import type { aws_ec2 as ec2 } from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import * as core from 'aws-cdk-lib';
import type { Construct } from 'constructs';
import { AuthPolicyDocument, AuthType } from './auth';
import type { LoggingDestination } from './logging';
import type { IService } from './service';
/**
 * Represents a VPC Lattice Service Network.
 * Implemented by `ServiceNetwork`.
 */
export interface IServiceNetwork extends core.IResource {
    /**
     * The Amazon Resource Name (ARN) of the service network.
     * @attribute
     */
    readonly serviceNetworkArn: string;
    /**
     * The Id of the Service Network
     * @attribute
     * @example "sn-0123456789abcdef0"
     */
    readonly serviceNetworkId: string;
    /**
     * Associate a Lattice Service to the Service Network
     */
    associateService(service: IService): void;
    /**
     * Associate a VPC with the Service Network
     */
    associateVPC(props: AssociateVPCProps): void;
}
/**
 * Properties to share a Service Network
 * @see https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-vpc-lattice
 */
export interface ShareServiceNetworkProps {
    /**
     * The name of the share.
     */
    readonly name: string;
    /**
     * Specifies whether principals outside your organization in AWS Organizations
     * can be associated with a resource share. A value of `true` lets you share
     * with individual AWS accounts that are *not* in your organization. A value
     * of `false` only has meaning if your account is a member of an AWS
     * Organization.
     * @default true;
     */
    readonly allowExternalPrincipals?: boolean;
    /**
     * Principals to share the Service Network with
     * @default none
     */
    readonly principals?: string[];
    /**
     * Resources to share the Service Network with
     * @default none
     */
    readonly resourceArns?: string[];
}
/**
 * Properties to associate a VPC with a Service Network
 */
export interface AssociateVPCProps {
    /**
     * The VPC to associate with the Service Network
     */
    readonly vpc: ec2.IVpc;
    /**
     * The security groups to associate with the Service Network
     * @default - a security group that allows inbound 443 will be permitted.
     */
    readonly securityGroups?: ec2.SecurityGroup[];
}
/**
 * Properties for defining a VPC Lattice Service Network
 */
export interface ServiceNetworkProps {
    /**
     * The name of the Service Network. If not provided,
     * CloudFormation will generate a name.
     * @default - CloudFormation generated name
     */
    readonly name?: string;
    /**
     * The authentication and authorization that manages client access to the network.
     * If `AuthType.AWS_IAM` is selected, and a policy is not attached, all traffic will be denied
     * by default regardless of the identity or service level permissions.
     * @default AuthType.NONE
     */
    readonly authType?: AuthType;
    /**
     * Where to send access logs. Access log entries represent traffic
     * originated from VPCs associated with that network.
     * @default - No logging
     */
    readonly loggingDestinations?: LoggingDestination[];
    /**
     * Lattice Services that are associated with this Service Network
     * @default - no services are associated with the service network
     */
    readonly services?: IService[];
    /**
     * You can associate VPCs to your service network at or after network creation.
     * After association, services within the VPC can make calls to services in the
     * service network. Any VPC owner with access to the service network can associate
     * their VPCs to it.
     * @default - no VPCs are associated
     */
    readonly vpcAssociations?: AssociateVPCProps[];
    /**
     * Determine what happens to the repository when the resource/stack is deleted.
     *
     * @default RemovalPolicy.RETAIN
     */
    readonly removalPolicy?: core.RemovalPolicy;
    /**
     * Policy to apply to the service network
     * @default - No policy is applied
     */
    readonly authPolicy?: AuthPolicyDocument;
}
/**
 * Base class for Service Network. Reused between imported and created service networks.
 */
declare abstract class ServiceNetworkBase extends core.Resource implements IServiceNetwork {
    /**
     * @inheritdoc
     */
    abstract readonly serviceNetworkArn: string;
    /**
     * @inheritdoc
     */
    abstract readonly serviceNetworkId: string;
    /**
     * Associate a Lattice Service with a Service Network
     */
    associateService(service: IService): void;
    /**
     * Apply the VPC to the Service Network
     */
    associateVPC(props: AssociateVPCProps): void;
}
/**
 * Define a VPC Lattice Service Network.
 *
 * @resource AWS::VpcLattice::ServiceNetwork
 */
export declare class ServiceNetwork extends ServiceNetworkBase {
    /**
     * Import a Service Network by Arn
     */
    static fromArn(scope: Construct, id: string, arn: string): IServiceNetwork;
    /**
     * Import a Service Network by Id
     */
    static fromId(scope: Construct, id: string, serviceNetworkId: string): IServiceNetwork;
    readonly serviceNetworkArn: string;
    readonly serviceNetworkId: string;
    /**
     * The name of the service network
     */
    readonly name: string;
    /**
     * The auth type of the service network
     * @default AuthType.NONE
     */
    readonly authType: AuthType;
    /**
     * Logging destinations of the service network
     */
    readonly loggingDestinations: LoggingDestination[];
    /**
     * Auth policy to be added to the service network
     */
    readonly authPolicy: AuthPolicyDocument;
    private readonly _resource;
    constructor(scope: Construct, id: string, props: ServiceNetworkProps);
    /**
     * Must be between 3-63 characters. Lowercase letters, numbers, and hyphens are accepted.
     * Must begin and end with a letter or number. No consecutive hyphens.
     */
    protected validateServiceNetworkName(name: string): string[];
    /**
     * Must specify at most only one destination per destination type
     */
    protected validateLoggingDestinations(loggingDestinations: LoggingDestination[]): string[];
    /**
     * .grantAccess on a lattice service, will permit the principals to
     * access all of the service. Consider using more granular permissions
     * at the rule level.
     *
     * @param principals a list of IAM principals to grant access.
     */
    grantAccess(principals: iam.IPrincipal[]): void;
    /**
     * Send logs to a destination
     */
    addLoggingDestination(destination: LoggingDestination): void;
    /**
     * Associates a VPC with the service network.
     */
    /**
     * Amazon VPC Lattice integrates with AWS Resource Access Manager (AWS RAM) to enable
     * resource sharing across AWS accounts or through AWS Organizations.
     */
    shareResource(props: ShareServiceNetworkProps): void;
}
/**
 * Props to Associate a VPC with a Service Network
 */
export interface ServiceNetworkVpcAssociationProps {
    /**
     * Security groups for the lattice endpoint
     */
    readonly securityGroups?: ec2.ISecurityGroup[];
    /**
     * The VPC to associate with
     */
    readonly vpc: ec2.IVpc;
    /**
     * Service Network Identifier
     */
    readonly serviceNetworkId: string;
}
/**
 * Associate a VPC with Lattice Service Network
 */
export declare class ServiceNetworkVpcAssociation extends core.Resource {
    constructor(scope: Construct, id: string, props: ServiceNetworkVpcAssociationProps);
}
export {};