import { ITaggable, Resource, ResourceProps, TagManager, aws_kms, aws_lambda, aws_secretsmanager } from 'aws-cdk-lib';
import { IKeyPair, OperatingSystemType } from 'aws-cdk-lib/aws-ec2';
import { aws_ec2 as interfaces_aws_ec2 } from 'aws-cdk-lib/interfaces';
import { Construct } from 'constructs';
import { KeyType, LogLevel, PublicKeyFormat } from './types';
export { KeyType, LogLevel, PublicKeyFormat } from './types';
/**
 * Definition of EC2 Key Pair
 */
export interface KeyPairProps extends ResourceProps {
    /**
     * Name of the Key Pair
     *
     * In AWS Secrets Manager the key will be prefixed with `ec2-ssh-key/`.
     *
     * The name can be up to 255 characters long. Valid characters include _, -, a-z, A-Z, and 0-9.
     */
    readonly keyPairName: string;
    /**
     * The description for the key in AWS Secrets Manager
     * @default - ''
     */
    readonly description?: string;
    /**
     * The KMS key used to encrypt the Secrets Manager secrets with
     *
     * This needs to be a key created in the same stack. You cannot use a key imported via ARN, because the keys access policy will need to be modified.
     *
     * @default - `alias/aws/secretsmanager`
     */
    readonly kms?: aws_kms.Key;
    /**
     * The KMS key to use to encrypt the private key with
     *
     * This needs to be a key created in the same stack. You cannot use a key imported via ARN, because the keys access policy will need to be modified.
     *
     * If no value is provided, the property `kms` will be used instead.
     *
     * @default - `this.kms`
     */
    readonly kmsPrivateKey?: aws_kms.Key;
    /**
     * The KMS key to use to encrypt the public key with
     *
     * This needs to be a key created in the same stack. You cannot use a key imported via ARN, because the keys access policy will need to be modified.
     *
     * If no value is provided, the property `kms` will be used instead.
     *
     * @default - `this.kms`
     */
    readonly kmsPublicKey?: aws_kms.Key;
    /**
     * Import a public key instead of creating it
     *
     * If no public key is provided, a new key pair will be created.
     */
    readonly publicKey?: string;
    /**
     * Store the public key as a secret
     *
     * @default - false
     */
    readonly storePublicKey?: boolean;
    /**
     * Expose the public key as property `publicKeyValue`
     *
     * @default - false
     */
    readonly exposePublicKey?: boolean;
    /**
     * The type of key pair
     *
     * @default - RSA
     */
    readonly keyType?: KeyType;
    /**
     * Format for public key.
     *
     * Relevant only if the public key is stored and/or exposed.
     *
     * @default - SSH
     */
    readonly publicKeyFormat?: PublicKeyFormat;
    /**
     * When the resource is destroyed, after how many days the private and public key in the AWS Secrets Manager should be deleted.
     *
     * Valid values are 0 and 7 to 30
     *
     * @default 0
     */
    readonly removeKeySecretsAfterDays?: number;
    /**
     * Prefix for the secret in AWS Secrets Manager.
     *
     * @default `ec2-ssh-key/`
     */
    readonly secretPrefix?: string;
    /**
     * A prefix for all resource names.
     *
     * By default all resources are prefixed with the stack name to avoid collisions with other stacks. This might cause problems when you work with long stack names and can be overridden through this parameter.
     *
     * @default Name of the stack
     */
    readonly resourcePrefix?: string;
    /**
     * Whether to use the legacy name for the Lambda function, which backs the custom resource.
     *
     * Starting with v4 of this package, the Lambda function by default has no longer a fixed name.
     *
     * If you migrate from v3 to v4, you need to set this to `true` as CloudFormation does not allow to change the name of the Lambda function used by custom resource.
     *
     * @default false
     */
    readonly legacyLambdaName?: boolean;
    /**
     * The log level of the Lambda function
     *
     * @default LogLevel.warn
     */
    readonly logLevel?: LogLevel;
    /**
     * The Node.js runtime to use for the Lambda function backing the custom resource.
     *
     * Since this Lambda function is shared across all `KeyPair` instances in the same stack,
     * only the value set on the first instance takes effect.
     *
     * @default aws_lambda.Runtime.NODEJS_24_X
     */
    readonly lambdaRuntime?: aws_lambda.Runtime;
}
/**
 * An EC2 Key Pair
 */
export declare class KeyPair extends Resource implements ITaggable, IKeyPair {
    /**
     * The lambda function that is created
     */
    readonly lambdaFunction: aws_lambda.IFunction;
    /**
     * The public key.
     *
     * Only filled, when `exposePublicKey = true`
     */
    readonly publicKeyValue: string;
    /**
     * Name of the Key Pair
     */
    readonly keyPairName: string;
    /**
     * ID of the Key Pair
     */
    readonly keyPairID: string;
    /**
     * Fingerprint of the Key Pair
     */
    readonly keyPairFingerprint: string;
    /**
     * Format of the public key
     */
    readonly publicKeyFormat: PublicKeyFormat;
    /**
     * The private key secret in AWS Secrets Manager
     */
    readonly privateKeySecret: aws_secretsmanager.ISecret;
    /**
     * The public key secret in AWS Secrets Manager
     *
     * Only available when `storePublicKey` is set to `true`.
     */
    readonly publicKeySecret?: aws_secretsmanager.ISecret;
    /**
     * Type of the Key Pair
     */
    readonly keyType: KeyType;
    /**
     * Resource tags
     */
    readonly tags: TagManager;
    readonly prefix: string;
    get keyPairRef(): interfaces_aws_ec2.KeyPairReference;
    /**
     * Defines a new EC2 Key Pair. The private key will be stored in AWS Secrets Manager
     */
    constructor(scope: Construct, id: string, props: KeyPairProps);
    private ensureLambda;
    /**
     * Used internally to determine whether the key pair is compatible with an OS type.
     *
     * @internal
     */
    _isOsCompatible(osType: OperatingSystemType): boolean;
}