"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const cdk_1 = require("@aws-cdk/cdk");
const alias_1 = require("./alias");
const kms_generated_1 = require("./kms.generated");
class EncryptionKeyRef extends cdk_1.Construct {
    /**
     * Defines an imported encryption key.
     *
     * `ref` can be obtained either via a call to `key.export()` or using
     * literals.
     *
     * For example:
     *
     *     const keyRefProps = key.export();
     *     const keyRef1 = EncryptionKeyRef.import(this, 'MyImportedKey1', keyRefProps);
     *     const keyRef2 = EncryptionKeyRef.import(this, 'MyImportedKey2', {
     *         keyArn: new KeyArn('arn:aws:kms:...')
     *     });
     *
     * @param parent The parent construct.
     * @param name The name of the construct.
     * @param props The key reference.
     */
    static import(parent, name, props) {
        return new EncryptionKeyRefImport(parent, name, props);
    }
    /**
     * Defines a new alias for the key.
     */
    addAlias(alias) {
        return new alias_1.EncryptionKeyAlias(this, 'Alias', { alias, key: this });
    }
    /**
     * Adds a statement to the KMS key resource policy.
     * @param statement The policy statement to add
     * @param allowNoOp If this is set to `false` and there is no policy
     * defined (i.e. external key), the operation will fail. Otherwise, it will
     * no-op.
     */
    addToResourcePolicy(statement, allowNoOp = true) {
        if (!this.policy) {
            if (allowNoOp) {
                return;
            }
            throw new Error(`Unable to add statement to IAM resource policy for KMS key: ${JSON.stringify(cdk_1.resolve(this.keyArn))}`);
        }
        this.policy.addStatement(statement);
    }
    /**
     * Exports this key from the current stack.
     * @returns a key ref which can be used in a call to `EncryptionKey.import(ref)`.
     */
    export() {
        return {
            keyArn: new cdk_1.Output(this, 'KeyArn').makeImportValue()
        };
    }
}
exports.EncryptionKeyRef = EncryptionKeyRef;
/**
 * Definews a KMS key.
 */
class EncryptionKey extends EncryptionKeyRef {
    constructor(parent, name, props = {}) {
        super(parent, name);
        if (props.policy) {
            this.policy = props.policy;
        }
        else {
            this.policy = new cdk_1.PolicyDocument();
            this.allowAccountToAdmin();
        }
        const resource = new kms_generated_1.cloudformation.KeyResource(this, 'Resource', {
            description: props.description,
            enableKeyRotation: props.enableKeyRotation,
            enabled: props.enabled,
            keyPolicy: this.policy
        });
        this.keyArn = resource.keyArn;
        resource.options.deletionPolicy = cdk_1.DeletionPolicy.Retain;
    }
    /**
     * Let users from this account admin this key.
     * @link https://aws.amazon.com/premiumsupport/knowledge-center/update-key-policy-future/
     */
    allowAccountToAdmin() {
        const actions = [
            "kms:Create*",
            "kms:Describe*",
            "kms:Enable*",
            "kms:List*",
            "kms:Put*",
            "kms:Update*",
            "kms:Revoke*",
            "kms:Disable*",
            "kms:Get*",
            "kms:Delete*",
            "kms:ScheduleKeyDeletion",
            "kms:CancelKeyDeletion"
        ];
        this.addToResourcePolicy(new cdk_1.PolicyStatement()
            .addResource('*')
            .addActions(...actions)
            .addAccountRootPrincipal());
    }
}
exports.EncryptionKey = EncryptionKey;
class EncryptionKeyRefImport extends EncryptionKeyRef {
    constructor(parent, name, props) {
        super(parent, name);
        this.policy = undefined; // no policy associated with an imported key
        this.keyArn = props.keyArn;
    }
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsia2V5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsc0NBQTJHO0FBQzNHLG1DQUE2QztBQUM3QyxtREFBeUQ7QUFTekQsTUFBc0IsZ0JBQWlCLFNBQVEsZUFBUztJQUNwRDs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FpQkc7SUFDSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQWlCLEVBQUUsSUFBWSxFQUFFLEtBQTRCO1FBQzlFLE9BQU8sSUFBSSxzQkFBc0IsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFlRDs7T0FFRztJQUNJLFFBQVEsQ0FBQyxLQUFhO1FBQ3pCLE9BQU8sSUFBSSwwQkFBa0IsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSSxtQkFBbUIsQ0FBQyxTQUEwQixFQUFFLFNBQVMsR0FBRyxJQUFJO1FBQ25FLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFO1lBQ2QsSUFBSSxTQUFTLEVBQUU7Z0JBQUUsT0FBTzthQUFFO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsK0RBQStELElBQUksQ0FBQyxTQUFTLENBQUMsYUFBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztTQUMxSDtRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxNQUFNO1FBQ1QsT0FBTztZQUNILE1BQU0sRUFBRSxJQUFJLFlBQU0sQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsZUFBZSxFQUFFO1NBQ3ZELENBQUM7SUFDTixDQUFDO0NBQ0o7QUFwRUQsNENBb0VDO0FBaUNEOztHQUVHO0FBQ0gsTUFBYSxhQUFjLFNBQVEsZ0JBQWdCO0lBSS9DLFlBQVksTUFBaUIsRUFBRSxJQUFZLEVBQUUsUUFBNEIsRUFBRTtRQUN2RSxLQUFLLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRXBCLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRTtZQUNkLElBQUksQ0FBQyxNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQztTQUM5QjthQUFNO1lBQ0gsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLG9CQUFjLEVBQUUsQ0FBQztZQUNuQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztTQUM5QjtRQUVELE1BQU0sUUFBUSxHQUFHLElBQUksOEJBQWMsQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUM5RCxXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7WUFDOUIsaUJBQWlCLEVBQUUsS0FBSyxDQUFDLGlCQUFpQjtZQUMxQyxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU87WUFDdEIsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNO1NBQ3pCLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUM5QixRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsR0FBRyxvQkFBYyxDQUFDLE1BQU0sQ0FBQztJQUM1RCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ssbUJBQW1CO1FBQ3ZCLE1BQU0sT0FBTyxHQUFHO1lBQ1osYUFBYTtZQUNiLGVBQWU7WUFDZixhQUFhO1lBQ2IsV0FBVztZQUNYLFVBQVU7WUFDVixhQUFhO1lBQ2IsYUFBYTtZQUNiLGNBQWM7WUFDZCxVQUFVO1lBQ1YsYUFBYTtZQUNiLHlCQUF5QjtZQUN6Qix1QkFBdUI7U0FDMUIsQ0FBQztRQUVGLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLHFCQUFlLEVBQUU7YUFDekMsV0FBVyxDQUFDLEdBQUcsQ0FBQzthQUNoQixVQUFVLENBQUMsR0FBRyxPQUFPLENBQUM7YUFDdEIsdUJBQXVCLEVBQUUsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7Q0FDSjtBQWxERCxzQ0FrREM7QUFFRCxNQUFNLHNCQUF1QixTQUFRLGdCQUFnQjtJQUlqRCxZQUFZLE1BQWlCLEVBQUUsSUFBWSxFQUFFLEtBQTRCO1FBQ3JFLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFITCxXQUFNLEdBQUcsU0FBUyxDQUFDLENBQUMsNENBQTRDO1FBSy9FLElBQUksQ0FBQyxNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQztJQUMvQixDQUFDO0NBQ0oifQ==