/**
 * AWS EC2 provisioning composition for the Forge/PHP path — the pure, testable
 * pieces shared by {@link import('./driver').AwsDriver.provisionComputeInfrastructure}.
 *
 * Mirrors the Hetzner path: boot a single **Ubuntu** box (same base as Hetzner,
 * so the apt provisioning + nginx vhosts + php-fpm sockets are identical) with
 * the shared bootstrap as UserData, fronted by a security group. The live API
 * orchestration (AMI resolve, VPC/subnet, runInstances, wait) lives in the
 * driver; this module builds the inputs.
 */
import type { CloudConfig } from '@ts-cloud/core';
/**
 * SSM public parameter for the latest Canonical Ubuntu 24.04 (Noble) AMI —
 * region-agnostic, so we never hardcode region-specific AMI ids.
 */
export declare const UBUNTU_AMI_SSM_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
/** A security-group ingress rule. */
export interface AwsIngressRule {
    port: number;
    protocol: 'tcp';
    cidr: string;
}
/**
 * Ingress rules for a PHP/app box: SSH (deploy fallback), HTTP, HTTPS, and any
 * extra app ports any site declares. Deploys themselves run over SSM.
 */
export declare function awsComputeIngressRules(config: CloudConfig): AwsIngressRule[];
/**
 * Build the EC2 UserData (raw bash, not yet base64) from the shared Ubuntu
 * bootstrap — the exact same recipe Hetzner uses. Honors a baked golden image
 * (`compute.bakedImage`) by skipping the install-heavy steps.
 */
export declare function buildAwsUserData(config: CloudConfig): string;
/** Base64-encode UserData for the EC2 RunInstances API. */
export declare function encodeUserData(userData: string): string;
/**
 * Resolve the AMI to boot: an explicit `compute.image` (a golden AMI), else the
 * caller resolves {@link UBUNTU_AMI_SSM_PARAM} via SSM. Returns the explicit id
 * or `null` to signal "resolve Ubuntu via SSM".
 */
export declare function resolveAwsImageId(config: CloudConfig): string | null;
