/**
 * VPC Agent Security Utilities
 *
 * Provides security-related utilities for the VPC Agent including
 * IAM policy generation and security group configuration helpers.
 *
 * @module runtime-awake/vpc-agent/security
 *
 * @see Requirements 10.5, 10.6
 */
import type { VpcAgentConfig } from './vpc-agent.types';
/**
 * IAM policy statement for VPC Agent Lambda.
 */
export interface IamPolicyStatement {
    readonly Effect: 'Allow' | 'Deny';
    readonly Action: string | string[];
    readonly Resource: string | string[];
    readonly Condition?: Record<string, Record<string, string | string[]>>;
}
/**
 * IAM policy document for VPC Agent.
 */
export interface IamPolicyDocument {
    readonly Version: '2012-10-17';
    readonly Statement: IamPolicyStatement[];
}
/**
 * Security group rule for VPC Agent.
 */
export interface SecurityGroupRule {
    readonly protocol: 'tcp' | 'udp' | '-1';
    readonly fromPort: number;
    readonly toPort: number;
    readonly description: string;
}
/**
 * Generate IAM policy for VPC Agent Lambda execution role.
 *
 * Creates a least-privilege policy that only allows:
 * - CloudWatch Logs for logging
 * - VPC network interface management (for VPC Lambda)
 * - No access to other AWS services
 *
 * @param config - VPC Agent configuration
 * @param region - AWS region
 * @param accountId - AWS account ID
 * @returns IAM policy document
 *
 * @see Requirements 10.5
 */
export declare function generateVpcAgentExecutionPolicy(config: VpcAgentConfig, region: string, accountId: string): IamPolicyDocument;
/**
 * Generate IAM policy for developers to invoke VPC Agent.
 *
 * Creates a policy that allows developers to invoke the VPC Agent
 * Lambda function via Function URL or API Gateway.
 *
 * @param functionArn - VPC Agent Lambda function ARN
 * @param allowedDevelopers - List of IAM user/role ARNs allowed to invoke
 * @returns IAM policy document
 *
 * @see Requirements 10.5
 */
export declare function generateVpcAgentInvokePolicy(functionArn: string, allowedDevelopers: string[]): IamPolicyDocument;
/**
 * Generate security group egress rules for VPC Agent.
 *
 * Creates egress rules that only allow traffic to the configured
 * allowed hosts and ports, preventing unrestricted VPC access.
 *
 * @param config - VPC Agent configuration
 * @returns Array of security group rules
 *
 * @see Requirements 10.6
 */
export declare function generateSecurityGroupEgressRules(config: VpcAgentConfig): SecurityGroupRule[];
/**
 * Validate that a configuration doesn't allow unrestricted access.
 *
 * Checks for overly permissive configurations that could allow
 * unrestricted access to the VPC.
 *
 * @param config - VPC Agent configuration
 * @returns Validation result with warnings
 *
 * @see Requirements 10.6
 */
export declare function validateSecurityConfig(config: VpcAgentConfig): {
    valid: boolean;
    warnings: string[];
};
/**
 * Sanitize host pattern for logging.
 *
 * Removes potentially sensitive information from host patterns
 * before logging.
 *
 * @param host - Host pattern to sanitize
 * @returns Sanitized host pattern
 */
export declare function sanitizeHostForLogging(host: string): string;
export declare function shouldRateLimit(clientId: string, maxRequestsPerMinute?: number): boolean;
/**
 * Clear rate limit entries (for testing or cleanup).
 */
export declare function clearRateLimits(): void;
