"""
Autogenerated state module using `pop-create-idem <https://gitlab.com/saltstack/pop/pop-create-idem>`__

hub.exec.boto3.client.s3.delete_bucket_encryption
hub.exec.boto3.client.s3.get_bucket_encryption
hub.exec.boto3.client.s3.put_bucket_encryption
"""



from typing import *
import dict_tools.differ as differ
async def present(hub, ctx, name: Text, bucket: Text, server_side_encryption_configuration: Dict, content_md5: Text = None, expected_bucket_owner: Text = None)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    This action uses the encryption subresource to configure default encryption and Amazon S3 Bucket Key for an
    existing bucket. Default encryption for a bucket can use server-side encryption with Amazon S3-managed keys
    (SSE-S3) or Amazon Web Services KMS customer master keys (SSE-KMS). If you specify default encryption using SSE-
    KMS, you can also configure Amazon S3 Bucket Key. For information about default encryption, see Amazon S3
    default bucket encryption in the Amazon S3 User Guide. For more information about S3 Bucket Keys, see Amazon S3
    Bucket Keys in the Amazon S3 User Guide.  This action requires Amazon Web Services Signature Version 4. For more
    information, see  Authenticating Requests (Amazon Web Services Signature Version 4).   To use this operation,
    you must have permissions to perform the s3:PutEncryptionConfiguration action. The bucket owner has this
    permission by default. The bucket owner can grant this permission to others. For more information about
    permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your
    Amazon S3 Resources in the Amazon S3 User Guide.   Related Resources     GetBucketEncryption
    DeleteBucketEncryption

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        bucket(Text): Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed
            keys (SSE-S3) or customer master keys stored in Amazon Web Services KMS (SSE-KMS). For
            information about the Amazon S3 default encryption feature, see Amazon S3 Default Bucket
            Encryption in the Amazon S3 User Guide.
        content_md5(Text, optional): The base64-encoded 128-bit MD5 digest of the server-side encryption configuration. For requests
            made using the Amazon Web Services Command Line Interface (CLI) or Amazon Web Services SDKs,
            this field is calculated automatically. Defaults to None.
        server_side_encryption_configuration(Dict): Specifies the default server-side-encryption configuration.
        expected_bucket_owner(Text, optional): The account ID of the expected bucket owner. If the bucket is owned by a different account, the
            request will fail with an HTTP 403 (Access Denied) error. Defaults to None.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_present:
              aws_auto.s3.bucket_encryption.present:
                - name: value
                - bucket: value
                - server_side_encryption_configuration: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.s3.bucket_encryption.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    
    before = await hub.exec.boto3.client.s3.get_bucket_encryption(name)

    if before:
        result["comment"] = f"'{name}' already exists"
    else:
        try:
            ret = await hub.exec.boto3.client.s3.put_bucket_encryption(
                ctx,
                
                
                **{"Bucket": bucket, "ContentMD5": content_md5, "ServerSideEncryptionConfiguration": server_side_encryption_configuration, "ExpectedBucketOwner": expected_bucket_owner}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            ret["comment"] = f"Created '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    
    # TODO perform other modifications as needed here
    ...

    after = await hub.exec.boto3.client.s3.get_bucket_encryption(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

async def absent(hub, ctx, name: Text, bucket: Text, expected_bucket_owner: Text = None)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    This implementation of the DELETE action removes default encryption from the bucket. For information about the
    Amazon S3 default encryption feature, see Amazon S3 Default Bucket Encryption in the Amazon S3 User Guide. To
    use this operation, you must have permissions to perform the s3:PutEncryptionConfiguration action. The bucket
    owner has this permission by default. The bucket owner can grant this permission to others. For more information
    about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to
    your Amazon S3 Resources in the Amazon S3 User Guide.  Related Resources     PutBucketEncryption
    GetBucketEncryption

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        bucket(Text): The name of the bucket containing the server-side encryption configuration to delete.
        expected_bucket_owner(Text, optional): The account ID of the expected bucket owner. If the bucket is owned by a different account, the
            request will fail with an HTTP 403 (Access Denied) error. Defaults to None.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_absent:
              aws_auto.s3.bucket_encryption.absent:
                - name: value
                - bucket: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.s3.bucket_encryption.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    

    before = await hub.exec.boto3.client.s3.get_bucket_encryption(name)

    if not before:
        result["comment"] = f"'{name}' already absent"
    else:
        try:
            ret = await hub.exec.boto3.client.s3.delete_bucket_encryption(
                ctx,
                
                
                **{"Bucket": bucket, "ExpectedBucketOwner": expected_bucket_owner}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            result["comment"] = f"Deleted '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    

    after = await hub.exec.boto3.client.s3.get_bucket_encryption(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

