import { aws_cloudfront as cloudfront, aws_secretsmanager as secretsmanager, aws_kms as kms, RemovalPolicy } from 'aws-cdk-lib';
import * as constructs from 'constructs';
export interface CognitoAuthSecretManagerProps {
    readonly domainName: string;
    /** Config-secret name. @default `cloudfront-auth-config-${domainName}` */
    readonly configSecretName?: string;
    readonly tableName: string;
    readonly tableRegion: string;
    readonly userPoolId: string;
    readonly clientId: string;
    readonly cognitoDomain: string;
    readonly cognitoRegion: string;
    readonly securityAlertsTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    /**
     * Removal policy for the auth-secret KMS key.
     * @default RemovalPolicy.RETAIN_ON_UPDATE_OR_DELETE
     */
    readonly removalPolicy?: RemovalPolicy;
}
export declare class CognitoAuthSecretManager extends constructs.Construct {
    readonly kmsKey: kms.Key;
    readonly configSecret: secretsmanager.Secret;
    readonly kvs: cloudfront.KeyValueStore;
    constructor(scope: constructs.Construct, id: string, props: CognitoAuthSecretManagerProps);
}