/**
 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0.
 */

#pragma once
#include <aws/core/utils/DateTime.h>
#include <aws/core/utils/memory/stl/AWSString.h>
#include <aws/kms/KMS_EXPORTS.h>
#include <aws/kms/model/ConnectionErrorCodeType.h>
#include <aws/kms/model/ConnectionStateType.h>
#include <aws/kms/model/CustomKeyStoreType.h>
#include <aws/kms/model/XksProxyConfigurationType.h>

#include <utility>

namespace Aws {
namespace Utils {
namespace Json {
class JsonValue;
class JsonView;
}  // namespace Json
}  // namespace Utils
namespace KMS {
namespace Model {

/**
 * <p>Contains information about each custom key store in the custom key store
 * list.</p><p><h3>See Also:</h3>   <a
 * href="http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CustomKeyStoresListEntry">AWS
 * API Reference</a></p>
 */
class CustomKeyStoresListEntry {
 public:
  AWS_KMS_API CustomKeyStoresListEntry() = default;
  AWS_KMS_API CustomKeyStoresListEntry(Aws::Utils::Json::JsonView jsonValue);
  AWS_KMS_API CustomKeyStoresListEntry& operator=(Aws::Utils::Json::JsonView jsonValue);
  AWS_KMS_API Aws::Utils::Json::JsonValue Jsonize() const;

  ///@{
  /**
   * <p>A unique identifier for the custom key store.</p>
   */
  inline const Aws::String& GetCustomKeyStoreId() const { return m_customKeyStoreId; }
  inline bool CustomKeyStoreIdHasBeenSet() const { return m_customKeyStoreIdHasBeenSet; }
  template <typename CustomKeyStoreIdT = Aws::String>
  void SetCustomKeyStoreId(CustomKeyStoreIdT&& value) {
    m_customKeyStoreIdHasBeenSet = true;
    m_customKeyStoreId = std::forward<CustomKeyStoreIdT>(value);
  }
  template <typename CustomKeyStoreIdT = Aws::String>
  CustomKeyStoresListEntry& WithCustomKeyStoreId(CustomKeyStoreIdT&& value) {
    SetCustomKeyStoreId(std::forward<CustomKeyStoreIdT>(value));
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>The user-specified friendly name for the custom key store.</p>
   */
  inline const Aws::String& GetCustomKeyStoreName() const { return m_customKeyStoreName; }
  inline bool CustomKeyStoreNameHasBeenSet() const { return m_customKeyStoreNameHasBeenSet; }
  template <typename CustomKeyStoreNameT = Aws::String>
  void SetCustomKeyStoreName(CustomKeyStoreNameT&& value) {
    m_customKeyStoreNameHasBeenSet = true;
    m_customKeyStoreName = std::forward<CustomKeyStoreNameT>(value);
  }
  template <typename CustomKeyStoreNameT = Aws::String>
  CustomKeyStoresListEntry& WithCustomKeyStoreName(CustomKeyStoreNameT&& value) {
    SetCustomKeyStoreName(std::forward<CustomKeyStoreNameT>(value));
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>A unique identifier for the CloudHSM cluster that is associated with an
   * CloudHSM key store. This field appears only when the
   * <code>CustomKeyStoreType</code> is <code>AWS_CLOUDHSM</code>.</p>
   */
  inline const Aws::String& GetCloudHsmClusterId() const { return m_cloudHsmClusterId; }
  inline bool CloudHsmClusterIdHasBeenSet() const { return m_cloudHsmClusterIdHasBeenSet; }
  template <typename CloudHsmClusterIdT = Aws::String>
  void SetCloudHsmClusterId(CloudHsmClusterIdT&& value) {
    m_cloudHsmClusterIdHasBeenSet = true;
    m_cloudHsmClusterId = std::forward<CloudHsmClusterIdT>(value);
  }
  template <typename CloudHsmClusterIdT = Aws::String>
  CustomKeyStoresListEntry& WithCloudHsmClusterId(CloudHsmClusterIdT&& value) {
    SetCloudHsmClusterId(std::forward<CloudHsmClusterIdT>(value));
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>The trust anchor certificate of the CloudHSM cluster associated with an
   * CloudHSM key store. When you <a
   * href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr">initialize
   * the cluster</a>, you create this certificate and save it in the
   * <code>customerCA.crt</code> file.</p> <p>This field appears only when the
   * <code>CustomKeyStoreType</code> is <code>AWS_CLOUDHSM</code>.</p>
   */
  inline const Aws::String& GetTrustAnchorCertificate() const { return m_trustAnchorCertificate; }
  inline bool TrustAnchorCertificateHasBeenSet() const { return m_trustAnchorCertificateHasBeenSet; }
  template <typename TrustAnchorCertificateT = Aws::String>
  void SetTrustAnchorCertificate(TrustAnchorCertificateT&& value) {
    m_trustAnchorCertificateHasBeenSet = true;
    m_trustAnchorCertificate = std::forward<TrustAnchorCertificateT>(value);
  }
  template <typename TrustAnchorCertificateT = Aws::String>
  CustomKeyStoresListEntry& WithTrustAnchorCertificate(TrustAnchorCertificateT&& value) {
    SetTrustAnchorCertificate(std::forward<TrustAnchorCertificateT>(value));
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>Indicates whether the custom key store is connected to its backing key store.
   * For an CloudHSM key store, the <code>ConnectionState</code> indicates whether it
   * is connected to its CloudHSM cluster. For an external key store, the
   * <code>ConnectionState</code> indicates whether it is connected to the external
   * key store proxy that communicates with your external key manager.</p> <p>You can
   * create and use KMS keys in your custom key stores only when its
   * <code>ConnectionState</code> is <code>CONNECTED</code>.</p> <p>The
   * <code>ConnectionState</code> value is <code>DISCONNECTED</code> only if the key
   * store has never been connected or you use the <a>DisconnectCustomKeyStore</a>
   * operation to disconnect it. If the value is <code>CONNECTED</code> but you are
   * having trouble using the custom key store, make sure that the backing key store
   * is reachable and active. For an CloudHSM key store, verify that its associated
   * CloudHSM cluster is active and contains at least one active HSM. For an external
   * key store, verify that the external key store proxy and external key manager are
   * connected and enabled.</p> <p>A value of <code>FAILED</code> indicates that an
   * attempt to connect was unsuccessful. The <code>ConnectionErrorCode</code> field
   * in the response indicates the cause of the failure. For help resolving a
   * connection failure, see <a
   * href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html">Troubleshooting
   * a custom key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
   */
  inline ConnectionStateType GetConnectionState() const { return m_connectionState; }
  inline bool ConnectionStateHasBeenSet() const { return m_connectionStateHasBeenSet; }
  inline void SetConnectionState(ConnectionStateType value) {
    m_connectionStateHasBeenSet = true;
    m_connectionState = value;
  }
  inline CustomKeyStoresListEntry& WithConnectionState(ConnectionStateType value) {
    SetConnectionState(value);
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>Describes the connection error. This field appears in the response only when
   * the <code>ConnectionState</code> is <code>FAILED</code>.</p> <p>Many failures
   * can be resolved by updating the properties of the custom key store. To update a
   * custom key store, disconnect it (<a>DisconnectCustomKeyStore</a>), correct the
   * errors (<a>UpdateCustomKeyStore</a>), and try to connect again
   * (<a>ConnectCustomKeyStore</a>). For additional help resolving these errors, see
   * <a
   * href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed">How
   * to Fix a Connection Failure</a> in <i>Key Management Service Developer
   * Guide</i>.</p> <p> <b>All custom key stores:</b> </p> <ul> <li> <p>
   * <code>INTERNAL_ERROR</code> — KMS could not complete the request due to an
   * internal error. Retry the request. For <code>ConnectCustomKeyStore</code>
   * requests, disconnect the custom key store before trying to connect again.</p>
   * </li> <li> <p> <code>NETWORK_ERRORS</code> — Network errors are preventing KMS
   * from connecting the custom key store to its backing key store.</p> </li> </ul>
   * <p> <b>CloudHSM key stores:</b> </p> <ul> <li> <p>
   * <code>CLUSTER_NOT_FOUND</code> — KMS cannot find the CloudHSM cluster with the
   * specified cluster ID.</p> </li> <li> <p> <code>INSUFFICIENT_CLOUDHSM_HSMS</code>
   * — The associated CloudHSM cluster does not contain any active HSMs. To connect a
   * custom key store to its CloudHSM cluster, the cluster must contain at least one
   * active HSM.</p> </li> <li> <p>
   * <code>INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET</code> — At least one private subnet
   * associated with the CloudHSM cluster doesn't have any available IP addresses. A
   * CloudHSM key store connection requires one free IP address in each of the
   * associated private subnets, although two are preferable. For details, see <a
   * href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed">How
   * to Fix a Connection Failure</a> in the <i>Key Management Service Developer
   * Guide</i>.</p> </li> <li> <p> <code>INVALID_CREDENTIALS</code> — The
   * <code>KeyStorePassword</code> for the custom key store doesn't match the current
   * password of the <code>kmsuser</code> crypto user in the CloudHSM cluster. Before
   * you can connect your custom key store to its CloudHSM cluster, you must change
   * the <code>kmsuser</code> account password and update the
   * <code>KeyStorePassword</code> value for the custom key store.</p> </li> <li> <p>
   * <code>SUBNET_NOT_FOUND</code> — A subnet in the CloudHSM cluster configuration
   * was deleted. If KMS cannot find all of the subnets in the cluster configuration,
   * attempts to connect the custom key store to the CloudHSM cluster fail. To fix
   * this error, create a cluster from a recent backup and associate it with your
   * custom key store. (This process creates a new cluster configuration with a VPC
   * and private subnets.) For details, see <a
   * href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed">How
   * to Fix a Connection Failure</a> in the <i>Key Management Service Developer
   * Guide</i>.</p> </li> <li> <p> <code>USER_LOCKED_OUT</code> — The
   * <code>kmsuser</code> CU account is locked out of the associated CloudHSM cluster
   * due to too many failed password attempts. Before you can connect your custom key
   * store to its CloudHSM cluster, you must change the <code>kmsuser</code> account
   * password and update the key store password value for the custom key store.</p>
   * </li> <li> <p> <code>USER_LOGGED_IN</code> — The <code>kmsuser</code> CU account
   * is logged into the associated CloudHSM cluster. This prevents KMS from rotating
   * the <code>kmsuser</code> account password and logging into the cluster. Before
   * you can connect your custom key store to its CloudHSM cluster, you must log the
   * <code>kmsuser</code> CU out of the cluster. If you changed the
   * <code>kmsuser</code> password to log into the cluster, you must also and update
   * the key store password value for the custom key store. For help, see <a
   * href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#login-kmsuser-2">How
   * to Log Out and Reconnect</a> in the <i>Key Management Service Developer
   * Guide</i>.</p> </li> <li> <p> <code>USER_NOT_FOUND</code> — KMS cannot find a
   * <code>kmsuser</code> CU account in the associated CloudHSM cluster. Before you
   * can connect your custom key store to its CloudHSM cluster, you must create a
   * <code>kmsuser</code> CU account in the cluster, and then update the key store
   * password value for the custom key store.</p> </li> </ul> <p> <b>External key
   * stores:</b> </p> <ul> <li> <p> <code>INVALID_CREDENTIALS</code> — One or both of
   * the <code>XksProxyAuthenticationCredential</code> values is not valid on the
   * specified external key store proxy.</p> </li> <li> <p>
   * <code>XKS_PROXY_ACCESS_DENIED</code> — KMS requests are denied access to the
   * external key store proxy. If the external key store proxy has authorization
   * rules, verify that they permit KMS to communicate with the proxy on your
   * behalf.</p> </li> <li> <p> <code>XKS_PROXY_INVALID_CONFIGURATION</code> — A
   * configuration error is preventing the external key store from connecting to its
   * proxy. Verify the value of the <code>XksProxyUriPath</code>.</p> </li> <li> <p>
   * <code>XKS_PROXY_INVALID_RESPONSE</code> — KMS cannot interpret the response from
   * the external key store proxy. If you see this connection error code repeatedly,
   * notify your external key store proxy vendor.</p> </li> <li> <p>
   * <code>XKS_PROXY_INVALID_TLS_CONFIGURATION</code> — KMS cannot connect to the
   * external key store proxy because the TLS configuration is invalid. Verify that
   * the XKS proxy supports TLS 1.2 or 1.3. Also, verify that the TLS certificate is
   * not expired, and that it matches the hostname in the
   * <code>XksProxyUriEndpoint</code> value, and that it is signed by a certificate
   * authority included in the <a
   * href="https://github.com/aws/aws-kms-xksproxy-api-spec/blob/main/TrustedCertificateAuthorities">Trusted
   * Certificate Authorities</a> list.</p> </li> <li> <p>
   * <code>XKS_PROXY_NOT_REACHABLE</code> — KMS can't communicate with your external
   * key store proxy. Verify that the <code>XksProxyUriEndpoint</code> and
   * <code>XksProxyUriPath</code> are correct. Use the tools for your external key
   * store proxy to verify that the proxy is active and available on its network.
   * Also, verify that your external key manager instances are operating properly.
   * Connection attempts fail with this connection error code if the proxy reports
   * that all external key manager instances are unavailable.</p> </li> <li> <p>
   * <code>XKS_PROXY_TIMED_OUT</code> — KMS can connect to the external key store
   * proxy, but the proxy does not respond to KMS in the time allotted. If you see
   * this connection error code repeatedly, notify your external key store proxy
   * vendor.</p> </li> <li> <p>
   * <code>XKS_VPC_ENDPOINT_SERVICE_INVALID_CONFIGURATION</code> — The Amazon VPC
   * endpoint service configuration doesn't conform to the requirements for an KMS
   * external key store.</p> <ul> <li> <p>The VPC endpoint service must be an
   * endpoint service for interface endpoints in the caller's Amazon Web Services
   * account.</p> </li> <li> <p>It must have a network load balancer (NLB) connected
   * to at least two subnets, each in a different Availability Zone.</p> </li> <li>
   * <p>The <code>Allow principals</code> list must include the KMS service principal
   * for the Region, <code>cks.kms.&lt;region&gt;.amazonaws.com</code>, such as
   * <code>cks.kms.us-east-1.amazonaws.com</code>.</p> </li> <li> <p>It must
   * <i>not</i> require <a
   * href="https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html">acceptance</a>
   * of connection requests.</p> </li> <li> <p>It must have a private DNS name. The
   * private DNS name for an external key store with
   * <code>VPC_ENDPOINT_SERVICE</code> connectivity must be unique in its Amazon Web
   * Services Region.</p> </li> <li> <p>The domain of the private DNS name must have
   * a <a
   * href="https://docs.aws.amazon.com/vpc/latest/privatelink/verify-domains.html">verification
   * status</a> of <code>verified</code>.</p> </li> <li> <p>The <a
   * href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html">TLS
   * certificate</a> specifies the private DNS hostname at which the endpoint is
   * reachable.</p> </li> </ul> </li> <li> <p>
   * <code>XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND</code> — KMS can't find the VPC
   * endpoint service that it uses to communicate with the external key store proxy.
   * Verify that the <code>XksProxyVpcEndpointServiceName</code> is correct and the
   * KMS service principal has service consumer permissions on the Amazon VPC
   * endpoint service.</p> </li> </ul>
   */
  inline ConnectionErrorCodeType GetConnectionErrorCode() const { return m_connectionErrorCode; }
  inline bool ConnectionErrorCodeHasBeenSet() const { return m_connectionErrorCodeHasBeenSet; }
  inline void SetConnectionErrorCode(ConnectionErrorCodeType value) {
    m_connectionErrorCodeHasBeenSet = true;
    m_connectionErrorCode = value;
  }
  inline CustomKeyStoresListEntry& WithConnectionErrorCode(ConnectionErrorCodeType value) {
    SetConnectionErrorCode(value);
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>The date and time when the custom key store was created.</p>
   */
  inline const Aws::Utils::DateTime& GetCreationDate() const { return m_creationDate; }
  inline bool CreationDateHasBeenSet() const { return m_creationDateHasBeenSet; }
  template <typename CreationDateT = Aws::Utils::DateTime>
  void SetCreationDate(CreationDateT&& value) {
    m_creationDateHasBeenSet = true;
    m_creationDate = std::forward<CreationDateT>(value);
  }
  template <typename CreationDateT = Aws::Utils::DateTime>
  CustomKeyStoresListEntry& WithCreationDate(CreationDateT&& value) {
    SetCreationDate(std::forward<CreationDateT>(value));
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>Indicates the type of the custom key store. <code>AWS_CLOUDHSM</code>
   * indicates a custom key store backed by an CloudHSM cluster.
   * <code>EXTERNAL_KEY_STORE</code> indicates a custom key store backed by an
   * external key store proxy and external key manager outside of Amazon Web
   * Services.</p>
   */
  inline CustomKeyStoreType GetCustomKeyStoreType() const { return m_customKeyStoreType; }
  inline bool CustomKeyStoreTypeHasBeenSet() const { return m_customKeyStoreTypeHasBeenSet; }
  inline void SetCustomKeyStoreType(CustomKeyStoreType value) {
    m_customKeyStoreTypeHasBeenSet = true;
    m_customKeyStoreType = value;
  }
  inline CustomKeyStoresListEntry& WithCustomKeyStoreType(CustomKeyStoreType value) {
    SetCustomKeyStoreType(value);
    return *this;
  }
  ///@}

  ///@{
  /**
   * <p>Configuration settings for the external key store proxy (XKS proxy). The
   * external key store proxy translates KMS requests into a format that your
   * external key manager can understand. The proxy configuration includes connection
   * information that KMS requires.</p> <p>This field appears only when the
   * <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code>.</p>
   */
  inline const XksProxyConfigurationType& GetXksProxyConfiguration() const { return m_xksProxyConfiguration; }
  inline bool XksProxyConfigurationHasBeenSet() const { return m_xksProxyConfigurationHasBeenSet; }
  template <typename XksProxyConfigurationT = XksProxyConfigurationType>
  void SetXksProxyConfiguration(XksProxyConfigurationT&& value) {
    m_xksProxyConfigurationHasBeenSet = true;
    m_xksProxyConfiguration = std::forward<XksProxyConfigurationT>(value);
  }
  template <typename XksProxyConfigurationT = XksProxyConfigurationType>
  CustomKeyStoresListEntry& WithXksProxyConfiguration(XksProxyConfigurationT&& value) {
    SetXksProxyConfiguration(std::forward<XksProxyConfigurationT>(value));
    return *this;
  }
  ///@}
 private:
  Aws::String m_customKeyStoreId;

  Aws::String m_customKeyStoreName;

  Aws::String m_cloudHsmClusterId;

  Aws::String m_trustAnchorCertificate;

  ConnectionStateType m_connectionState{ConnectionStateType::NOT_SET};

  ConnectionErrorCodeType m_connectionErrorCode{ConnectionErrorCodeType::NOT_SET};

  Aws::Utils::DateTime m_creationDate{};

  CustomKeyStoreType m_customKeyStoreType{CustomKeyStoreType::NOT_SET};

  XksProxyConfigurationType m_xksProxyConfiguration;
  bool m_customKeyStoreIdHasBeenSet = false;
  bool m_customKeyStoreNameHasBeenSet = false;
  bool m_cloudHsmClusterIdHasBeenSet = false;
  bool m_trustAnchorCertificateHasBeenSet = false;
  bool m_connectionStateHasBeenSet = false;
  bool m_connectionErrorCodeHasBeenSet = false;
  bool m_creationDateHasBeenSet = false;
  bool m_customKeyStoreTypeHasBeenSet = false;
  bool m_xksProxyConfigurationHasBeenSet = false;
};

}  // namespace Model
}  // namespace KMS
}  // namespace Aws
