import { Token } from '../core/tokens';
export declare class PolicyDocument extends Token {
    private readonly baseDocument?;
    private statements;
    /**
     * Creates a new IAM policy document.
     * @param defaultDocument An IAM policy document to use as an initial
     * policy. All statements of this document will be copied in.
     */
    constructor(baseDocument?: any);
    resolve(): any;
    readonly isEmpty: boolean;
    /**
     * The number of statements already added to this policy.
     * Can be used, for example, to generate uniuqe "sid"s within the policy.
     */
    readonly statementCount: number;
    addStatement(statement: PolicyStatement): PolicyDocument;
}
/**
 * Represents an IAM principal.
 */
export declare abstract class PolicyPrincipal {
    /**
     * When this Principal is used in an AssumeRole policy, the action to use.
     */
    readonly assumeRoleAction: string;
    /**
     * Return the policy fragment that identifies this principal in a Policy.
     */
    abstract policyFragment(): PrincipalPolicyFragment;
}
/**
 * A collection of the fields in a PolicyStatement that can be used to identify a principal.
 *
 * This consists of the JSON used in the "Principal" field, and optionally a
 * set of "Condition"s that need to be applied to the policy.
 */
export declare class PrincipalPolicyFragment {
    readonly principalJson: any;
    readonly conditions: {
        [key: string]: any;
    };
    constructor(principalJson: any, conditions?: {
        [key: string]: any;
    });
}
export declare class ArnPrincipal extends PolicyPrincipal {
    readonly arn: any;
    constructor(arn: any);
    policyFragment(): PrincipalPolicyFragment;
}
export declare class AccountPrincipal extends ArnPrincipal {
    readonly accountId: any;
    constructor(accountId: any);
}
/**
 * An IAM principal that represents an AWS service (i.e. sqs.amazonaws.com).
 */
export declare class ServicePrincipal extends PolicyPrincipal {
    readonly service: any;
    constructor(service: any);
    policyFragment(): PrincipalPolicyFragment;
}
/**
 * A policy prinicipal for canonicalUserIds - useful for S3 bucket policies that use
 * Origin Access identities.
 *
 * See https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html
 *
 * and
 *
 * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
 *
 * for more details.
 *
 */
export declare class CanonicalUserPrincipal extends PolicyPrincipal {
    readonly canonicalUserId: any;
    constructor(canonicalUserId: any);
    policyFragment(): PrincipalPolicyFragment;
}
export declare class FederatedPrincipal extends PolicyPrincipal {
    readonly federated: any;
    readonly conditions: {
        [key: string]: any;
    };
    readonly assumeRoleAction: string;
    constructor(federated: any, conditions: {
        [key: string]: any;
    }, assumeRoleAction?: string);
    policyFragment(): PrincipalPolicyFragment;
}
export declare class AccountRootPrincipal extends AccountPrincipal {
    constructor();
}
/**
 * A principal representing all identities in all accounts
 */
export declare class Anyone extends PolicyPrincipal {
    /**
     * Interface compatibility with AccountPrincipal for the purposes of the Lambda library
     *
     * The Lambda's addPermission() call works differently from regular
     * statements, and will use the value of this property directly if present
     * (which leads to the correct statement ultimately).
     */
    readonly accountId: string;
    policyFragment(): PrincipalPolicyFragment;
}
/**
 * Represents a statement in an IAM policy document.
 */
export declare class PolicyStatement extends Token {
    private action;
    private principal;
    private resource;
    private condition;
    private effect?;
    private sid?;
    constructor(effect?: PolicyStatementEffect);
    addAction(action: string): PolicyStatement;
    addActions(...actions: string[]): PolicyStatement;
    /**
     * Indicates if this permission has a "Principal" section.
     */
    readonly hasPrincipal: boolean;
    addPrincipal(principal: PolicyPrincipal): PolicyStatement;
    addAwsPrincipal(arn: any): PolicyStatement;
    addAwsAccountPrincipal(accountId: any): PolicyStatement;
    addServicePrincipal(service: any): PolicyStatement;
    addFederatedPrincipal(federated: any, conditions: {
        [key: string]: any;
    }): PolicyStatement;
    addAccountRootPrincipal(): PolicyStatement;
    addResource(resource: any): PolicyStatement;
    /**
     * Adds a ``"*"`` resource to this statement.
     */
    addAllResources(): PolicyStatement;
    addResources(...resources: any[]): PolicyStatement;
    /**
     * Indicates if this permission as at least one resource associated with it.
     */
    readonly hasResource: boolean;
    /**
     * Indicates if this permission has only a ``"*"`` resource associated with it.
     */
    readonly isOnlyStarResource: boolean;
    describe(sid: any): PolicyStatement;
    /**
     * Sets the permission effect to deny access to resources.
     */
    allow(): PolicyStatement;
    /**
     * Sets the permission effect to allow access to resources.
     */
    deny(): PolicyStatement;
    /**
     * Add a condition to the Policy
     */
    addCondition(key: string, value: any): PolicyStatement;
    /**
     * Add multiple conditions to the Policy
     */
    addConditions(conditions: {
        [key: string]: any;
    }): PolicyStatement;
    /**
     * Add a condition to the Policy.
     *
     * @deprecated For backwards compatibility. Use addCondition() instead.
     */
    setCondition(key: string, value: any): PolicyStatement;
    limitToAccount(accountId: any): PolicyStatement;
    resolve(): any;
    toJson(): any;
}
export declare enum PolicyStatementEffect {
    Allow = "Allow",
    Deny = "Deny"
}