"use strict";var _a,_b,_c;Object.defineProperty(exports,"__esModule",{value:!0}),exports.FlowLog=exports.FlowLogDestination=exports.FlowLogResourceType=exports.FlowLogDestinationType=exports.FlowLogTrafficType=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),iam=require("../../aws-iam"),logs=require("../../aws-logs"),s3=require("../../aws-s3"),core_1=require("../../core"),ec2_generated_1=require("./ec2.generated");var FlowLogTrafficType;(function(FlowLogTrafficType2){FlowLogTrafficType2.ACCEPT="ACCEPT",FlowLogTrafficType2.ALL="ALL",FlowLogTrafficType2.REJECT="REJECT"})(FlowLogTrafficType=exports.FlowLogTrafficType||(exports.FlowLogTrafficType={}));var FlowLogDestinationType;(function(FlowLogDestinationType2){FlowLogDestinationType2.CLOUD_WATCH_LOGS="cloud-watch-logs",FlowLogDestinationType2.S3="s3"})(FlowLogDestinationType=exports.FlowLogDestinationType||(exports.FlowLogDestinationType={}));class FlowLogResourceType{static fromSubnet(subnet){return jsiiDeprecationWarnings.aws_cdk_lib_aws_ec2_ISubnet(subnet),{resourceType:"Subnet",resourceId:subnet.subnetId}}static fromVpc(vpc){return jsiiDeprecationWarnings.aws_cdk_lib_aws_ec2_IVpc(vpc),{resourceType:"VPC",resourceId:vpc.vpcId}}static fromNetworkInterfaceId(id){return{resourceType:"NetworkInterface",resourceId:id}}}exports.FlowLogResourceType=FlowLogResourceType,_a=JSII_RTTI_SYMBOL_1,FlowLogResourceType[_a]={fqn:"aws-cdk-lib.aws_ec2.FlowLogResourceType",version:"2.13.0"};class FlowLogDestination{static toCloudWatchLogs(logGroup,iamRole){return jsiiDeprecationWarnings.aws_cdk_lib_aws_logs_ILogGroup(logGroup),jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_IRole(iamRole),new CloudWatchLogsDestination({logDestinationType:FlowLogDestinationType.CLOUD_WATCH_LOGS,logGroup,iamRole})}static toS3(bucket,keyPrefix){return jsiiDeprecationWarnings.aws_cdk_lib_aws_s3_IBucket(bucket),new S3Destination({logDestinationType:FlowLogDestinationType.S3,s3Bucket:bucket,keyPrefix})}}exports.FlowLogDestination=FlowLogDestination,_b=JSII_RTTI_SYMBOL_1,FlowLogDestination[_b]={fqn:"aws-cdk-lib.aws_ec2.FlowLogDestination",version:"2.13.0"};class S3Destination extends FlowLogDestination{constructor(props){super();this.props=props}bind(scope,_flowLog){let s3Bucket;return this.props.s3Bucket===void 0?s3Bucket=new s3.Bucket(scope,"Bucket",{encryption:s3.BucketEncryption.UNENCRYPTED,removalPolicy:core_1.RemovalPolicy.RETAIN}):s3Bucket=this.props.s3Bucket,{logDestinationType:FlowLogDestinationType.S3,s3Bucket,keyPrefix:this.props.keyPrefix}}}class CloudWatchLogsDestination extends FlowLogDestination{constructor(props){super();this.props=props}bind(scope,_flowLog){let iamRole,logGroup;return this.props.iamRole===void 0?iamRole=new iam.Role(scope,"IAMRole",{roleName:core_1.PhysicalName.GENERATE_IF_NEEDED,assumedBy:new iam.ServicePrincipal("vpc-flow-logs.amazonaws.com")}):iamRole=this.props.iamRole,this.props.logGroup===void 0?logGroup=new logs.LogGroup(scope,"LogGroup"):logGroup=this.props.logGroup,iamRole.addToPrincipalPolicy(new iam.PolicyStatement({actions:["logs:CreateLogStream","logs:PutLogEvents","logs:DescribeLogStreams"],effect:iam.Effect.ALLOW,resources:[logGroup.logGroupArn]})),iamRole.addToPrincipalPolicy(new iam.PolicyStatement({actions:["iam:PassRole"],effect:iam.Effect.ALLOW,resources:[iamRole.roleArn]})),{logDestinationType:FlowLogDestinationType.CLOUD_WATCH_LOGS,logGroup,iamRole}}}class FlowLogBase extends core_1.Resource{}class FlowLog extends FlowLogBase{constructor(scope,id,props){super(scope,id,{physicalName:props.flowLogName});jsiiDeprecationWarnings.aws_cdk_lib_aws_ec2_FlowLogProps(props);const destinationConfig=(props.destination||FlowLogDestination.toCloudWatchLogs()).bind(this,this);this.logGroup=destinationConfig.logGroup,this.bucket=destinationConfig.s3Bucket,this.iamRole=destinationConfig.iamRole,this.keyPrefix=destinationConfig.keyPrefix;let logDestination;this.bucket&&(logDestination=this.keyPrefix?this.bucket.arnForObjects(this.keyPrefix):this.bucket.bucketArn);const flowLog=new ec2_generated_1.CfnFlowLog(this,"FlowLog",{deliverLogsPermissionArn:this.iamRole?this.iamRole.roleArn:void 0,logDestinationType:destinationConfig.logDestinationType,logGroupName:this.logGroup?this.logGroup.logGroupName:void 0,resourceId:props.resourceType.resourceId,resourceType:props.resourceType.resourceType,trafficType:props.trafficType?props.trafficType:FlowLogTrafficType.ALL,logDestination});this.flowLogId=flowLog.ref}static fromFlowLogId(scope,id,flowLogId){class Import extends FlowLogBase{constructor(){super(...arguments);this.flowLogId=flowLogId}}return new Import(scope,id)}}exports.FlowLog=FlowLog,_c=JSII_RTTI_SYMBOL_1,FlowLog[_c]={fqn:"aws-cdk-lib.aws_ec2.FlowLog",version:"2.13.0"};
//# sourceMappingURL=vpc-flow-logs.js.map
