import * as iam from '../../../aws-iam';
import * as sns from '../../../aws-sns';
import type { IResource } from '../../../core';
export declare function regionFromArn(topic: sns.ITopic, resource: IResource): string | undefined;
/**
 * Determine the correct SNS service principal for cross-region subscriptions
 * involving opt-in regions.
 *
 * Per https://docs.aws.amazon.com/sns/latest/dg/sns-cross-region-delivery.html:
 * - Default region → opt-in region: sns.<subscriber-region>.amazonaws.com
 * - Opt-in region → default region: sns.<topic-region>.amazonaws.com
 * - Opt-in region → opt-in region: sns.<subscriber-region>.amazonaws.com
 * - Default region → default region: sns.amazonaws.com (global)
 *
 * Limitation: this can only regionalize the principal when both regions are known
 * at synthesis time. If either region is unresolved — e.g. an environment-agnostic
 * stack (no explicit `env`) or a topic imported from a tokenized ARN — the opt-in
 * fix cannot be applied and the global `sns.amazonaws.com` principal is used. In
 * that case, for a cross-region opt-in subscription to work, either give the stack
 * an explicit `env` or add the regionalized `sns.<region>.amazonaws.com` principal
 * to the resource policy manually.
 */
export declare function snsServicePrincipal(topic: sns.ITopic, subscriber: IResource): iam.ServicePrincipal;