import { aws_iam as iam, Resource } from 'aws-cdk-lib';
import type { IResource, RemovalPolicy } from 'aws-cdk-lib';
import type { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
import type { IHostedZone } from 'aws-cdk-lib/aws-route53';
import type { Construct } from 'constructs';
import { AuthType, AuthPolicyDocument } from './auth';
import { Listener } from './listener';
import type { AddRuleProps, ListenerProtocol } from './listener';
import type { LoggingDestination } from './logging';
import type { RuleAction } from './rule-action';
import type { IServiceNetwork } from './service-network';
import { MappingRecordType } from './util';
/**
 * Represents a Vpc Lattice Service.
 * Implemented by `Service`.
 */
export interface IService extends IResource {
    /**
     * The Amazon Resource Name (ARN) of the service.
     * @attribute
     * @example "arn:aws:vpc-lattice:eu-central-1:123456789123:service/svc-03537cbda06ea0823"
     */
    readonly serviceArn: string;
    /**
     * The Id of the service.
     * @attribute
     * @example "svc-03537cbda06ea0823"
     */
    readonly serviceId: string;
    /**
     * Associate the service with a Service Network.
     */
    associateWithServiceNetwork(serviceNetwork: IServiceNetwork): void;
}
export interface ShareServiceProps {
    /**
     * The name of the share.
     */
    readonly name: string;
    /**
     * Whether external principals are allowed.
     * @default false;
     */
    readonly allowExternalPrincipals?: boolean;
    /**
     * Principals to share the Service Network with
     * @default none
     */
    readonly principals?: string[];
    /**
     * Resources to share the Service Network with
     * @default none
     */
    readonly resourceArns?: string[];
}
export interface AddListenerProps {
    /**
     * The Name of the listener.
     */
    readonly name?: string;
    /**
     * Protocol that the listener will listen on
     */
    readonly protocol?: ListenerProtocol;
    /**
     * Optional port number for the listener. If not supplied, will default to 80 or 443, depending on the Protocol.
     * @default - 80 or 443 depending on the Protocol
     */
    readonly port?: number;
    /**
     *  * A default action that will be taken if no rules match.
     *  @default HTTPFixedResponse.NOT_FOUND
     */
    readonly defaultAction?: RuleAction;
    /**
     * Rules to add to the listener.
     */
    readonly rules?: AddRuleProps[];
    /**
     * Determine what happens to the service when the resource/stack is deleted.
     *
     * @default RemovalPolicy.RETAIN
     */
    readonly removalPolicy?: RemovalPolicy;
}
export interface LatticeDnsEntry {
    /**
     * The domain name of the service.
     */
    readonly domainName: string;
    /**
     * The Route53 Private Hosted Zone or Public Hosted Zone.
     */
    readonly hostedZone: IHostedZone;
}
export interface CustomDomainProps {
    /**
     * A registered custom domain name for your service. Requests to the custom
     * domain are resolved by the DNS server to the VPC Lattice generated domain
     * name. Note: **Changing it requires recreating the service.**
     * @default - Your service will be reachable only by the domain name that VPC Lattice generates
     * @see https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-custom-domain-name.html
     */
    readonly domainName: string;
    /**
     * The Route53 Private Hosted Zone or Public Hosted Zone.
     * This will add a record between the custom domain name and the VPC
     * Lattice service generated DNS name. Leave empty if DNS is managed outside
     * of Route53 or if you want to manually add the Route53 Alias or CNAME record.
     */
    readonly hostedZone?: IHostedZone;
    /**
     * A certificate that may be used by the service. To receive HTTPS requests,
     * you must provide your own certificate in AWS Certificate Manager.
     * @default - No custom certificate is used.
     * @see https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-byoc.html
     */
    readonly certificate?: ICertificate;
    /**
     * The type of record to be added to the hosted zone.
     * Available options are: Alias (default), or CNAME
     * @default MappingRecordType.ALIAS
     * @see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html
     */
    readonly recordType?: MappingRecordType;
}
/**
 * Properties for defining a VPC Lattice Service
 */
export interface ServiceProps {
    /**
     * The name to assign to the service.
     *
     * Note: It must be unique within your AWS account and this name will become part of
     * the service DNS and can't be changed after the VPC Lattice service is created.
     * @see https://docs.aws.amazon.com/vpc-lattice/latest/ug/services.html
     * @default - a CloudFormation generated name
     */
    readonly name?: string;
    /**
     * Determine what happens to the service when the resource/stack is deleted.
     *
     * @default RemovalPolicy.RETAIN
     */
    readonly removalPolicy?: RemovalPolicy;
    /**
     * The authentication and authorization that manages client access to the service.
     * If AuthType.AWS_IAM is selected, and an auth policy is not attached or an access mode
     * is not specified, all traffic will be denied to the service, regardless of the identity
     * or permissions associated with the service network-level policy.
     * @default AuthType.NONE
     */
    readonly authType?: AuthType;
    /**
     * A registered custom domain name for your service. Requests to the custom
     * domain are resolved by the DNS server to the VPC Lattice generated domain name.
     * Note: **Changing it requires recreating the service.**
     * @default - Your service will be reachable only by the domain name that VPC Lattice generates
     * @see https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-custom-domain-name.html
     */
    readonly customDomain?: CustomDomainProps;
    /**
     * ServiceNetwork to associate with.
     * @default - will not associate with any serviceNetwork.
     */
    readonly serviceNetwork?: IServiceNetwork;
    /**
     * Where to send access logs. Access log entries represent traffic
     * originated from VPCs associated with that network.
     * @default - No logging
     */
    readonly loggingDestinations?: LoggingDestination[];
    /**
     * Policy to apply to the service
     * @default - No policy is attached. All traffic is denied by default.
     */
    readonly authPolicy?: AuthPolicyDocument;
}
/**
 * Base class for Service. Reused between imported and created services.
 */
declare abstract class ServiceBase extends Resource implements IService {
    /**
     * @inheritdoc
     */
    abstract readonly serviceArn: string;
    /**
     * @inheritdoc
     */
    abstract readonly serviceId: string;
    /**
     * Associate a Lattice Service with a Service Network
     */
    associateWithServiceNetwork(serviceNetwork: IServiceNetwork): void;
}
/**
 * Define a VPC Lattice Service.
 *
 * @resource AWS::VpcLattice::Service
 */
export declare class Service extends ServiceBase {
    static fromServiceArn(scope: Construct, id: string, serviceArn: string): IService;
    static fromServiceId(scope: Construct, id: string, serviceId: string): IService;
    readonly serviceArn: string;
    readonly serviceId: string;
    /**
     * The name of the service
     */
    readonly serviceName: string;
    /**
     * The auth type of the service
     */
    readonly authType: AuthType;
    /**
     * Logging destinations of the service
     */
    readonly loggingDestinations: LoggingDestination[];
    /**
     * Auth policy to be added to the service.
     */
    readonly authPolicy: AuthPolicyDocument;
    /**
     * VPC Lattice DNS Entry
     */
    readonly dnsEntry: LatticeDnsEntry;
    /**
     * Custom Domain Name
     */
    readonly customDomain?: CustomDomainProps;
    /**
     * L1 resource
     */
    private readonly _resource;
    constructor(scope: Construct, id: string, props: ServiceProps);
    /**
     * Must be between 3-40 characters. Lowercase letters, numbers, and hyphens are accepted.
     * Must begin and end with a letter or number. No consecutive hyphens.
     */
    protected validateServiceName(name: string): string[];
    /**
     * Must specify at most only one destination per destination type
     */
    protected validateLoggingDestinations(loggingDestinations: LoggingDestination[]): string[];
    /**
     * .grantAccess on a lattice service, will permit the principals to
     * access all of the service. Consider using more granular permissions
     * at the rule level.
     *
     * @param principals a list of IAM principals to grant access.
     */
    grantAccess(principals: iam.IPrincipal[]): void;
    /**
     * Send logs to a destination
     */
    private addLoggingDestination;
    /**
     * Add Listener
     */
    addListener(listener: AddListenerProps): Listener;
    /**
     * Amazon VPC Lattice integrates with AWS Resource Access Manager (AWS RAM) to enable
     * resource sharing across AWS accounts or through AWS Organizations.
     */
    shareResource(props: ShareServiceProps): void;
}
export {};