import { AccessLevelList } from '../shared/access-level' ; import { PolicyStatement , Operator } from '../shared' ; param sid export class Secretsmanager extends PolicyStatement { public servicePrefix = 'secretsmanager' ; param sid constructor ( sid ? ) { super ( sid ) ; } /**
     * Grants permission to cancel an in-progress secret rotation
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CancelRotateSecret.html
     */ public toCancelRotateSecret ( ) { return this . to ( 'CancelRotateSecret' ) ; } /**
     * Grants permission to create a secret that stores encrypted data that can be queried and rotated
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifName()
     * - .ifDescription()
     * - .ifKmsKeyId()
     * - .ifAwsRequestTag()
     * - .ifAwsResourceTag()
     * - .ifAwsTagKeys()
     * - .ifResourceTag()
     * - .ifAddReplicaRegions()
     * - .ifForceOverwriteReplicaSecret()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html
     */ public toCreateSecret ( ) { return this . to ( 'CreateSecret' ) ; } /**
     * Grants permission to delete the resource policy attached to a secret
     *
     * Access Level: Permissions management
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteResourcePolicy.html
     */ public toDeleteResourcePolicy ( ) { return this . to ( 'DeleteResourcePolicy' ) ; } /**
     * Grants permission to delete a secret
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifRecoveryWindowInDays()
     * - .ifForceDeleteWithoutRecovery()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html
     */ public toDeleteSecret ( ) { return this . to ( 'DeleteSecret' ) ; } /**
     * Grants permission to retrieve the metadata about a secret, but not the encrypted data
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DescribeSecret.html
     */ public toDescribeSecret ( ) { return this . to ( 'DescribeSecret' ) ; } /**
     * Grants permission to generate a random string for use in password creation
     *
     * Access Level: Read
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetRandomPassword.html
     */ public toGetRandomPassword ( ) { return this . to ( 'GetRandomPassword' ) ; } /**
     * Grants permission to get the resource policy attached to a secret
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetResourcePolicy.html
     */ public toGetResourcePolicy ( ) { return this . to ( 'GetResourcePolicy' ) ; } /**
     * Grants permission to retrieve and decrypt the encrypted data
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifVersionId()
     * - .ifVersionStage()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
     */ public toGetSecretValue ( ) { return this . to ( 'GetSecretValue' ) ; } /**
     * Grants permission to list the available versions of a secret
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecretVersionIds.html
     */ public toListSecretVersionIds ( ) { return this . to ( 'ListSecretVersionIds' ) ; } /**
     * Grants permission to list the available secrets
     *
     * Access Level: List
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html
     */ public toListSecrets ( ) { return this . to ( 'ListSecrets' ) ; } /**
     * Grants permission to attach a resource policy to a secret
     *
     * Access Level: Permissions management
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifBlockPublicPolicy()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_PutResourcePolicy.html
     */ public toPutResourcePolicy ( ) { return this . to ( 'PutResourcePolicy' ) ; } /**
     * Grants permission to create a new version of the secret with new encrypted data
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_PutSecretValue.html
     */ public toPutSecretValue ( ) { return this . to ( 'PutSecretValue' ) ; } /**
     * Grants permission to remove regions from replication
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RemoveRegionsFromReplication.html
     */ public toRemoveRegionsFromReplication ( ) { return this . to ( 'RemoveRegionsFromReplication' ) ; } /**
     * Grants permission to convert an existing secret to a multi-Region secret and begin replicating the secret to a list of new regions
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     * - .ifAddReplicaRegions()
     * - .ifForceOverwriteReplicaSecret()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ReplicateSecretToRegions.html
     */ public toReplicateSecretToRegions ( ) { return this . to ( 'ReplicateSecretToRegions' ) ; } /**
     * Grants permission to cancel deletion of a secret
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RestoreSecret.html
     */ public toRestoreSecret ( ) { return this . to ( 'RestoreSecret' ) ; } /**
     * Grants permission to start rotation of a secret
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifRotationLambdaARN()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RotateSecret.html
     */ public toRotateSecret ( ) { return this . to ( 'RotateSecret' ) ; } /**
     * Grants permission to remove the secret from replication and promote the secret to a regional secret in the replica Region
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_StopReplicationToReplica.html
     */ public toStopReplicationToReplica ( ) { return this . to ( 'StopReplicationToReplica' ) ; } /**
     * Grants permission to add tags to a secret
     *
     * Access Level: Tagging
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifAwsRequestTag()
     * - .ifAwsTagKeys()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_TagResource.html
     */ public toTagResource ( ) { return this . to ( 'TagResource' ) ; } /**
     * Grants permission to remove tags from a secret
     *
     * Access Level: Tagging
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifAwsTagKeys()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UntagResource.html
     */ public toUntagResource ( ) { return this . to ( 'UntagResource' ) ; } /**
     * Grants permission to update a secret with new metadata or with a new version of the encrypted data
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifDescription()
     * - .ifKmsKeyId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UpdateSecret.html
     */ public toUpdateSecret ( ) { return this . to ( 'UpdateSecret' ) ; } /**
     * Grants permission to move a stage from one secret to another
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifVersionStage()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UpdateSecretVersionStage.html
     */ public toUpdateSecretVersionStage ( ) { return this . to ( 'UpdateSecretVersionStage' ) ; } /**
     * Grants permission to validate a resource policy before attaching policy
     *
     * Access Level: Permissions management
     *
     * Possible conditions:
     * - .ifSecretId()
     * - .ifResource()
     * - .ifResourceTag()
     * - .ifAwsResourceTag()
     * - .ifSecretPrimaryRegion()
     *
     * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ValidateResourcePolicy.html
     */ public toValidateResourcePolicy ( ) { return this . to ( 'ValidateResourcePolicy' ) ; } protected accessLevelList : AccessLevelList = { Write : [ 'CancelRotateSecret' , 'CreateSecret' , 'DeleteSecret' , 'PutSecretValue' , 'RemoveRegionsFromReplication' , 'ReplicateSecretToRegions' , 'RestoreSecret' , 'RotateSecret' , 'StopReplicationToReplica' , 'UpdateSecret' , 'UpdateSecretVersionStage' ] , 'Permissions management' : [ 'DeleteResourcePolicy' , 'PutResourcePolicy' , 'ValidateResourcePolicy' ] , Read : [ 'DescribeSecret' , 'GetRandomPassword' , 'GetResourcePolicy' , 'GetSecretValue' , 'ListSecretVersionIds' ] , List : [ 'ListSecrets' ] , Tagging : [ 'TagResource' , 'UntagResource' ] } ; param secretId param account param region param partition public onSecret ( secretId , account ? , region ? , partition ? ) { return this . on ( `arn:${ partition || 'aws' }:secretsmanager:${ region || '*' }:${ account || '*' }:secret:${ secretId }` ) ; } param value param operator public ifAddReplicaRegions ( value , operator ? ) { return this . if ( `AddReplicaRegions` , value , operator || 'StringLike' ) ; } param value public ifBlockPublicPolicy ( value ? ) { return this . if ( `BlockPublicPolicy` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value param operator public ifDescription ( value , operator ? ) { return this . if ( `Description` , value , operator || 'StringLike' ) ; } param value public ifForceDeleteWithoutRecovery ( value ? ) { return this . if ( `ForceDeleteWithoutRecovery` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value public ifForceOverwriteReplicaSecret ( value ? ) { return this . if ( `ForceOverwriteReplicaSecret` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value param operator public ifKmsKeyId ( value , operator ? ) { return this . if ( `KmsKeyId` , value , operator || 'StringLike' ) ; } param value param operator public ifName ( value , operator ? ) { return this . if ( `Name` , value , operator || 'StringLike' ) ; } param value param operator public ifRecoveryWindowInDays ( value , operator ? ) { return this . if ( `RecoveryWindowInDays` , value , operator || 'NumericEquals' ) ; } param tagKey param value param operator public ifResourceTag ( tagKey , value , operator ? ) { return this . if ( `ResourceTag/${ tagKey }` , value , operator || 'StringLike' ) ; } param value param operator public ifRotationLambdaARN ( value , operator ? ) { return this . if ( `RotationLambdaARN` , value , operator || 'ArnLike' ) ; } param value param operator public ifSecretId ( value , operator ? ) { return this . if ( `SecretId` , value , operator || 'ArnLike' ) ; } param value param operator public ifSecretPrimaryRegion ( value , operator ? ) { return this . if ( `SecretPrimaryRegion` , value , operator || 'StringLike' ) ; } param value param operator public ifVersionId ( value , operator ? ) { return this . if ( `VersionId` , value , operator || 'StringLike' ) ; } param value param operator public ifVersionStage ( value , operator ? ) { return this . if ( `VersionStage` , value , operator || 'StringLike' ) ; } param allowRotationLambdaArn param value param operator public ifResource ( allowRotationLambdaArn , value , operator ? ) { return this . if ( `resource/${ allowRotationLambdaArn }` , value , operator || 'ArnLike' ) ; } }