"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.CfnSecretTargetAttachmentPropsMixin = exports.CfnSecretPropsMixin = exports.CfnRotationSchedulePropsMixin = exports.CfnResourcePolicyPropsMixin = void 0;
const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
/* eslint-disable @stylistic/max-len, eol-last */
const cdk = __importStar(require("aws-cdk-lib/core"));
const service = __importStar(require("aws-cdk-lib/aws-secretsmanager"));
/**
 * Attaches a resource-based permission policy to a secret.
 *
 * A resource-based policy is optional. If a secret already has a resource policy attached, you must first remove it before attaching a new policy using this CloudFormation resource. You can remove the policy using the [console](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html) , [CLI](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/delete-resource-policy.html) , or [API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteResourcePolicy.html) . For more information, see [Authentication and access control for Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html) .
 *
 * *Required permissions:* `secretsmanager:PutResourcePolicy` , `secretsmanager:GetResourcePolicy` . For more information, see [IAM policy actions for Secrets Manager](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html#awssecretsmanager-actions-as-permissions) and [Authentication and access control in Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html) .
 *
 * @cloudformationResource AWS::SecretsManager::ResourcePolicy
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-resourcepolicy.html
 */
class CfnResourcePolicyPropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_secretsmanager.CfnResourcePolicyPropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["blockPublicPolicy", "resourcePolicy", "secretId"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::SecretsManager::ResourcePolicy`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_secretsmanager_CfnResourcePolicyMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnResourcePolicyPropsMixin);
            }
            throw error;
        }
        this.props = {
            ...props,
            ...flattenCfnResourcePolicyMixinProps(props)
        };
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnResourcePolicy.isCfnResourcePolicy(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnResourcePolicyPropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnResourcePolicyPropsMixin = CfnResourcePolicyPropsMixin;
// @ts-ignore TS6133
function flattenCfnResourcePolicyMixinProps(props) {
    const ret = {};
    if ((props.secretId !== undefined))
        ret.secretId = cdk.getRefProperty(props.secretId?.secretRef, 'secretId') ?? cdk.ensureStringOrUndefined(props.secretId, "secretId", "secretsmanager.ISecretRef | string");
    return ret;
}
/**
 * Configure the rotation schedule and Lambda rotation function for a secret. For more information, see [How rotation works](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) .
 *
 * For database credentials, refer to the following resources:
 *
 * - Amazon RDS master user credentials: [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html)
 * - Amazon Redshift admin user credentials: [AWS::Redshift::Cluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-redshift-cluster.html)
 *
 * Choose one of the following options for the rotation function:
 *
 * - Create a new rotation function using `HostedRotationLambda` based on a [Secrets Manager rotation function template](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) .
 * - Use an existing rotation function by specifying its ARN with `RotationLambdaARN` .
 *
 * > For database secrets defined in the same CloudFormation template as the database or service:
 * >
 * > - Use the [AWS::SecretsManager::SecretTargetAttachment](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html) resource to populate the secret with connection details.
 * > - Add a `DependsOn` attribute to the `RotationSchedule` resource that uses a `SecretTargetAttachment` . This ensures the rotation is configured after the secret is populated with connection details. > You can define only one rotation schedule per secret.
 *
 * @cloudformationResource AWS::SecretsManager::RotationSchedule
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-rotationschedule.html
 */
class CfnRotationSchedulePropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_secretsmanager.CfnRotationSchedulePropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["externalSecretRotationMetadata", "externalSecretRotationRoleArn", "hostedRotationLambda", "rotateImmediatelyOnUpdate", "rotationLambdaArn", "rotationRules", "secretId"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::SecretsManager::RotationSchedule`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_secretsmanager_CfnRotationScheduleMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnRotationSchedulePropsMixin);
            }
            throw error;
        }
        this.props = props;
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnRotationSchedule.isCfnRotationSchedule(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnRotationSchedulePropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnRotationSchedulePropsMixin = CfnRotationSchedulePropsMixin;
/**
 * Creates a new secret.
 *
 * A *secret* can be a password, a set of credentials such as a user name and password, an OAuth token, or other secret information that you store in an encrypted form in Secrets Manager.
 *
 * For Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .
 *
 * For Amazon Redshift admin user credentials, see [AWS::Redshift::Cluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-redshift-cluster.html) .
 *
 * To retrieve a secret in a CloudFormation template, use a *dynamic reference* . For more information, see [Retrieve a secret in an CloudFormation resource](https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html) .
 *
 * For information about creating a secret in the console, see [Create a secret](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html) . For information about creating a secret using the CLI or SDK, see [CreateSecret](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html) .
 *
 * For information about retrieving a secret in code, see [Retrieve secrets from Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html) .
 *
 * @cloudformationResource AWS::SecretsManager::Secret
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secret.html
 */
class CfnSecretPropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_secretsmanager.CfnSecretPropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["description", "generateSecretString", "kmsKeyId", "name", "replicaRegions", "secretString", "tags", "type"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::SecretsManager::Secret`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_secretsmanager_CfnSecretMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnSecretPropsMixin);
            }
            throw error;
        }
        this.props = {
            ...props,
            ...flattenCfnSecretMixinProps(props)
        };
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnSecret.isCfnSecret(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnSecretPropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnSecretPropsMixin = CfnSecretPropsMixin;
// @ts-ignore TS6133
function flattenCfnSecretMixinProps(props) {
    const ret = {};
    if ((props.kmsKeyId !== undefined))
        ret.kmsKeyId = cdk.getRefProperty(props.kmsKeyId?.keyRef, 'keyArn') ?? cdk.getRefProperty(props.kmsKeyId?.keyRef, 'keyId') ?? cdk.ensureStringOrUndefined(props.kmsKeyId, "kmsKeyId", "kms.IKeyRef | string");
    return ret;
}
/**
 * The `AWS::SecretsManager::SecretTargetAttachment` resource completes the final link between a Secrets Manager secret and the associated database by adding the database connection information to the secret JSON.
 *
 * If you want to turn on automatic rotation for a database credential secret, the secret must contain the database connection information. For more information, see [JSON structure of Secrets Manager database credential secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html) .
 *
 * A single secret resource can only have one target attached to it.
 *
 * When you remove a `SecretTargetAttachment` from a stack, Secrets Manager removes the database connection information from the secret with a `PutSecretValue` call.
 *
 * For Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .
 *
 * For Amazon Redshift admin user credentials, see [AWS::Redshift::Cluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-redshift-cluster.html) .
 *
 * @cloudformationResource AWS::SecretsManager::SecretTargetAttachment
 * @mixin true
 * @stability external
 * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html
 */
class CfnSecretTargetAttachmentPropsMixin extends cdk.Mixin {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/cfn-property-mixins.aws_secretsmanager.CfnSecretTargetAttachmentPropsMixin", version: "2.258.1" };
    static CFN_PROPERTY_KEYS = ["secretId", "targetId", "targetType"];
    props;
    strategy;
    /**
     * Create a mixin to apply properties to `AWS::SecretsManager::SecretTargetAttachment`.
     *
     * @param props L1 properties to apply
     * @param options Mixin options
     */
    constructor(props, options = {}) {
        super();
        try {
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_aws_secretsmanager_CfnSecretTargetAttachmentMixinProps(props);
            jsiiDeprecationWarnings._aws_cdk_cfn_property_mixins_CfnPropertyMixinOptions(options);
        }
        catch (error) {
            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
                Error.captureStackTrace(error, CfnSecretTargetAttachmentPropsMixin);
            }
            throw error;
        }
        this.props = props;
        this.strategy = (options.strategy ?? cdk.PropertyMergeStrategy.combine());
    }
    /**
     * Check if this mixin supports the given construct
     */
    supports(construct) {
        return (cdk.CfnResource.isCfnResource(construct) && service.CfnSecretTargetAttachment.isCfnSecretTargetAttachment(construct));
    }
    /**
     * Apply the mixin properties to the construct
     */
    applyTo(construct) {
        if (this.supports(construct)) {
            this.strategy.apply(construct, this.props, CfnSecretTargetAttachmentPropsMixin.CFN_PROPERTY_KEYS);
        }
    }
}
exports.CfnSecretTargetAttachmentPropsMixin = CfnSecretTargetAttachmentPropsMixin;
