import { Value } from '../../../cloudformation/Value';
/**
  Creates a new Lambda rotation function based on one of the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html"> Secrets Manager rotation function templates</a>.
  For full documentation go to <a href="http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html">the AWS Docs</a>
*/
export interface HostedRotationLambdaProps {
    /** <p> */
    runtime?: Value<string>;
    /** <p> */
    rotationType: Value<string>;
    /** <code>RotationLambdaName</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-rotationlambdaname"></a>
  The name of the Lambda rotation function.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    rotationLambdaName?: Value<string>;
    /** <code>KmsKeyArn</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-kmskeyarn"></a>
  The ARN of the KMS key that Secrets Manager uses to encrypt the secret. If you don’t specify this value, then Secrets Manager uses the key <code>aws/secretsmanager</code>. If <code>aws/secretsmanager</code> doesn’t yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    kmsKeyArn?: Value<string>;
    /** <code>MasterSecretArn</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-mastersecretarn"></a>
  The ARN of the secret that contains superuser credentials, if you use the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users"> Alternating users rotation strategy</a>. CloudFormation grants the execution role for the Lambda rotation function <code>GetSecretValue</code> permission to the secret in this property. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html">Lambda rotation function execution role permissions for Secrets Manager</a>.<br />
  You must create the superuser secret before you can set this property.<br />
  You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html">JSON structure of Secrets Manager secrets</a>.<br />
  You can specify <code>MasterSecretArn</code> or <code>SuperuserSecretArn</code> but not both. They represent the same superuser secret.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    masterSecretArn?: Value<string>;
    /** <code>VpcSecurityGroupIds</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-vpcsecuritygroupids"></a>
  A comma-separated list of security group IDs applied to the target database.<br />
  The template applies the same security groups as on the Lambda rotation function that is created as part of this stack.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    vpcSecurityGroupIds?: Value<string>;
    /** <code>ExcludeCharacters</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-excludecharacters"></a>
  A string of the characters that you don’t want in the password.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    excludeCharacters?: Value<string>;
    /** <code>MasterSecretKmsKeyArn</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-mastersecretkmskeyarn"></a>
  The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users">alternating users strategy</a> and the superuser secret is encrypted with a customer managed key. You don’t need to specify this property if the superuser secret is encrypted using the key <code>aws/secretsmanager</code>. CloudFormation grants the execution role for the Lambda rotation function <code>Decrypt</code>, <code>DescribeKey</code>, and <code>GenerateDataKey</code> permission to the key in this property. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html">Lambda rotation function execution role permissions for Secrets Manager</a>.<br />
  You can specify <code>MasterSecretKmsKeyArn</code> or <code>SuperuserSecretKmsKeyArn</code> but not both. They represent the same superuser secret KMS key.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    masterSecretKmsKeyArn?: Value<string>;
    /** <code>SuperuserSecretArn</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-superusersecretarn"></a>
  The ARN of the secret that contains superuser credentials, if you use the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users"> Alternating users rotation strategy</a>. CloudFormation grants the execution role for the Lambda rotation function <code>GetSecretValue</code> permission to the secret in this property. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html">Lambda rotation function execution role permissions for Secrets Manager</a>.<br />
  You must create the superuser secret before you can set this property.<br />
  You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html">JSON structure of Secrets Manager secrets</a>.<br />
  You can specify <code>MasterSecretArn</code> or <code>SuperuserSecretArn</code> but not both. They represent the same superuser secret.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    superuserSecretArn?: Value<string>;
    /** <code>SuperuserSecretKmsKeyArn</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-superusersecretkmskeyarn"></a>
  The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users">alternating users strategy</a> and the superuser secret is encrypted with a customer managed key. You don’t need to specify this property if the superuser secret is encrypted using the key <code>aws/secretsmanager</code>. CloudFormation grants the execution role for the Lambda rotation function <code>Decrypt</code>, <code>DescribeKey</code>, and <code>GenerateDataKey</code> permission to the key in this property. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html">Lambda rotation function execution role permissions for Secrets Manager</a>.<br />
  You can specify <code>MasterSecretKmsKeyArn</code> or <code>SuperuserSecretKmsKeyArn</code> but not both. They represent the same superuser secret KMS key.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    superuserSecretKmsKeyArn?: Value<string>;
    /** <code>VpcSubnetIds</code>  <a name="cfn-secretsmanager-rotationschedule-hostedrotationlambda-vpcsubnetids"></a>
  A comma separated list of VPC subnet IDs of the target database network. The Lambda rotation function is in the same subnet group.<br />
  
  Required: No<br />
  
  Update requires: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt">No interruption</a> */
    vpcSubnetIds?: Value<string>;
}
