"""
Autogenerated state module using `pop-create-idem <https://gitlab.com/saltstack/pop/pop-create-idem>`__

hub.exec.boto3.client.sso_admin.create_instance_access_control_attribute_configuration
hub.exec.boto3.client.sso_admin.delete_instance_access_control_attribute_configuration
hub.exec.boto3.client.sso_admin.describe_instance_access_control_attribute_configuration
hub.exec.boto3.client.sso_admin.update_instance_access_control_attribute_configuration
"""



from typing import *
import dict_tools.differ as differ
async def present(hub, ctx, name: Text, instance_arn: Text, instance_access_control_attribute_configuration: Dict)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Enables the attributes-based access control (ABAC) feature for the specified Amazon Web Services SSO instance.
    You can also specify new attributes to add to your ABAC configuration during the enabling process. For more
    information about ABAC, see Attribute-Based Access Control in the Amazon Web Services SSO User Guide.

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        instance_arn(Text): The ARN of the SSO instance under which the operation will be executed.
        instance_access_control_attribute_configuration(Dict): Specifies the Amazon Web Services SSO identity store attributes to add to your ABAC
            configuration. When using an external identity provider as an identity source, you can pass
            attributes through the SAML assertion. Doing so provides an alternative to configuring
            attributes from the Amazon Web Services SSO identity store. If a SAML assertion passes any of
            these attributes, Amazon Web Services SSO will replace the attribute value with the value from
            the Amazon Web Services SSO identity store.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_present:
              aws_auto.sso_admin.instance_access_control_attribute_configuration.present:
                - name: value
                - instance_arn: value
                - instance_access_control_attribute_configuration: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.sso_admin.instance_access_control_attribute_configuration.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    
    before = await hub.exec.boto3.client.sso_admin.describe_instance_access_control_attribute_configuration(name)

    if before:
        result["comment"] = f"'{name}' already exists"
    else:
        try:
            ret = await hub.exec.boto3.client.sso_admin.create_instance_access_control_attribute_configuration(
                ctx,
                
                
                **{"InstanceArn": instance_arn, "InstanceAccessControlAttributeConfiguration": instance_access_control_attribute_configuration}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            ret["comment"] = f"Created '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    
    # TODO perform other modifications as needed here
    ...

    after = await hub.exec.boto3.client.sso_admin.describe_instance_access_control_attribute_configuration(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

async def absent(hub, ctx, name: Text, instance_arn: Text)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Disables the attributes-based access control (ABAC) feature for the specified Amazon Web Services SSO instance
    and deletes all of the attribute mappings that have been configured. Once deleted, any attributes that are
    received from an identity source and any custom attributes you have previously configured will not be passed.
    For more information about ABAC, see Attribute-Based Access Control in the Amazon Web Services SSO User Guide.

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        instance_arn(Text): The ARN of the SSO instance under which the operation will be executed.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_absent:
              aws_auto.sso_admin.instance_access_control_attribute_configuration.absent:
                - name: value
                - instance_arn: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.sso_admin.instance_access_control_attribute_configuration.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    

    before = await hub.exec.boto3.client.sso_admin.describe_instance_access_control_attribute_configuration(name)

    if not before:
        result["comment"] = f"'{name}' already absent"
    else:
        try:
            ret = await hub.exec.boto3.client.sso_admin.delete_instance_access_control_attribute_configuration(
                ctx,
                
                
                **{"InstanceArn": instance_arn}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            result["comment"] = f"Deleted '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    

    after = await hub.exec.boto3.client.sso_admin.describe_instance_access_control_attribute_configuration(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

