provider
 * ```typescript
 * import * as AWS from "alchemy/AWS";
 *
 * const saml = yield* AWS.OpenSearchServerless.SecurityConfig("Saml", {
 *   configName: "my-idp",
 *   type: "saml",
 *   samlOptions: {
 *     metadata: idpMetadataXml,
 *     groupAttribute: "groups",
 *     sessionTimeout: "4 hours",
 *   },
 * });
 * // Reference saml.configId as a Principal in a data access policy
 * ```
 *
 * ### IAM Federation
 * **Example:** Map Session Attributes to Identities
 * ```typescript
 * const federation = yield* AWS.OpenSearchServerless.SecurityConfig("Federation", {
 *   configName: "my-federation",
 *   type: "iamfederation",
 *   iamFederationOptions: {
 *     userAttribute: "user",
 *     groupAttribute: "groups",
 *   },
 * });
 * ```
 *
 * @resource
 */
export declare const SecurityConfig: import("../../Resource.ts").ResourceClass<SecurityConfig>;
export declare const SecurityConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<SecurityConfig>, never, AWSEnvironment | import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
//# sourceMappingURL=SecurityConfig.d.ts.map