/**
 * Effect of a policy statement, whether it permits or forbids the action.
 */
export declare enum PolicyEffect {
    /**
     * Permit the action when the statement matches and its conditions hold.
     *
     * Multiple permit statements can apply, and any matching permit grants access.
     */
    PERMIT = "permit",
    /**
     * Forbid the action when the statement matches and its conditions hold.
     *
     * A forbid always takes precedence over any permit.
     */
    FORBID = "forbid"
}
/**
 * An attribute of the request that a condition can compare against.
 *
 * Cedar exposes three sources of attributes. Which one you want depends on where the
 * value comes from: the caller, the thing being accessed, or the request environment.
 *
 * @example
 * import { PolicyAttribute } from 'aws-cdk-lib/aws-bedrockagentcore';
 *
 * PolicyAttribute.principal('department'); // principal.department
 * PolicyAttribute.resource('confidential'); // resource.confidential
 * PolicyAttribute.context('sourceIp'); // context.sourceIp
 */
export declare class PolicyAttribute {
    private readonly source;
    private readonly attribute;
    /**
     * An attribute of the principal, meaning the authenticated user or service making
     * the request. For example `username`, `department` or `groups`.
     *
     * @param attribute - The attribute name
     */
    static principal(attribute: string): PolicyAttribute;
    /**
     * An attribute of the resource being accessed. For example `owner` or
     * `classification`.
     *
     * @param attribute - The attribute name
     */
    static resource(attribute: string): PolicyAttribute;
    /**
     * An attribute of the request context, meaning the request environment rather than
     * either entity. For example `sourceIp`, `environment` or `timestamp`.
     *
     * @param attribute - The attribute name
     */
    static context(attribute: string): PolicyAttribute;
    private constructor();
    /**
     * Render this attribute as a Cedar attribute path.
     * @internal
     */
    _toCedar(): string;
}
/**
 * A condition on a policy statement.
 *
 * A condition compares a request attribute against a value. Conditions are grouped
 * into the `when` and `unless` clauses of a statement, where the members of a clause
 * must all hold.
 *
 * Comparisons are named for the type of value they accept, so each one takes a
 * concrete type rather than a union. Use `allOf` and `anyOf` to build a nested
 * boolean expression, which also makes the grouping explicit in the generated Cedar.
 *
 * @example
 * import { PolicyAttribute, PolicyCondition } from 'aws-cdk-lib/aws-bedrockagentcore';
 *
 * // principal.department == "Engineering"
 * PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Engineering');
 *
 * // (principal.department == "Engineering" || principal.department == "Support")
 * PolicyCondition.anyOf([
 *   PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Engineering'),
 *   PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Support'),
 * ]);
 */
export declare class PolicyCondition {
    private readonly node;
    /**
     * The attribute equals a string value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static stringEquals(attribute: PolicyAttribute, value: string): PolicyCondition;
    /**
     * The attribute does not equal a string value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static stringNotEquals(attribute: PolicyAttribute, value: string): PolicyCondition;
    /**
     * The attribute equals a number value.
     *
     * Cedar whole numbers are 64-bit signed integers, so the value must be an integer.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static numberEquals(attribute: PolicyAttribute, value: number): PolicyCondition;
    /**
     * The attribute does not equal a number value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static numberNotEquals(attribute: PolicyAttribute, value: number): PolicyCondition;
    /**
     * The attribute is less than a number value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static numberLessThan(attribute: PolicyAttribute, value: number): PolicyCondition;
    /**
     * The attribute is less than or equal to a number value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static numberLessThanOrEquals(attribute: PolicyAttribute, value: number): PolicyCondition;
    /**
     * The attribute is greater than a number value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static numberGreaterThan(attribute: PolicyAttribute, value: number): PolicyCondition;
    /**
     * The attribute is greater than or equal to a number value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static numberGreaterThanOrEquals(attribute: PolicyAttribute, value: number): PolicyCondition;
    /**
     * The attribute equals a boolean value.
     *
     * @param attribute - The attribute to compare
     * @param value - The value to compare against
     */
    static booleanEquals(attribute: PolicyAttribute, value: boolean): PolicyCondition;
    /**
     * The attribute is an IP address inside the given CIDR range.
     *
     * @param attribute - The attribute holding an IP address
     * @param cidr - The range in CIDR notation, for example '192.168.1.0/24'
     */
    static ipInRange(attribute: PolicyAttribute, cidr: string): PolicyCondition;
    /**
     * The attribute is a set that contains the given value.
     *
     * Use this when the attribute itself holds a set, for example `principal.groups`.
     * To test a scalar attribute against a list of allowed values, use `stringIn` or
     * `numberIn` instead.
     *
     * @param attribute - The attribute holding a set
     * @param value - The member to look for
     */
    static setContains(attribute: PolicyAttribute, value: string): PolicyCondition;
    /**
     * The attribute is one of the given string values.
     *
     * @param attribute - The attribute to compare
     * @param values - The allowed values, at least one
     */
    static stringIn(attribute: PolicyAttribute, values: string[]): PolicyCondition;
    /**
     * The attribute is one of the given number values.
     *
     * @param attribute - The attribute to compare
     * @param values - The allowed values, at least one
     */
    static numberIn(attribute: PolicyAttribute, values: number[]): PolicyCondition;
    /**
     * All of the given conditions must hold.
     *
     * Renders as a parenthesised `&&` group, so it can be nested inside `anyOf`
     * without relying on operator precedence.
     *
     * @param conditions - The conditions to combine, at least one
     */
    static allOf(conditions: PolicyCondition[]): PolicyCondition;
    /**
     * At least one of the given conditions must hold.
     *
     * Renders as a parenthesised `||` group, so it can be nested inside `allOf` or
     * combined with the surrounding clause without relying on operator precedence.
     *
     * @param conditions - The conditions to combine, at least one
     */
    static anyOf(conditions: PolicyCondition[]): PolicyCondition;
    private static infix;
    private static memberOf;
    private static group;
    private constructor();
    /**
     * Render this condition as a Cedar expression.
     * @internal
     */
    _toCedar(): string;
}
/**
 * The principal a policy statement applies to.
 *
 * @example
 * import { PolicyPrincipal } from 'aws-cdk-lib/aws-bedrockagentcore';
 *
 * PolicyPrincipal.any(); // principal
 * PolicyPrincipal.entityType('AgentCore::OAuthUser'); // principal is AgentCore::OAuthUser
 * PolicyPrincipal.entity('AgentCore::OAuthUser', 'user123'); // principal == AgentCore::OAuthUser::"user123"
 * PolicyPrincipal.inGroup('AgentCore::OAuthGroup', 'admins'); // principal in AgentCore::OAuthGroup::"admins"
 */
export declare class PolicyPrincipal {
    private readonly config?;
    /**
     * Any principal, whoever the caller is.
     */
    static any(): PolicyPrincipal;
    /**
     * Any principal of the given entity type.
     *
     * @param entityType - The entity type, for example 'AgentCore::OAuthUser'
     */
    static entityType(entityType: string): PolicyPrincipal;
    /**
     * One specific principal.
     *
     * @param entityType - The entity type, for example 'AgentCore::OAuthUser'
     * @param entityId - The entity identifier
     */
    static entity(entityType: string, entityId: string): PolicyPrincipal;
    /**
     * Any principal that is a member of the given group.
     *
     * @param groupType - The group entity type, for example 'AgentCore::OAuthGroup'
     * @param groupId - The group identifier
     */
    static inGroup(groupType: string, groupId: string): PolicyPrincipal;
    private constructor();
    /**
     * Render this principal as a Cedar principal scope.
     * @internal
     */
    _toCedar(): string;
}
/**
 * The action a policy statement applies to.
 *
 * @example
 * import { PolicyAction } from 'aws-cdk-lib/aws-bedrockagentcore';
 *
 * PolicyAction.any(); // action
 * PolicyAction.one('AgentCore::Action::GetGateway'); // action == AgentCore::Action::"GetGateway"
 * PolicyAction.anyOf([ // action in [AgentCore::Action::"GetGateway", AgentCore::Action::"ListGateways"]
 *   'AgentCore::Action::GetGateway',
 *   'AgentCore::Action::ListGateways',
 * ]);
 */
export declare class PolicyAction {
    private readonly actions?;
    /**
     * Any action.
     */
    static any(): PolicyAction;
    /**
     * One specific action.
     *
     * @param action - The action name, for example 'AgentCore::Action::GetGateway'
     */
    static one(action: string): PolicyAction;
    /**
     * Any one of the given actions.
     *
     * @param actions - The action names, at least one
     */
    static anyOf(actions: string[]): PolicyAction;
    private constructor();
    /**
     * Render this action as a Cedar action scope.
     * @internal
     */
    _toCedar(): string;
}
/**
 * The resource a policy statement applies to.
 *
 * AgentCore rejects a policy whose resource is an unconstrained wildcard, so a
 * statement must name either a resource type or a specific resource.
 *
 * @example
 * import { PolicyResource } from 'aws-cdk-lib/aws-bedrockagentcore';
 * declare const gatewayArn: string;
 *
 * PolicyResource.anyOfType('AgentCore::Gateway'); // resource is AgentCore::Gateway
 * PolicyResource.instance('AgentCore::Gateway', gatewayArn); // resource == AgentCore::Gateway::"<arn>"
 */
export declare class PolicyResource {
    private readonly entityType;
    private readonly entityArn?;
    /**
     * Any resource of the given entity type.
     *
     * @param entityType - The entity type, for example 'AgentCore::Gateway'
     */
    static anyOfType(entityType: string): PolicyResource;
    /**
     * One specific resource.
     *
     * AgentCore requires a specific resource when the statement names specific
     * actions rather than any action.
     *
     * @param entityType - The entity type, for example 'AgentCore::Gateway'
     * @param entityArn - The resource ARN or identifier
     */
    static instance(entityType: string, entityArn: string): PolicyResource;
    private constructor();
    /**
     * Render this resource as a Cedar resource scope.
     * @internal
     */
    _toCedar(): string;
}
/**
 * Properties for a policy statement.
 */
export interface PolicyStatementProps {
    /**
     * Whether the statement permits or forbids the action.
     */
    readonly effect: PolicyEffect;
    /**
     * The principal the statement applies to.
     */
    readonly principal: PolicyPrincipal;
    /**
     * The action the statement applies to.
     */
    readonly action: PolicyAction;
    /**
     * The resource the statement applies to.
     */
    readonly resource: PolicyResource;
    /**
     * Conditions that must all hold for the statement to apply.
     *
     * Use `PolicyCondition.anyOf()` for a member that only needs one of several
     * conditions to hold.
     *
     * @default - the statement applies whenever its principal, action and resource match
     */
    readonly when?: PolicyCondition[];
    /**
     * Conditions that must not hold for the statement to apply.
     *
     * @default - no exclusions
     */
    readonly unless?: PolicyCondition[];
}
/**
 * A Cedar authorization policy statement.
 *
 * A statement names the principal, action and resource it applies to, and optionally
 * conditions that narrow it further. All three parts are required, so a statement is
 * complete as soon as it is constructed.
 *
 * @example
 * import { Policy, PolicyEngine, PolicyEffect, PolicyStatement, PolicyPrincipal, PolicyAction, PolicyResource } from 'aws-cdk-lib/aws-bedrockagentcore';
 * declare const engine: PolicyEngine;
 *
 * // Example 1: permit any principal to take any action on any gateway
 * new Policy(this, 'AllowAll', {
 *   policyEngine: engine,
 *   statement: new PolicyStatement({
 *     effect: PolicyEffect.PERMIT,
 *     principal: PolicyPrincipal.any(),
 *     action: PolicyAction.any(),
 *     resource: PolicyResource.anyOfType('AgentCore::Gateway'),
 *   }),
 * });
 *
 * // Generated Cedar:
 * // permit(
 * //   principal,
 * //   action,
 * //   resource is AgentCore::Gateway
 * // );
 *
 * @example
 * import { Policy, PolicyEngine, PolicyEffect, PolicyStatement, PolicyPrincipal, PolicyAction, PolicyResource } from 'aws-cdk-lib/aws-bedrockagentcore';
 * declare const engine: PolicyEngine;
 * declare const gatewayArn: string;
 *
 * // Example 2: permit a group to take specific actions on one gateway
 * new Policy(this, 'AllowSpecificActions', {
 *   policyEngine: engine,
 *   statement: new PolicyStatement({
 *     effect: PolicyEffect.PERMIT,
 *     principal: PolicyPrincipal.inGroup('Group', 'Engineers'),
 *     action: PolicyAction.anyOf([
 *       'AgentCore::Action::exampleaction1',
 *       'AgentCore::Action::exampleaction2',
 *     ]),
 *     resource: PolicyResource.instance('AgentCore::Gateway', gatewayArn),
 *   }),
 * });
 *
 * // Generated Cedar:
 * // permit(
 * //   principal in Group::"Engineers",
 * //   action in [AgentCore::Action::"exampleaction1", AgentCore::Action::"exampleaction2"],
 * //   resource == AgentCore::Gateway::"arn:aws:bedrock:us-east-1:123:gateway/gw-123"
 * // );
 *
 * @example
 * import { Policy, PolicyEngine, PolicyEffect, PolicyStatement, PolicyPrincipal, PolicyAction, PolicyResource, PolicyAttribute, PolicyCondition } from 'aws-cdk-lib/aws-bedrockagentcore';
 * declare const engine: PolicyEngine;
 *
 * // Example 3: conditions, with an exclusion
 * new Policy(this, 'ConditionalPolicy', {
 *   policyEngine: engine,
 *   statement: new PolicyStatement({
 *     effect: PolicyEffect.PERMIT,
 *     principal: PolicyPrincipal.any(),
 *     action: PolicyAction.any(),
 *     resource: PolicyResource.anyOfType('AgentCore::Gateway'),
 *     when: [
 *       PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Engineering'),
 *       PolicyCondition.ipInRange(PolicyAttribute.context('sourceIp'), '192.168.1.0/24'),
 *     ],
 *     unless: [
 *       PolicyCondition.booleanEquals(PolicyAttribute.principal('suspended'), true),
 *     ],
 *   }),
 * });
 *
 * // Generated Cedar:
 * // permit(
 * //   principal,
 * //   action,
 * //   resource is AgentCore::Gateway
 * // )
 * // when {
 * //   principal.department == "Engineering" && context.sourceIp.isInRange(ip("192.168.1.0/24"))
 * // }
 * // unless {
 * //   principal.suspended == true
 * // };
 *
 * @example
 * import { Policy, PolicyEngine, PolicyStatement } from 'aws-cdk-lib/aws-bedrockagentcore';
 * declare const engine: PolicyEngine;
 *
 * // Example 4: raw Cedar, for features the API does not model
 * new Policy(this, 'CustomPolicy', {
 *   policyEngine: engine,
 *   statement: PolicyStatement.fromCedar('permit(principal, action, resource) when { context.custom > 10 };'),
 * });
 */
export declare class PolicyStatement {
    private readonly props;
    /**
     * Create a statement from raw Cedar source.
     *
     * Use this for Cedar features this API does not model, or to migrate an existing
     * policy.
     *
     * The source is used exactly as given. This method does not escape, quote, or
     * validate it, so it is treated as trusted input and you own its correctness and
     * its safety. Do not build the string by joining values that come from outside
     * your application: a value containing a double quote can close a string literal
     * early and add policy statements you did not write. Pass such values through
     * `PolicyCondition` and the principal, action and resource factories instead,
     * which reject that case at synthesis time. Service-side validation does not help,
     * because an injected policy is still valid Cedar.
     *
     * @param cedarStatement - Complete Cedar policy statement
     */
    static fromCedar(cedarStatement: string): PolicyStatement;
    private rawCedar?;
    constructor(props: PolicyStatementProps);
    /**
     * Generate the Cedar policy statement string.
     *
     * This is called internally by the Policy construct.
     *
     * @returns Valid Cedar policy statement
     */
    toCedar(): string;
}