import * as pulumi from "@pulumi/pulumi";
import * as outputs from "../types/output";
/**
 * Get the DNSKEY and DS records of DNSSEC-signed managed zones.
 *
 * For more information see the
 * [official documentation](https://cloud.google.com/dns/docs/dnskeys/)
 * and [API](https://cloud.google.com/dns/docs/reference/v1/dnsKeys).
 *
 * > A gcp.dns.ManagedZone resource must have DNSSEC enabled in order
 * to contain any DNSKEYs. Queries to managed zones without this setting
 * enabled will result in a 404 error as the collection of DNSKEYs does
 * not exist in the DNS API.
 *
 * ## Example Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const foo = new gcp.dns.ManagedZone("foo", {
 *     name: "foobar",
 *     dnsName: "foo.bar.",
 *     dnssecConfig: {
 *         state: "on",
 *         nonExistence: "nsec3",
 *     },
 * });
 * const fooDnsKeys = gcp.dns.getKeysOutput({
 *     managedZone: foo.id,
 * });
 * export const fooDnsDsRecord = fooDnsKeys.apply(fooDnsKeys => fooDnsKeys.keySigningKeys?.[0]?.dsRecord);
 * ```
 */
export declare function getKeys(args: GetKeysArgs, opts?: pulumi.InvokeOptions): Promise<GetKeysResult>;
/**
 * A collection of arguments for invoking getKeys.
 */
export interface GetKeysArgs {
    /**
     * The name or id of the Cloud DNS managed zone.
     */
    managedZone: string;
    /**
     * The ID of the project in which the resource belongs. If `project` is not provided, the provider project is used.
     */
    project?: string;
}
/**
 * A collection of values returned by getKeys.
 */
export interface GetKeysResult {
    /**
     * The provider-assigned unique ID for this managed resource.
     */
    readonly id: string;
    /**
     * A list of Key-signing key (KSK) records. Structure is documented below. Additionally, the DS record is provided:
     */
    readonly keySigningKeys: outputs.dns.GetKeysKeySigningKey[];
    readonly managedZone: string;
    readonly project: string;
    /**
     * A list of Zone-signing key (ZSK) records. Structure is documented below.
     */
    readonly zoneSigningKeys: outputs.dns.GetKeysZoneSigningKey[];
}
/**
 * Get the DNSKEY and DS records of DNSSEC-signed managed zones.
 *
 * For more information see the
 * [official documentation](https://cloud.google.com/dns/docs/dnskeys/)
 * and [API](https://cloud.google.com/dns/docs/reference/v1/dnsKeys).
 *
 * > A gcp.dns.ManagedZone resource must have DNSSEC enabled in order
 * to contain any DNSKEYs. Queries to managed zones without this setting
 * enabled will result in a 404 error as the collection of DNSKEYs does
 * not exist in the DNS API.
 *
 * ## Example Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const foo = new gcp.dns.ManagedZone("foo", {
 *     name: "foobar",
 *     dnsName: "foo.bar.",
 *     dnssecConfig: {
 *         state: "on",
 *         nonExistence: "nsec3",
 *     },
 * });
 * const fooDnsKeys = gcp.dns.getKeysOutput({
 *     managedZone: foo.id,
 * });
 * export const fooDnsDsRecord = fooDnsKeys.apply(fooDnsKeys => fooDnsKeys.keySigningKeys?.[0]?.dsRecord);
 * ```
 */
export declare function getKeysOutput(args: GetKeysOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetKeysResult>;
/**
 * A collection of arguments for invoking getKeys.
 */
export interface GetKeysOutputArgs {
    /**
     * The name or id of the Cloud DNS managed zone.
     */
    managedZone: pulumi.Input<string>;
    /**
     * The ID of the project in which the resource belongs. If `project` is not provided, the provider project is used.
     */
    project?: pulumi.Input<string>;
}