"""
Autogenerated state module using `pop-create-idem <https://gitlab.com/saltstack/pop/pop-create-idem>`__

hub.exec.boto3.client.acm_pca.create_certificate_authority
hub.exec.boto3.client.acm_pca.delete_certificate_authority
hub.exec.boto3.client.acm_pca.describe_certificate_authority
hub.exec.boto3.client.acm_pca.list_certificate_authorities
hub.exec.boto3.client.acm_pca.restore_certificate_authority
hub.exec.boto3.client.acm_pca.tag_certificate_authority
hub.exec.boto3.client.acm_pca.untag_certificate_authority
hub.exec.boto3.client.acm_pca.update_certificate_authority
"""



from typing import *
import dict_tools.differ as differ
async def present(hub, ctx, name: Text, certificate_authority_configuration: Dict, certificate_authority_type: Text, revocation_configuration: Dict = None, idempotency_token: Text = None, key_storage_security_standard: Text = None, tags: List = None)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Creates a root or subordinate private certificate authority (CA). You must specify the CA configuration, the
    certificate revocation list (CRL) configuration, the CA type, and an optional idempotency token to avoid
    accidental creation of multiple CAs. The CA configuration specifies the name of the algorithm and key size to be
    used to create the CA private key, the type of signing algorithm that the CA uses, and X.500 subject
    information. The CRL configuration specifies the CRL expiration period in days (the validity period of the CRL),
    the Amazon S3 bucket that will contain the CRL, and a CNAME alias for the S3 bucket that is included in
    certificates issued by the CA. If successful, this action returns the Amazon Resource Name (ARN) of the CA. ACM
    Private CA assets that are stored in Amazon S3 can be protected with encryption. For more information, see
    Encrypting Your CRLs.  Both PCA and the IAM principal must have permission to write to the S3 bucket that you
    specify. If the IAM principal making the call does not have permission to write to the bucket, then an exception
    is thrown. For more information, see Configure Access to ACM Private CA.

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        certificate_authority_configuration(Dict): Name and bit size of the private key algorithm, the name of the signing algorithm, and X.500
            certificate subject information.
        revocation_configuration(Dict, optional): Contains a Boolean value that you can use to enable a certification revocation list (CRL) for
            the CA, the name of the S3 bucket to which ACM Private CA will write the CRL, and an optional
            CNAME alias that you can use to hide the name of your bucket in the CRL Distribution Points
            extension of your CA certificate. For more information, see the CrlConfiguration structure. Defaults to None.
        certificate_authority_type(Text): The type of the certificate authority.
        idempotency_token(Text, optional): Custom string that can be used to distinguish between calls to the CreateCertificateAuthority
            action. Idempotency tokens for CreateCertificateAuthority time out after five minutes.
            Therefore, if you call CreateCertificateAuthority multiple times with the same idempotency token
            within five minutes, ACM Private CA recognizes that you are requesting only certificate
            authority and will issue only one. If you change the idempotency token for each call, PCA
            recognizes that you are requesting multiple certificate authorities. Defaults to None.
        key_storage_security_standard(Text, optional): Specifies a cryptographic key management compliance standard used for handling CA keys. Default:
            FIPS_140_2_LEVEL_3_OR_HIGHER Note: FIPS_140_2_LEVEL_3_OR_HIGHER is not supported in Region ap-
            northeast-3. When creating a CA in the ap-northeast-3, you must provide
            FIPS_140_2_LEVEL_2_OR_HIGHER as the argument for KeyStorageSecurityStandard. Failure to do this
            results in an InvalidArgsException with the message, "A certificate authority cannot be created
            in this region with the specified security standard.". Defaults to None.
        tags(List, optional): Key-value pairs that will be attached to the new private CA. You can associate up to 50 tags
            with a private CA. For information using tags with IAM to manage permissions, see Controlling
            Access Using IAM Tags. Defaults to None.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_present:
              aws_auto.acm_pca.certificate_authority.present:
                - name: value
                - certificate_authority_configuration: value
                - certificate_authority_type: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.acm_pca.certificate_authority.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    
    before = await hub.exec.boto3.client.acm_pca.describe_certificate_authority(name)

    if before:
        result["comment"] = f"'{name}' already exists"
    else:
        try:
            ret = await hub.exec.boto3.client.acm_pca.create_certificate_authority(
                ctx,
                
                
                **{"CertificateAuthorityConfiguration": certificate_authority_configuration, "RevocationConfiguration": revocation_configuration, "CertificateAuthorityType": certificate_authority_type, "IdempotencyToken": idempotency_token, "KeyStorageSecurityStandard": key_storage_security_standard, "Tags": tags}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            ret["comment"] = f"Created '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    
    # TODO perform other modifications as needed here
    ...

    after = await hub.exec.boto3.client.acm_pca.describe_certificate_authority(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

async def absent(hub, ctx, name: Text, certificate_authority_arn: Text, permanent_deletion_time_in_days: int = None)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Deletes a private certificate authority (CA). You must provide the Amazon Resource Name (ARN) of the private CA
    that you want to delete. You can find the ARN by calling the ListCertificateAuthorities action.   Deleting a CA
    will invalidate other CAs and certificates below it in your CA hierarchy.  Before you can delete a CA that you
    have created and activated, you must disable it. To do this, call the UpdateCertificateAuthority action and set
    the CertificateAuthorityStatus parameter to DISABLED.  Additionally, you can delete a CA if you are waiting for
    it to be created (that is, the status of the CA is CREATING). You can also delete it if the CA has been created
    but you haven't yet imported the signed certificate into ACM Private CA (that is, the status of the CA is
    PENDING_CERTIFICATE).  When you successfully call DeleteCertificateAuthority, the CA's status changes to
    DELETED. However, the CA won't be permanently deleted until the restoration period has passed. By default, if
    you do not set the PermanentDeletionTimeInDays parameter, the CA remains restorable for 30 days. You can set the
    parameter from 7 to 30 days. The DescribeCertificateAuthority action returns the time remaining in the
    restoration window of a private CA in the DELETED state. To restore an eligible CA, call the
    RestoreCertificateAuthority action.

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        certificate_authority_arn(Text): The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority.
            This must have the following form:   arn:aws:acm-pca:region:account:certificate-
            authority/12345678-1234-1234-1234-123456789012 .
        permanent_deletion_time_in_days(int, optional): The number of days to make a CA restorable after it has been deleted. This can be anywhere from
            7 to 30 days, with 30 being the default. Defaults to None.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_absent:
              aws_auto.acm_pca.certificate_authority.absent:
                - name: value
                - certificate_authority_arn: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.acm_pca.certificate_authority.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    

    before = await hub.exec.boto3.client.acm_pca.describe_certificate_authority(name)

    if not before:
        result["comment"] = f"'{name}' already absent"
    else:
        try:
            ret = await hub.exec.boto3.client.acm_pca.delete_certificate_authority(
                ctx,
                
                
                **{"CertificateAuthorityArn": certificate_authority_arn, "PermanentDeletionTimeInDays": permanent_deletion_time_in_days}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            result["comment"] = f"Deleted '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    

    after = await hub.exec.boto3.client.acm_pca.describe_certificate_authority(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

