# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = ['PermissionArgs', 'Permission']

@pulumi.input_type
class PermissionArgs:
    def __init__(__self__, *,
                 actions: pulumi.Input[Sequence[pulumi.Input[str]]],
                 certificate_authority_arn: pulumi.Input[str],
                 principal: pulumi.Input[str],
                 source_account: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a Permission resource.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] actions: Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        :param pulumi.Input[str] certificate_authority_arn: ARN of the CA that grants the permissions.
        :param pulumi.Input[str] principal: AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        :param pulumi.Input[str] source_account: ID of the calling account
        """
        pulumi.set(__self__, "actions", actions)
        pulumi.set(__self__, "certificate_authority_arn", certificate_authority_arn)
        pulumi.set(__self__, "principal", principal)
        if source_account is not None:
            pulumi.set(__self__, "source_account", source_account)

    @property
    @pulumi.getter
    def actions(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        """
        return pulumi.get(self, "actions")

    @actions.setter
    def actions(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "actions", value)

    @property
    @pulumi.getter(name="certificateAuthorityArn")
    def certificate_authority_arn(self) -> pulumi.Input[str]:
        """
        ARN of the CA that grants the permissions.
        """
        return pulumi.get(self, "certificate_authority_arn")

    @certificate_authority_arn.setter
    def certificate_authority_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "certificate_authority_arn", value)

    @property
    @pulumi.getter
    def principal(self) -> pulumi.Input[str]:
        """
        AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        """
        return pulumi.get(self, "principal")

    @principal.setter
    def principal(self, value: pulumi.Input[str]):
        pulumi.set(self, "principal", value)

    @property
    @pulumi.getter(name="sourceAccount")
    def source_account(self) -> Optional[pulumi.Input[str]]:
        """
        ID of the calling account
        """
        return pulumi.get(self, "source_account")

    @source_account.setter
    def source_account(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source_account", value)


@pulumi.input_type
class _PermissionState:
    def __init__(__self__, *,
                 actions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 certificate_authority_arn: Optional[pulumi.Input[str]] = None,
                 policy: Optional[pulumi.Input[str]] = None,
                 principal: Optional[pulumi.Input[str]] = None,
                 source_account: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering Permission resources.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] actions: Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        :param pulumi.Input[str] certificate_authority_arn: ARN of the CA that grants the permissions.
        :param pulumi.Input[str] policy: IAM policy that is associated with the permission.
        :param pulumi.Input[str] principal: AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        :param pulumi.Input[str] source_account: ID of the calling account
        """
        if actions is not None:
            pulumi.set(__self__, "actions", actions)
        if certificate_authority_arn is not None:
            pulumi.set(__self__, "certificate_authority_arn", certificate_authority_arn)
        if policy is not None:
            pulumi.set(__self__, "policy", policy)
        if principal is not None:
            pulumi.set(__self__, "principal", principal)
        if source_account is not None:
            pulumi.set(__self__, "source_account", source_account)

    @property
    @pulumi.getter
    def actions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        """
        return pulumi.get(self, "actions")

    @actions.setter
    def actions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "actions", value)

    @property
    @pulumi.getter(name="certificateAuthorityArn")
    def certificate_authority_arn(self) -> Optional[pulumi.Input[str]]:
        """
        ARN of the CA that grants the permissions.
        """
        return pulumi.get(self, "certificate_authority_arn")

    @certificate_authority_arn.setter
    def certificate_authority_arn(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "certificate_authority_arn", value)

    @property
    @pulumi.getter
    def policy(self) -> Optional[pulumi.Input[str]]:
        """
        IAM policy that is associated with the permission.
        """
        return pulumi.get(self, "policy")

    @policy.setter
    def policy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "policy", value)

    @property
    @pulumi.getter
    def principal(self) -> Optional[pulumi.Input[str]]:
        """
        AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        """
        return pulumi.get(self, "principal")

    @principal.setter
    def principal(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "principal", value)

    @property
    @pulumi.getter(name="sourceAccount")
    def source_account(self) -> Optional[pulumi.Input[str]]:
        """
        ID of the calling account
        """
        return pulumi.get(self, "source_account")

    @source_account.setter
    def source_account(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source_account", value)


class Permission(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 actions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 certificate_authority_arn: Optional[pulumi.Input[str]] = None,
                 principal: Optional[pulumi.Input[str]] = None,
                 source_account: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        Provides a resource to manage an AWS Certificate Manager Private Certificate Authorities Permission.
        Currently, this is only required in order to allow the ACM service to automatically renew certificates issued by a PCA.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_aws as aws

        example_certificate_authority = aws.acmpca.CertificateAuthority("exampleCertificateAuthority", certificate_authority_configuration=aws.acmpca.CertificateAuthorityCertificateAuthorityConfigurationArgs(
            key_algorithm="RSA_4096",
            signing_algorithm="SHA512WITHRSA",
            subject=aws.acmpca.CertificateAuthorityCertificateAuthorityConfigurationSubjectArgs(
                common_name="example.com",
            ),
        ))
        example_permission = aws.acmpca.Permission("examplePermission",
            certificate_authority_arn=example_certificate_authority.arn,
            actions=[
                "IssueCertificate",
                "GetCertificate",
                "ListPermissions",
            ],
            principal="acm.amazonaws.com")
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] actions: Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        :param pulumi.Input[str] certificate_authority_arn: ARN of the CA that grants the permissions.
        :param pulumi.Input[str] principal: AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        :param pulumi.Input[str] source_account: ID of the calling account
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: PermissionArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Provides a resource to manage an AWS Certificate Manager Private Certificate Authorities Permission.
        Currently, this is only required in order to allow the ACM service to automatically renew certificates issued by a PCA.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_aws as aws

        example_certificate_authority = aws.acmpca.CertificateAuthority("exampleCertificateAuthority", certificate_authority_configuration=aws.acmpca.CertificateAuthorityCertificateAuthorityConfigurationArgs(
            key_algorithm="RSA_4096",
            signing_algorithm="SHA512WITHRSA",
            subject=aws.acmpca.CertificateAuthorityCertificateAuthorityConfigurationSubjectArgs(
                common_name="example.com",
            ),
        ))
        example_permission = aws.acmpca.Permission("examplePermission",
            certificate_authority_arn=example_certificate_authority.arn,
            actions=[
                "IssueCertificate",
                "GetCertificate",
                "ListPermissions",
            ],
            principal="acm.amazonaws.com")
        ```

        :param str resource_name: The name of the resource.
        :param PermissionArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(PermissionArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 actions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 certificate_authority_arn: Optional[pulumi.Input[str]] = None,
                 principal: Optional[pulumi.Input[str]] = None,
                 source_account: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = PermissionArgs.__new__(PermissionArgs)

            if actions is None and not opts.urn:
                raise TypeError("Missing required property 'actions'")
            __props__.__dict__["actions"] = actions
            if certificate_authority_arn is None and not opts.urn:
                raise TypeError("Missing required property 'certificate_authority_arn'")
            __props__.__dict__["certificate_authority_arn"] = certificate_authority_arn
            if principal is None and not opts.urn:
                raise TypeError("Missing required property 'principal'")
            __props__.__dict__["principal"] = principal
            __props__.__dict__["source_account"] = source_account
            __props__.__dict__["policy"] = None
        super(Permission, __self__).__init__(
            'aws:acmpca/permission:Permission',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            actions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            certificate_authority_arn: Optional[pulumi.Input[str]] = None,
            policy: Optional[pulumi.Input[str]] = None,
            principal: Optional[pulumi.Input[str]] = None,
            source_account: Optional[pulumi.Input[str]] = None) -> 'Permission':
        """
        Get an existing Permission resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] actions: Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        :param pulumi.Input[str] certificate_authority_arn: ARN of the CA that grants the permissions.
        :param pulumi.Input[str] policy: IAM policy that is associated with the permission.
        :param pulumi.Input[str] principal: AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        :param pulumi.Input[str] source_account: ID of the calling account
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _PermissionState.__new__(_PermissionState)

        __props__.__dict__["actions"] = actions
        __props__.__dict__["certificate_authority_arn"] = certificate_authority_arn
        __props__.__dict__["policy"] = policy
        __props__.__dict__["principal"] = principal
        __props__.__dict__["source_account"] = source_account
        return Permission(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter
    def actions(self) -> pulumi.Output[Sequence[str]]:
        """
        Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
        """
        return pulumi.get(self, "actions")

    @property
    @pulumi.getter(name="certificateAuthorityArn")
    def certificate_authority_arn(self) -> pulumi.Output[str]:
        """
        ARN of the CA that grants the permissions.
        """
        return pulumi.get(self, "certificate_authority_arn")

    @property
    @pulumi.getter
    def policy(self) -> pulumi.Output[str]:
        """
        IAM policy that is associated with the permission.
        """
        return pulumi.get(self, "policy")

    @property
    @pulumi.getter
    def principal(self) -> pulumi.Output[str]:
        """
        AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
        """
        return pulumi.get(self, "principal")

    @property
    @pulumi.getter(name="sourceAccount")
    def source_account(self) -> pulumi.Output[str]:
        """
        ID of the calling account
        """
        return pulumi.get(self, "source_account")

