import type * as constructs from 'constructs';
import * as kms from '../../aws-kms';
import * as cdk from '../../core';
/**
 * Interface representing a created or an imported `SecurityConfiguration`.
 */
export interface ISecurityConfiguration extends cdk.IResource {
    /**
     * The name of the security configuration.
     * @attribute
     */
    readonly securityConfigurationName: string;
}
/**
 * Encryption mode for S3.
 * @see https://docs.aws.amazon.com/glue/latest/webapi/API_S3Encryption.html#Glue-Type-S3Encryption-S3EncryptionMode
 */
export declare enum S3EncryptionMode {
    /**
     * Server side encryption (SSE) with an Amazon S3-managed key.
     *
     * @see https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html
     */
    S3_MANAGED = "SSE-S3",
    /**
     * Server-side encryption (SSE) with an AWS KMS key managed by the account owner.
     *
     * @see https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html
     */
    KMS = "SSE-KMS"
}
/**
 * S3 encryption configuration for a `SecurityConfiguration`.
 *
 * Use {@link S3Encryption.s3Managed} for SSE-S3 or {@link S3Encryption.kms} for
 * SSE-KMS. Because these are separate factories, a KMS key can never be paired
 * with S3-managed encryption.
 */
export declare class S3Encryption {
    /**
     * Server-side encryption (SSE) with an Amazon S3-managed key.
     *
     * @see https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html
     */
    static s3Managed(): S3Encryption;
    /**
     * Server-side encryption (SSE) with an AWS KMS key managed by the account owner.
     *
     * @param kmsKey the KMS key used to encrypt the data. A key is created if one is not provided.
     * @see https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html
     */
    static kms(kmsKey?: kms.IKeyRef): S3Encryption;
    /** @internal */
    readonly _mode: S3EncryptionMode;
    /** @internal */
    readonly _kmsKey?: kms.IKeyRef;
    private constructor();
}
/**
 * CloudWatch Logs encryption configuration for a `SecurityConfiguration`.
 *
 * CloudWatch Logs support only server-side encryption with a KMS key.
 */
export declare class CloudWatchEncryption {
    /**
     * Server-side encryption (SSE) with an AWS KMS key managed by the account owner.
     *
     * @param kmsKey the KMS key used to encrypt the data. A key is created if one is not provided.
     */
    static kms(kmsKey?: kms.IKeyRef): CloudWatchEncryption;
    /** @internal */
    readonly _kmsKey?: kms.IKeyRef;
    private constructor();
}
/**
 * Job bookmarks encryption configuration for a `SecurityConfiguration`.
 *
 * Job bookmarks support only client-side encryption with a KMS key.
 */
export declare class JobBookmarksEncryption {
    /**
     * Client-side encryption (CSE) with an AWS KMS key managed by the account owner.
     *
     * @param kmsKey the KMS key used to encrypt the data. A key is created if one is not provided.
     * @see https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
     */
    static clientSideKms(kmsKey?: kms.IKeyRef): JobBookmarksEncryption;
    /** @internal */
    readonly _kmsKey?: kms.IKeyRef;
    private constructor();
}
/**
 * Constructions properties of `SecurityConfiguration`.
 */
export interface SecurityConfigurationProps {
    /**
     * The name of the security configuration.
     *
     * @default - generated by CDK.
     */
    readonly securityConfigurationName?: string;
    /**
     * The encryption configuration for Amazon CloudWatch Logs.
     * @default no cloudwatch logs encryption.
     */
    readonly cloudWatchEncryption?: CloudWatchEncryption;
    /**
     * The encryption configuration for Glue Job Bookmarks.
     * @default no job bookmarks encryption.
     */
    readonly jobBookmarksEncryption?: JobBookmarksEncryption;
    /**
     * The encryption configuration for Amazon Simple Storage Service (Amazon S3) data.
     * @default no s3 encryption.
     */
    readonly s3Encryption?: S3Encryption;
    /**
     * Policy to apply when the security configuration is removed from the stack.
     *
     * @default - resource will be destroyed
     */
    readonly removalPolicy?: cdk.RemovalPolicy;
}
/**
 * A security configuration is a set of security properties that can be used by AWS Glue to encrypt data at rest.
 *
 * The following scenarios show some of the ways that you can use a security configuration.
 * - Attach a security configuration to an AWS Glue crawler to write encrypted Amazon CloudWatch Logs.
 * - Attach a security configuration to an extract, transform, and load (ETL) job to write encrypted Amazon Simple Storage Service (Amazon S3) targets and encrypted CloudWatch Logs.
 * - Attach a security configuration to an ETL job to write its jobs bookmarks as encrypted Amazon S3 data.
 * - Attach a security configuration to a development endpoint to write encrypted Amazon S3 targets.
 */
export declare class SecurityConfiguration extends cdk.Resource implements ISecurityConfiguration {
    /** Uniquely identifies this class. */
    static readonly PROPERTY_INJECTION_ID: string;
    /**
     * Creates a Connection construct that represents an external security configuration.
     *
     * @param scope The scope creating construct (usually `this`).
     * @param id The construct's id.
     * @param securityConfigurationName name of external security configuration.
     */
    static fromSecurityConfigurationName(scope: constructs.Construct, id: string, securityConfigurationName: string): ISecurityConfiguration;
    /**
     * The KMS key used in CloudWatch encryption if it requires a kms key.
     */
    readonly cloudWatchEncryptionKey?: kms.IKeyRef;
    /**
     * The KMS key used in job bookmarks encryption if it requires a kms key.
     */
    readonly jobBookmarksEncryptionKey?: kms.IKeyRef;
    /**
     * The KMS key used in S3 encryption if it requires a kms key.
     */
    readonly s3EncryptionKey?: kms.IKeyRef;
    private resource;
    constructor(scope: constructs.Construct, id: string, props?: SecurityConfigurationProps);
    get securityConfigurationName(): string;
}