"use strict";
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
    if (mod && mod.__esModule) return mod;
    var result = {};
    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
    __setModuleDefault(result, mod);
    return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.CustomerManagedPolicyAttachmentsExclusive = void 0;
const pulumi = __importStar(require("@pulumi/pulumi"));
const utilities = __importStar(require("../utilities"));
/**
 * Resource for managing exclusive AWS SSO Admin Customer Managed Policy Attachments.
 *
 * This resource is designed to manage all customer managed policy attachments for an SSO permission set. Using this resource, Terraform will remove any customer managed policies attached to the permission set that are not defined in the configuration.
 *
 * > **WARNING:** Do not use this resource together with the `aws.ssoadmin.CustomerManagedPolicyAttachment` resource for the same permission set. Doing so will cause a conflict and will lead to customer managed policies being removed.
 *
 * > Destruction of this resource means Terraform will no longer manage the customer managed policy attachments, **but will not detach any policies**. The permission set will retain all customer managed policies that were attached at the time of destruction.
 *
 * ## Example Usage
 *
 * ### Basic Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const example = aws.ssoadmin.getInstances({});
 * const examplePermissionSet = new aws.ssoadmin.PermissionSet("example", {
 *     name: "Example",
 *     instanceArn: example.then(example => example.arns?.[0]),
 * });
 * const examplePolicy = new aws.iam.Policy("example", {
 *     name: "TestPolicy",
 *     description: "My test policy",
 *     policy: JSON.stringify({
 *         Version: "2012-10-17",
 *         Statement: [{
 *             Action: ["ec2:Describe*"],
 *             Effect: "Allow",
 *             Resource: "*",
 *         }],
 *     }),
 * });
 * const exampleCustomerManagedPolicyAttachmentsExclusive = new aws.ssoadmin.CustomerManagedPolicyAttachmentsExclusive("example", {
 *     instanceArn: example.then(example => example.arns?.[0]),
 *     permissionSetArn: examplePermissionSet.arn,
 *     customerManagedPolicyReferences: [{
 *         name: examplePolicy.name,
 *         path: "/",
 *     }],
 * });
 * ```
 *
 * ### Disallow Customer Managed Policy Attachments
 *
 * To disallow all customer managed policy attachments, omit the `customerManagedPolicyReference` block.
 *
 * > Any customer managed policies attached to the permission set will be **removed**.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const example = new aws.ssoadmin.CustomerManagedPolicyAttachmentsExclusive("example", {
 *     instanceArn: exampleAwsSsoadminInstances.arns[0],
 *     permissionSetArn: exampleAwsSsoadminPermissionSet.arn,
 * });
 * ```
 *
 * ## Import
 *
 * ### Identity Schema
 *
 * #### Required
 *
 * * `instanceArn` (String) ARN of the SSO Instance.
 * * `permissionSetArn` (String) ARN of the Permission Set.
 *
 * #### Optional
 *
 * * `region` (String) Region where this resource is managed.
 *
 * Using `pulumi import`, import SSO Admin Customer Managed Policy Attachments Exclusive using the `instanceArn` and `permissionSetArn` arguments, separated by a comma (`,`). For example:
 *
 * ```sh
 * $ pulumi import aws:ssoadmin/customerManagedPolicyAttachmentsExclusive:CustomerManagedPolicyAttachmentsExclusive example arn:aws:sso:::instance/ssoins-1234567890abcdef,arn:aws:sso:::permissionSet/ssoins-1234567890abcdef/ps-1234567890abcdef
 * ```
 */
class CustomerManagedPolicyAttachmentsExclusive extends pulumi.CustomResource {
    /**
     * Get an existing CustomerManagedPolicyAttachmentsExclusive resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name, id, state, opts) {
        return new CustomerManagedPolicyAttachmentsExclusive(name, state, { ...opts, id: id });
    }
    /** @internal */
    static __pulumiType = 'aws:ssoadmin/customerManagedPolicyAttachmentsExclusive:CustomerManagedPolicyAttachmentsExclusive';
    /**
     * Returns true if the given object is an instance of CustomerManagedPolicyAttachmentsExclusive.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj) {
        if (obj === undefined || obj === null) {
            return false;
        }
        return obj['__pulumiType'] === CustomerManagedPolicyAttachmentsExclusive.__pulumiType;
    }
    constructor(name, argsOrState, opts) {
        let resourceInputs = {};
        opts = opts || {};
        if (opts.id) {
            const state = argsOrState;
            resourceInputs["customerManagedPolicyReferences"] = state?.customerManagedPolicyReferences;
            resourceInputs["instanceArn"] = state?.instanceArn;
            resourceInputs["permissionSetArn"] = state?.permissionSetArn;
            resourceInputs["region"] = state?.region;
            resourceInputs["timeouts"] = state?.timeouts;
        }
        else {
            const args = argsOrState;
            if (args?.instanceArn === undefined && !opts.urn) {
                throw new Error("Missing required property 'instanceArn'");
            }
            if (args?.permissionSetArn === undefined && !opts.urn) {
                throw new Error("Missing required property 'permissionSetArn'");
            }
            resourceInputs["customerManagedPolicyReferences"] = args?.customerManagedPolicyReferences;
            resourceInputs["instanceArn"] = args?.instanceArn;
            resourceInputs["permissionSetArn"] = args?.permissionSetArn;
            resourceInputs["region"] = args?.region;
            resourceInputs["timeouts"] = args?.timeouts;
        }
        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
        super(CustomerManagedPolicyAttachmentsExclusive.__pulumiType, name, resourceInputs, opts);
    }
}
exports.CustomerManagedPolicyAttachmentsExclusive = CustomerManagedPolicyAttachmentsExclusive;
//# sourceMappingURL=customerManagedPolicyAttachmentsExclusive.js.map