/**
 *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
 *  with the License. A copy of the License is located at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
 *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
 *  and limitations under the License.
 */
import type { Construct } from 'constructs';
import type { IWorkloadIdentityRef, WorkloadIdentityReference } from '../../../aws-bedrockagentcore';
import * as iam from '../../../aws-iam';
import type { IResource, ResourceProps } from '../../../core';
import { Resource } from '../../../core';
/******************************************************************************
 *                                Interface
 *****************************************************************************/
/**
 * A workload identity for Amazon Bedrock AgentCore.
 *
 * Represents the stable identity of an agent within an account's agent identity directory.
 * It ties together IAM roles, OAuth2 flows, API keys, and workload access tokens
 * for consistent authentication across environments.
 *
 * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/understanding-agent-identities.html
 */
export interface IWorkloadIdentity extends IResource, iam.IGrantable, IWorkloadIdentityRef {
    /**
     * The ARN of this workload identity.
     * @attribute
     */
    readonly workloadIdentityArn: string;
    /**
     * The name of this workload identity.
     * @attribute
     */
    readonly workloadIdentityName: string;
    /**
     * Timestamp when the workload identity was created.
     * @attribute
     */
    readonly createdTime?: string;
    /**
     * Timestamp when the workload identity was last updated.
     * @attribute
     */
    readonly lastUpdatedTime?: string;
    /**
     * Grants IAM actions on this workload identity, scoped to its ARN and the parent resources
     * required by the Bedrock AgentCore authorization model.
     */
    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
    /**
     * Grant `GetWorkloadIdentity` and `ListWorkloadIdentities`, scoped to this identity
     * and parent resources required by the Bedrock AgentCore authorization model.
     */
    grantRead(grantee: iam.IGrantable): iam.Grant;
    /**
     * Grant control plane permissions to manage this workload identity.
     */
    grantAdmin(grantee: iam.IGrantable): iam.Grant;
    /**
     * Grant data plane permissions to mint workload access tokens
     * (`GetWorkloadAccessToken`, `GetWorkloadAccessTokenForJWT`, `GetWorkloadAccessTokenForUserId`).
     */
    grantUse(grantee: iam.IGrantable): iam.Grant;
    /**
     * Grant read, list, admin, and use permissions.
     */
    grantFullAccess(grantee: iam.IGrantable): iam.Grant;
}
/**
 * Properties for a new {@link WorkloadIdentity}.
 */
export interface WorkloadIdentityProps {
    /**
     * Name of the workload identity.
     *
     * @default - a name generated by CDK
     */
    readonly workloadIdentityName?: string;
    /**
     * Allowed OAuth2 return URLs for resources associated with this workload identity.
     *
     * @default - no return URLs
     */
    readonly allowedResourceOauth2ReturnUrls?: string[];
    /**
     * Tags for this workload identity.
     *
     * @default - no tags
     */
    readonly tags?: {
        [key: string]: string;
    };
}
/**
 * Attributes for importing an existing workload identity.
 */
export interface WorkloadIdentityAttributes {
    /**
     * ARN of the workload identity.
     */
    readonly workloadIdentityArn: string;
    /**
     * Name of the workload identity.
     */
    readonly workloadIdentityName: string;
    /**
     * Resource creation time.
     *
     * @default - not set
     */
    readonly createdTime?: string;
    /**
     * Resource last-updated time.
     *
     * @default - not set
     */
    readonly lastUpdatedTime?: string;
}
/******************************************************************************
 *                         Abstract base
 *****************************************************************************/
declare abstract class WorkloadIdentityBase extends Resource implements IWorkloadIdentity {
    abstract readonly workloadIdentityArn: string;
    abstract readonly workloadIdentityName: string;
    abstract readonly createdTime?: string;
    abstract readonly lastUpdatedTime?: string;
    readonly grantPrincipal: iam.IPrincipal;
    get workloadIdentityRef(): WorkloadIdentityReference;
    constructor(scope: Construct, id: string, props?: ResourceProps);
    /**
     * [disable-awslint:no-grants]
     */
    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
    /**
     * [disable-awslint:no-grants]
     */
    grantRead(grantee: iam.IGrantable): iam.Grant;
    /**
     * [disable-awslint:no-grants]
     */
    grantAdmin(grantee: iam.IGrantable): iam.Grant;
    /**
     * [disable-awslint:no-grants]
     */
    grantUse(grantee: iam.IGrantable): iam.Grant;
    /**
     * [disable-awslint:no-grants]
     */
    grantFullAccess(grantee: iam.IGrantable): iam.Grant;
}
/******************************************************************************
 *                                Class
 *****************************************************************************/
/**
 * L2 construct for `AWS::BedrockAgentCore::WorkloadIdentity`.
 *
 * A workload identity is the stable identity of an agent in an AWS account. It ties together
 * IAM roles, OAuth2 flows, API keys, and workload access tokens for consistent authentication
 * across environments.
 *
 * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-workloadidentity.html
 * @resource AWS::BedrockAgentCore::WorkloadIdentity
 */
export declare class WorkloadIdentity extends WorkloadIdentityBase {
    /** Uniquely identifies this class. */
    static readonly PROPERTY_INJECTION_ID: string;
    /**
     * Import an existing workload identity.
     */
    static fromWorkloadIdentityAttributes(scope: Construct, id: string, attrs: WorkloadIdentityAttributes): IWorkloadIdentity;
    readonly workloadIdentityArn: string;
    readonly workloadIdentityName: string;
    private _createdTime?;
    private _lastUpdatedTime?;
    private readonly _resource;
    get createdTime(): string | undefined;
    get lastUpdatedTime(): string | undefined;
    constructor(scope: Construct, id: string, props?: WorkloadIdentityProps);
}
export {};