"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.CfnReplicaKeyPropsMixin = exports.CfnKeyPropsMixin = exports.CfnAliasPropsMixin = void 0;
const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
/* eslint-disable @stylistic/max-len, eol-last */
const cdk = __importStar(require("aws-cdk-lib/core"));
const service = __importStar(require("aws-cdk-lib/aws-kms"));
/**
 * The `AWS::KMS::Alias` resource specifies a display name for a [KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys) . You can use an alias to identify a KMS key in the AWS  console, in the [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html) operation, and in [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) , such as [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) and [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html) .
 *
 * > Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see [ABAC for AWS](https://docs.aws.amazon.com/kms/latest/developerguide/abac.html) in the *AWS Key Management Service Developer Guide* .
 *
 * Using an alias to refer to a KMS key can help you simplify key management. For example, an alias in your code can be associated with different KMS keys in different AWS Regions . For more information, see [Using aliases](https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html) in the *AWS Key Management Service Developer Guide* .
 *
 * When specifying an alias, observe the following rules.
 *
 * - Each alias is associated with one KMS key, but multiple aliases can be associated with the same KMS key.
 * - The alias and its associated KMS key must be in the same AWS account and Region.
 * - The alias name must be unique in the AWS account and Region. However, you can create aliases with the same name in different AWS Regions . For example, you can have an `alias/projectKey` in multiple Regions, each of which is associated with a KMS key in its Region.
 * - Each alias name must begin with `alias/` followed by a name, such as `alias/exampleKey` . The alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). Alias names cannot begin with `alias/aws/` . That alias name prefix is reserved for [AWS managed keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk) .
 *
 * *Regions*
 *
 * AWS  CloudFormation resources are available in all AWS Regions in which AWS  and CloudFormation are supported.
 *
 * @cloudformationResource AWS::KMS::Alias
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-alias.html
 */
class CfnAliasPropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_kms.CfnAliasPropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["aliasName", "targetKeyId"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::KMS::Alias`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_kms_CfnAliasMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnAliasPropsMixin);
            }
            throw error;
        }
        this.props = {
            ...props,
            ...flattenCfnAliasMixinProps(props)
        };
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnAlias.isCfnAlias(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnAliasPropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnAliasPropsMixin = CfnAliasPropsMixin;
// @ts-ignore TS6133
function flattenCfnAliasMixinProps(props) {
    const ret = {};
    if ((props.targetKeyId !== undefined))
        ret.targetKeyId = cdk.getRefProperty(props.targetKeyId?.keyRef, 'keyArn') ?? cdk.getRefProperty(props.targetKeyId?.replicaKeyRef, 'replicaKeyArn') ?? cdk.getRefProperty(props.targetKeyId?.keyRef, 'keyId') ?? cdk.getRefProperty(props.targetKeyId?.replicaKeyRef, 'keyId') ?? cdk.ensureStringOrUndefined(props.targetKeyId, "targetKeyId", "kms.IKeyRef | kms.IReplicaKeyRef | string");
    return ret;
}
/**
 * The `AWS::KMS::Key` resource specifies an [KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys) in AWS Key Management Service . You can use this resource to create symmetric encryption KMS keys, asymmetric KMS keys for encryption or signing, and symmetric HMAC KMS keys. You can use `AWS::KMS::Key` to create [multi-Region primary keys](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-primary-key) of all supported types. To replicate a multi-Region key, use the `AWS::KMS::ReplicaKey` resource.
 *
 * > If you change the value of the `KeySpec` , `KeyUsage` , `Origin` , or `MultiRegion` properties of an existing KMS key, the update request fails, regardless of the value of the [`UpdateReplacePolicy` attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatereplacepolicy.html) . This prevents you from accidentally deleting a KMS key by changing any of its immutable property values. > AWS  replaced the term *customer master key (CMK)* with *AWS KMS key* and *KMS key* . The concept has not changed. To prevent breaking changes, AWS  is keeping some variations of this term.
 *
 * You can use symmetric encryption KMS keys to encrypt and decrypt small amounts of data, but they are more commonly used to generate data keys and data key pairs. You can also use a symmetric encryption KMS key to encrypt data stored in AWS services that are [integrated with AWS](https://docs.aws.amazon.com//kms/features/#AWS_Service_Integration) . For more information, see [Symmetric encryption KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks) in the *AWS Key Management Service Developer Guide* .
 *
 * You can use asymmetric KMS keys to encrypt and decrypt data or sign messages and verify signatures. To create an asymmetric key, you must specify an asymmetric `KeySpec` value and a `KeyUsage` value. For details, see [Asymmetric keys in AWS](https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html) in the *AWS Key Management Service Developer Guide* .
 *
 * You can use HMAC KMS keys (which are also symmetric keys) to generate and verify hash-based message authentication codes. To create an HMAC key, you must specify an HMAC `KeySpec` value and a `KeyUsage` value of `GENERATE_VERIFY_MAC` . For details, see [HMAC keys in AWS](https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html) in the *AWS Key Management Service Developer Guide* .
 *
 * You can also create symmetric encryption, asymmetric, and HMAC multi-Region primary keys. To create a multi-Region primary key, set the `MultiRegion` property to `true` . For information about multi-Region keys, see [Multi-Region keys in AWS](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html) in the *AWS Key Management Service Developer Guide* .
 *
 * You cannot use the `AWS::KMS::Key` resource to specify a KMS key with [imported key material](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html) or a KMS key in a [custom key store](https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html) .
 *
 * *Regions*
 *
 * AWS  CloudFormation resources are available in all Regions in which AWS  and CloudFormation are supported. You can use the `AWS::KMS::Key` resource to create and manage all KMS key types that are supported in a Region.
 *
 * @cloudformationResource AWS::KMS::Key
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html
 */
class CfnKeyPropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_kms.CfnKeyPropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["bypassPolicyLockoutSafetyCheck", "description", "enabled", "enableKeyRotation", "keyPolicy", "keySpec", "keyUsage", "multiRegion", "origin", "pendingWindowInDays", "rotationPeriodInDays", "tags"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::KMS::Key`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_kms_CfnKeyMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnKeyPropsMixin);
            }
            throw error;
        }
        this.props = props;
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnKey.isCfnKey(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnKeyPropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnKeyPropsMixin = CfnKeyPropsMixin;
/**
 * The `AWS::KMS::ReplicaKey` resource specifies a multi-Region replica key that is based on a multi-Region primary key.
 *
 * *Multi-Region keys* are an AWS  feature that lets you create multiple interoperable KMS keys in different AWS Regions . Because these KMS keys have the same key ID, key material, and other metadata, you can use them to encrypt data in one AWS Region and decrypt it in a different AWS Region without making a cross-Region call or exposing the plaintext data. For more information, see [Multi-Region keys](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html) in the *AWS Key Management Service Developer Guide* .
 *
 * A multi-Region *primary key* is a fully functional symmetric encryption KMS key, HMAC KMS key, or asymmetric KMS key that is also the model for replica keys in other AWS Regions . To create a multi-Region primary key, add an [AWS::KMS::Key](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html) resource to your CloudFormation stack. Set its `MultiRegion` property to true.
 *
 * A multi-Region *replica key* is a fully functional KMS key that has the same key ID and key material as a multi-Region primary key, but is located in a different AWS Region of the same AWS partition. There can be multiple replicas of a primary key, but each must be in a different AWS Region .
 *
 * When you create a replica key in CloudFormation , the replica key is created in the AWS Region represented by the endpoint you use for the request. If you try to replicate a multi-Region key into a Region in which the key type is not supported, the request will fail.
 *
 * A primary key and its replicas have the same key ID and key material. They also have the same key spec, key usage, key material origin, and automatic key rotation status. These properties are known as *shared properties* . If they change, AWS  synchronizes the change to all related multi-Region keys. All other properties of a replica key can differ, including its key policy, tags, aliases, and key state. AWS  does not synchronize these properties.
 *
 * *Regions*
 *
 * AWS  CloudFormation resources are available in all AWS Regions in which AWS  and CloudFormation are supported. You can use the `AWS::KMS::ReplicaKey` resource to create replica keys in all Regions that support multi-Region KMS keys. For details, see [Multi-Region keys in AWS](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html) in the ** .
 *
 * @cloudformationResource AWS::KMS::ReplicaKey
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-replicakey.html
 */
class CfnReplicaKeyPropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_kms.CfnReplicaKeyPropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["description", "enabled", "keyPolicy", "pendingWindowInDays", "primaryKeyArn", "tags"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::KMS::ReplicaKey`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_kms_CfnReplicaKeyMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnReplicaKeyPropsMixin);
            }
            throw error;
        }
        this.props = props;
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnReplicaKey.isCfnReplicaKey(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnReplicaKeyPropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnReplicaKeyPropsMixin = CfnReplicaKeyPropsMixin;
