"""
Autogenerated state module using `pop-create-idem <https://gitlab.com/saltstack/pop/pop-create-idem>`__

hub.exec.boto3.client.secretsmanager.delete_resource_policy
hub.exec.boto3.client.secretsmanager.get_resource_policy
hub.exec.boto3.client.secretsmanager.put_resource_policy
hub.exec.boto3.client.secretsmanager.validate_resource_policy
"""



from typing import *
import dict_tools.differ as differ
async def present(hub, ctx, name: Text, secret_id: Text, resource_policy: Text, block_public_policy: bool = None)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Attaches the contents of the specified resource-based permission policy to a secret. A resource-based policy is
    optional. Alternatively, you can use IAM identity-based policies that specify the secret's Amazon Resource Name
    (ARN) in the policy statement's Resources element. You can also use a combination of both identity-based and
    resource-based policies. The affected users and roles receive the permissions that are permitted by all of the
    relevant policies. For more information, see Using Resource-Based Policies for Amazon Web Services Secrets
    Manager. For the complete description of the Amazon Web Services policy syntax and grammar, see IAM JSON Policy
    Reference in the IAM User Guide.  Minimum permissions  To run this command, you must have the following
    permissions:   secretsmanager:PutResourcePolicy    Related operations    To retrieve the resource policy
    attached to a secret, use GetResourcePolicy.   To delete the resource-based policy attached to a secret, use
    DeleteResourcePolicy.   To list all of the currently available secrets, use ListSecrets.

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        secret_id(Text): Specifies the secret that you want to attach the resource-based policy. You can specify either
            the ARN or the friendly name of the secret.  If you specify an ARN, we generally recommend that
            you specify a complete ARN. You can specify a partial ARN too—for example, if you don’t include
            the final hyphen and six random characters that Secrets Manager adds at the end of the ARN when
            you created the secret. A partial ARN match can work as long as it uniquely matches only one
            secret. However, if your secret has a name that ends in a hyphen followed by six characters
            (before Secrets Manager adds the hyphen and six characters to the ARN) and you try to use that
            as a partial ARN, then those characters cause Secrets Manager to assume that you’re specifying a
            complete ARN. This confusion can cause unexpected results. To avoid this situation, we recommend
            that you don’t create secret names ending with a hyphen followed by six characters. If you
            specify an incomplete ARN without the random suffix, and instead provide the 'friendly name',
            you must not include the random suffix. If you do include the random suffix added by Secrets
            Manager, you receive either a ResourceNotFoundException or an AccessDeniedException error,
            depending on your permissions.
        resource_policy(Text): A JSON-formatted string constructed according to the grammar and syntax for an Amazon Web
            Services resource-based policy. The policy in the string identifies who can access or manage
            this secret and its versions. For information on how to format a JSON parameter for the various
            command line tool environments, see Using JSON for Parameters in the CLI User Guide.
        block_public_policy(bool, optional): (Optional) If you set the parameter, BlockPublicPolicy to true, then you block resource-based
            policies that allow broad access to the secret. Defaults to None.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_present:
              aws_auto.secretsmanager.resource_policy.present:
                - name: value
                - secret_id: value
                - resource_policy: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.secretsmanager.resource_policy.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    
    before = await hub.exec.boto3.client.secretsmanager.get_resource_policy(name)

    if before:
        result["comment"] = f"'{name}' already exists"
    else:
        try:
            ret = await hub.exec.boto3.client.secretsmanager.put_resource_policy(
                ctx,
                
                
                **{"SecretId": secret_id, "ResourcePolicy": resource_policy, "BlockPublicPolicy": block_public_policy}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            ret["comment"] = f"Created '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    
    # TODO perform other modifications as needed here
    ...

    after = await hub.exec.boto3.client.secretsmanager.get_resource_policy(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

async def absent(hub, ctx, name: Text, secret_id: Text)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Deletes the resource-based permission policy attached to the secret.  Minimum permissions  To run this command,
    you must have the following permissions:   secretsmanager:DeleteResourcePolicy    Related operations    To
    attach a resource policy to a secret, use PutResourcePolicy.   To retrieve the current resource-based policy
    attached to a secret, use GetResourcePolicy.   To list all of the currently available secrets, use ListSecrets.

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        secret_id(Text): Specifies the secret that you want to delete the attached resource-based policy for. You can
            specify either the Amazon Resource Name (ARN) or the friendly name of the secret.  If you
            specify an ARN, we generally recommend that you specify a complete ARN. You can specify a
            partial ARN too—for example, if you don’t include the final hyphen and six random characters
            that Secrets Manager adds at the end of the ARN when you created the secret. A partial ARN match
            can work as long as it uniquely matches only one secret. However, if your secret has a name that
            ends in a hyphen followed by six characters (before Secrets Manager adds the hyphen and six
            characters to the ARN) and you try to use that as a partial ARN, then those characters cause
            Secrets Manager to assume that you’re specifying a complete ARN. This confusion can cause
            unexpected results. To avoid this situation, we recommend that you don’t create secret names
            ending with a hyphen followed by six characters. If you specify an incomplete ARN without the
            random suffix, and instead provide the 'friendly name', you must not include the random suffix.
            If you do include the random suffix added by Secrets Manager, you receive either a
            ResourceNotFoundException or an AccessDeniedException error, depending on your permissions.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_absent:
              aws_auto.secretsmanager.resource_policy.absent:
                - name: value
                - secret_id: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.secretsmanager.resource_policy.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    

    before = await hub.exec.boto3.client.secretsmanager.get_resource_policy(name)

    if not before:
        result["comment"] = f"'{name}' already absent"
    else:
        try:
            ret = await hub.exec.boto3.client.secretsmanager.delete_resource_policy(
                ctx,
                
                
                **{"SecretId": secret_id}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            result["comment"] = f"Deleted '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    

    after = await hub.exec.boto3.client.secretsmanager.get_resource_policy(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

