import type { IVpc } from 'aws-cdk-lib/aws-ec2';
import type { PolicyDocumentProps } from 'aws-cdk-lib/aws-iam';
import { PolicyDocument } from 'aws-cdk-lib/aws-iam';
import * as iam from 'aws-cdk-lib/aws-iam';
/**
 * Specifies the authentication and authorization that manages client access to
 * the service or service network.
 */
export declare enum AuthType {
    /**
     * No Authentication or Authorization. If an auth policy is present,
     * it is inactive.
     */
    NONE = "NONE",
    /**
     * Use VPC Lattice Auth Policy to control access. If enabled and a policy is
     * not attached, all traffic will be denied by default regardless of the
     * identity or service level permissions.
     */
    AWS_IAM = "AWS_IAM"
}
/**
 * Helps you create Auth Policies using higher level abstractions which reflect
 * common use cases.
 * @see https://docs.aws.amazon.com/vpc-lattice/latest/ug/auth-policies.html#example-auth-policies
 */
export declare class AuthPolicyStatement extends iam.PolicyStatement {
    /**
     * Creates an IAM Auth policy which limits access to requests which originate
     * from principals that belong to the AWS organization specified.
     * @param orgId The AWS Organization ID to limit access to.
     * @param resources optional list of resources to limit the statement to (defaults to "*")
     * @returns `AuthPolicyStatement`
     */
    static allowOnlyOrganization(orgId: string, resources?: string[]): AuthPolicyStatement;
    /**
     * Grants permissions to any authenticated request that uses the IAM role
     * specified.
     * @param role the AWS IAM Role
     * @param resources optional list of resources to limit the statement to (defaults to "*")
     * @returns `AuthPolicyStatement`
     */
    static allowOnlyRole(role: iam.IRole, resources?: string[]): AuthPolicyStatement;
    /**
     * Grants permissions to any authenticated request.
     * @param resources optional list of resources to limit the statement to (defaults to "*")
     * @returns `AuthPolicyStatement`
     */
    static allowOnlyAuthenticated(resources?: string[]): AuthPolicyStatement;
    /**
     * Grants permissions to both authenticated and unauthenticated (anonymous)
     * requests.
     * @param resources optional list of resources to limit the statement to (defaults to "*")
     * @returns `AuthPolicyStatement`
     */
    static allowAnonymous(resources?: string[]): AuthPolicyStatement;
    /**
     * Grants permissions to authenticated requests originating from principals
     * in the specified VPC
     * @param vpc the VPC to restrict requests from
     * @param resources optional list of resources to limit the statement to (defaults to "*")
     * @returns `AuthPolicyStatement`
     */
    static allowVpc(vpc: IVpc, resources?: string[], authenticated?: boolean): AuthPolicyStatement;
    protected static buildBaseStatement(): AuthPolicyStatement;
    constructor(props?: iam.PolicyStatementProps);
}
export declare class AuthPolicyDocument extends PolicyDocument {
    /**
     * Means that any request to the service or service network must contain
     * a valid request signature that is computed using Signature Version 4
     * (SigV4).
     * @see https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html
     */
    static readonly AUTHENTICATED_ONLY: AuthPolicyDocument;
    /**
     * Allows for Unauthenticated (Anonymous) Access to the Service Network.
     * Anonymous principals are callers that don't sign their AWS requests
     * with Signature Version 4 (SigV4), and are within a VPC that is connected
     * to the service network.
     */
    static readonly UNAUTHENTICATED: AuthPolicyDocument;
    /**
     * Grants permissions to any authenticated request to access as long as
     * the request originates from principals that belong to the AWS
     * organization specified in the `orgId` parameter.
     */
    static organizationOnly(orgId: string, resources?: string[]): AuthPolicyDocument;
    constructor(props?: PolicyDocumentProps);
    /**
     * Must ensure Service has the correct AuthType and policy is a
     * valid IAM Resource-based Policy for VPC Lattice
     */
    validateAuthPolicy(): string[];
    private validateActions;
    private validateResources;
}