puls-dev 0.2.0 → 0.2.1

package/README.md

@@ -1,4 +1,4 @@
-# Puls-dev
+# Pulsdev.io
 
 **Intent-driven infrastructure-as-code. Describe what you want - Puls figures out create, update, or skip.**
 

package/dist/providers/aws/api.d.ts

@@ -12,6 +12,8 @@ import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
 import { RDSClient } from "@aws-sdk/client-rds";
 import { SQSClient } from "@aws-sdk/client-sqs";
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
+import { SNSClient } from "@aws-sdk/client-sns";
 export declare const getS3Client: (region?: string) => S3Client;
 export declare const getCFClient: () => CloudFrontClient;
 export declare const getR53Client: () => Route53Client;
@@ -26,3 +28,5 @@ export declare const getCWLogsClient: (region?: string) => CloudWatchLogsClient;
 export declare const getRDSClient: (region?: string) => RDSClient;
 export declare const getSQSClient: (region?: string) => SQSClient;
 export declare const getSecretsClient: (region?: string) => SecretsManagerClient;
+export declare const getCWClient: (region?: string) => CloudWatchClient;
+export declare const getSNSClient: (region?: string) => SNSClient;

package/dist/providers/aws/api.js

@@ -12,6 +12,8 @@ import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
 import { RDSClient } from "@aws-sdk/client-rds";
 import { SQSClient } from "@aws-sdk/client-sqs";
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
+import { SNSClient } from "@aws-sdk/client-sns";
 import { Config } from "../../core/config.js";
 function getRegion() {
     const region = Config.get().providers.aws?.region;
@@ -34,3 +36,5 @@ export const getCWLogsClient = (region) => new CloudWatchLogsClient({ region: re
 export const getRDSClient = (region) => new RDSClient({ region: region ?? getRegion() });
 export const getSQSClient = (region) => new SQSClient({ region: region ?? getRegion() });
 export const getSecretsClient = (region) => new SecretsManagerClient({ region: region ?? getRegion() });
+export const getCWClient = (region) => new CloudWatchClient({ region: region ?? getRegion() });
+export const getSNSClient = (region) => new SNSClient({ region: region ?? getRegion() });

package/dist/providers/aws/cloudwatch.d.ts

@@ -0,0 +1,44 @@
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import { FargateBuilder } from "./fargate.js";
+import { RDSBuilder } from "./rds.js";
+import { SNSTopicBuilder } from "./sns.js";
+type ComparisonOperator = "GreaterThanOrEqualToThreshold" | "GreaterThanThreshold" | "LessThanThreshold" | "LessThanOrEqualToThreshold";
+type Statistic = "Average" | "Sum" | "SampleCount" | "Maximum" | "Minimum";
+export declare class CloudWatchAlarmBuilder extends BaseBuilder {
+    readonly out: {
+        name: Output<string>;
+        arn: Output<string>;
+    };
+    private _namespace?;
+    private _metricName?;
+    private _dimensions?;
+    private _comparison?;
+    private _threshold?;
+    private _period?;
+    private _evaluationPeriods?;
+    private _statistic?;
+    private _actions;
+    resolvedArn: string | null;
+    constructor(name: string);
+    metric(namespace: string, name: string, dimensions?: Record<string, string>): this;
+    comparison(op: ComparisonOperator): this;
+    threshold(value: number): this;
+    period(seconds: number): this;
+    evaluationPeriods(periods: number): this;
+    statistic(stat: Statistic): this;
+    actions(sns: string | SNSTopicBuilder): this;
+    fargateCPU(fargate: FargateBuilder, thresholdPercent: number): this;
+    fargateMemory(fargate: FargateBuilder, thresholdPercent: number): this;
+    rdsCPU(rds: RDSBuilder, thresholdPercent: number): this;
+    rdsStorage(rds: RDSBuilder, thresholdBytes: number): this;
+    private discoverAlarm;
+    deploy(): Promise<{
+        name: string;
+        arn: string | null;
+    }>;
+    destroy(): Promise<{
+        destroyed: string;
+    }>;
+}
+export {};

package/dist/providers/aws/cloudwatch.js

@@ -0,0 +1,205 @@
+import { DescribeAlarmsCommand, PutMetricAlarmCommand, DeleteAlarmsCommand, } from "@aws-sdk/client-cloudwatch";
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import { getCWClient } from "./api.js";
+export class CloudWatchAlarmBuilder extends BaseBuilder {
+    out = {
+        name: new Output(),
+        arn: new Output(),
+    };
+    _namespace;
+    _metricName;
+    _dimensions;
+    _comparison;
+    _threshold;
+    _period;
+    _evaluationPeriods;
+    _statistic;
+    _actions = [];
+    resolvedArn = null;
+    constructor(name) {
+        super(name);
+        this.out.name.resolve(name);
+        this.discoveryPromise = this.discoverAlarm(name);
+    }
+    metric(namespace, name, dimensions) {
+        this._namespace = namespace;
+        this._metricName = name;
+        if (dimensions) {
+            this._dimensions = dimensions;
+        }
+        return this;
+    }
+    comparison(op) {
+        this._comparison = op;
+        return this;
+    }
+    threshold(value) {
+        this._threshold = value;
+        return this;
+    }
+    period(seconds) {
+        this._period = seconds;
+        return this;
+    }
+    evaluationPeriods(periods) {
+        this._evaluationPeriods = periods;
+        return this;
+    }
+    statistic(stat) {
+        this._statistic = stat;
+        return this;
+    }
+    actions(sns) {
+        this._actions.push(sns);
+        return this;
+    }
+    fargateCPU(fargate, thresholdPercent) {
+        this._namespace = "AWS/ECS";
+        this._metricName = "CPUUtilization";
+        this._dimensions = {
+            ClusterName: fargate.clusterName,
+            ServiceName: fargate.serviceName,
+        };
+        this._comparison = "GreaterThanOrEqualToThreshold";
+        this._threshold = thresholdPercent;
+        this._period = this._period ?? 300;
+        this._evaluationPeriods = this._evaluationPeriods ?? 1;
+        this._statistic = this._statistic ?? "Average";
+        return this;
+    }
+    fargateMemory(fargate, thresholdPercent) {
+        this._namespace = "AWS/ECS";
+        this._metricName = "MemoryUtilization";
+        this._dimensions = {
+            ClusterName: fargate.clusterName,
+            ServiceName: fargate.serviceName,
+        };
+        this._comparison = "GreaterThanOrEqualToThreshold";
+        this._threshold = thresholdPercent;
+        this._period = this._period ?? 300;
+        this._evaluationPeriods = this._evaluationPeriods ?? 1;
+        this._statistic = this._statistic ?? "Average";
+        return this;
+    }
+    rdsCPU(rds, thresholdPercent) {
+        this._namespace = "AWS/RDS";
+        this._metricName = "CPUUtilization";
+        this._dimensions = {
+            DBInstanceIdentifier: rds.dbInstanceIdentifier,
+        };
+        this._comparison = "GreaterThanOrEqualToThreshold";
+        this._threshold = thresholdPercent;
+        this._period = this._period ?? 300;
+        this._evaluationPeriods = this._evaluationPeriods ?? 1;
+        this._statistic = this._statistic ?? "Average";
+        return this;
+    }
+    rdsStorage(rds, thresholdBytes) {
+        this._namespace = "AWS/RDS";
+        this._metricName = "FreeStorageSpace";
+        this._dimensions = {
+            DBInstanceIdentifier: rds.dbInstanceIdentifier,
+        };
+        this._comparison = "LessThanThreshold";
+        this._threshold = thresholdBytes;
+        this._period = this._period ?? 300;
+        this._evaluationPeriods = this._evaluationPeriods ?? 1;
+        this._statistic = this._statistic ?? "Average";
+        return this;
+    }
+    async discoverAlarm(name) {
+        const cw = getCWClient();
+        try {
+            const result = await cw.send(new DescribeAlarmsCommand({ AlarmNames: [name] }));
+            const match = (result.MetricAlarms ?? []).find((a) => a.AlarmName === name);
+            if (match) {
+                this.resolvedArn = match.AlarmArn ?? null;
+                if (this.resolvedArn) {
+                    this.out.arn.resolve(this.resolvedArn);
+                }
+                return match;
+            }
+            return null;
+        }
+        catch (e) {
+            if (e.name === "CredentialsProviderError")
+                return null;
+            throw e;
+        }
+    }
+    async deploy() {
+        const dryRun = this.isDryRunActive();
+        const existing = await this.discoveryPromise;
+        const cw = getCWClient();
+        console.log(`\n⏰ Finalizing CloudWatch Alarm "${this.name}"...`);
+        if (!this._namespace || !this._metricName || !this._comparison || this._threshold === undefined) {
+            throw new Error(`[CloudWatchAlarm:${this.name}] Metric namespace, name, comparison operator, and threshold are required.`);
+        }
+        // Resolve SNS action ARNs
+        const alarmActions = [];
+        for (const action of this._actions) {
+            if (typeof action === "string") {
+                alarmActions.push(action);
+            }
+            else {
+                const arn = await action.out.arn.get();
+                alarmActions.push(arn);
+            }
+        }
+        const dimensionsArray = this._dimensions
+            ? Object.entries(this._dimensions).map(([Name, Value]) => ({ Name, Value }))
+            : undefined;
+        const alarmParams = {
+            AlarmName: this.name,
+            ComparisonOperator: this._comparison,
+            EvaluationPeriods: this._evaluationPeriods ?? 1,
+            MetricName: this._metricName,
+            Namespace: this._namespace,
+            Period: this._period ?? 300,
+            Threshold: this._threshold,
+            Statistic: this._statistic ?? "Average",
+            ActionsEnabled: alarmActions.length > 0,
+            AlarmActions: alarmActions.length > 0 ? alarmActions : undefined,
+            Dimensions: dimensionsArray,
+        };
+        if (dryRun) {
+            console.log(`   📝 [PLAN] ${existing ? "Update" : "Create"} CloudWatch alarm "${this.name}"`);
+            console.log(`      └─ Metric: ${this._namespace}/${this._metricName}`);
+            console.log(`      └─ Comparison: ${this._comparison} | Threshold: ${this._threshold}`);
+            if (this._dimensions) {
+                console.log(`      └─ Dimensions: ${JSON.stringify(this._dimensions)}`);
+            }
+            if (alarmActions.length > 0) {
+                console.log(`      └─ Actions: ${alarmActions.join(", ")}`);
+            }
+            this.resolvedArn = existing?.AlarmArn ?? `arn:aws:cloudwatch:us-east-1:000000000000:alarm:DRYRUN-${this.name}`;
+            this.out.arn.resolve(this.resolvedArn);
+            return { name: this.name, arn: this.resolvedArn };
+        }
+        await cw.send(new PutMetricAlarmCommand(alarmParams));
+        const describeResult = await cw.send(new DescribeAlarmsCommand({ AlarmNames: [this.name] }));
+        this.resolvedArn = describeResult.MetricAlarms?.[0]?.AlarmArn ?? `arn:aws:cloudwatch:us-east-1:000000000000:alarm:${this.name}`;
+        this.out.arn.resolve(this.resolvedArn);
+        console.log(`🚀 Created/Updated CloudWatch Alarm "${this.name}" (arn=${this.resolvedArn})`);
+        await this.deploySidecars();
+        return { name: this.name, arn: this.resolvedArn };
+    }
+    async destroy() {
+        const dryRun = this.isDryRunActive();
+        const existing = await this.discoveryPromise;
+        console.log(`\n🗑️  Destroying CloudWatch Alarm "${this.name}"...`);
+        if (!existing) {
+            console.log(`   ✅ Alarm "${this.name}" does not exist - nothing to do`);
+            return { destroyed: this.name };
+        }
+        if (dryRun) {
+            console.log(`   📝 [PLAN] Delete CloudWatch alarm "${this.name}"`);
+            return { destroyed: this.name };
+        }
+        const cw = getCWClient();
+        await cw.send(new DeleteAlarmsCommand({ AlarmNames: [this.name] }));
+        console.log(`   ✅ Deleted CloudWatch alarm "${this.name}"`);
+        return { destroyed: this.name };
+    }
+}

package/dist/providers/aws/cloudwatch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/providers/aws/cloudwatch.test.js

@@ -0,0 +1,224 @@
+import { test, describe, beforeEach, afterEach } from "node:test";
+import assert from "node:assert";
+import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
+import { SNSClient } from "@aws-sdk/client-sns";
+import { ECSClient } from "@aws-sdk/client-ecs";
+import { RDSClient } from "@aws-sdk/client-rds";
+import { CloudWatchAlarmBuilder } from "./cloudwatch.js";
+import { SNSTopicBuilder } from "./sns.js";
+import { FargateBuilder } from "./fargate.js";
+import { RDSBuilder } from "./rds.js";
+import { Config } from "../../core/config.js";
+describe("CloudWatchAlarmBuilder Unit Tests", () => {
+    let originalCwSend;
+    let originalSnsSend;
+    let originalEcsSend;
+    let originalRdsSend;
+    let cwCalls = [];
+    let mockCwResponses = {};
+    beforeEach(() => {
+        Config.set({
+            dryRun: false,
+            providers: {
+                aws: { region: "us-east-1" },
+            },
+        });
+        cwCalls = [];
+        mockCwResponses = {};
+        originalCwSend = CloudWatchClient.prototype.send;
+        originalSnsSend = SNSClient.prototype.send;
+        originalEcsSend = ECSClient.prototype.send;
+        originalRdsSend = RDSClient.prototype.send;
+        CloudWatchClient.prototype.send = async function (command) {
+            const commandName = command.constructor.name;
+            const input = command.input;
+            cwCalls.push({ commandName, input });
+            if (mockCwResponses[commandName]) {
+                const handler = mockCwResponses[commandName];
+                if (typeof handler === "function")
+                    return handler(input);
+                if (handler instanceof Error)
+                    throw handler;
+                return handler;
+            }
+            return {};
+        };
+        SNSClient.prototype.send = async function (command) {
+            return {};
+        };
+        ECSClient.prototype.send = async function (command) {
+            return {};
+        };
+        RDSClient.prototype.send = async function (command) {
+            return {};
+        };
+    });
+    afterEach(() => {
+        CloudWatchClient.prototype.send = originalCwSend;
+        SNSClient.prototype.send = originalSnsSend;
+        ECSClient.prototype.send = originalEcsSend;
+        RDSClient.prototype.send = originalRdsSend;
+    });
+    test("gracefully handles discovery when alarm does not exist", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = { MetricAlarms: [] };
+        const builder = new CloudWatchAlarmBuilder("my-alarm");
+        const discoveryResult = await builder.discoveryPromise;
+        assert.strictEqual(discoveryResult, null);
+        assert.ok(cwCalls.some((c) => c.commandName === "DescribeAlarmsCommand"));
+    });
+    test("discovers existing alarm successfully", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = {
+            MetricAlarms: [
+                {
+                    AlarmName: "my-alarm",
+                    AlarmArn: "arn:aws:cloudwatch:us-east-1:123456789012:alarm:my-alarm",
+                },
+            ],
+        };
+        const builder = new CloudWatchAlarmBuilder("my-alarm");
+        const discoveryResult = await builder.discoveryPromise;
+        assert.ok(discoveryResult);
+        assert.strictEqual(builder.resolvedArn, "arn:aws:cloudwatch:us-east-1:123456789012:alarm:my-alarm");
+        const resolvedArn = await builder.out.arn.get();
+        assert.strictEqual(resolvedArn, "arn:aws:cloudwatch:us-east-1:123456789012:alarm:my-alarm");
+    });
+    test("creates a custom metric alarm", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = { MetricAlarms: [] };
+        const builder = new CloudWatchAlarmBuilder("custom-alarm")
+            .metric("MyCustomNamespace", "Errors", { Service: "checkout" })
+            .comparison("GreaterThanThreshold")
+            .threshold(10)
+            .period(60)
+            .evaluationPeriods(2)
+            .statistic("Sum");
+        await builder.deploy();
+        const putCall = cwCalls.find((c) => c.commandName === "PutMetricAlarmCommand");
+        assert.ok(putCall);
+        assert.deepStrictEqual(putCall.input, {
+            AlarmName: "custom-alarm",
+            ComparisonOperator: "GreaterThanThreshold",
+            EvaluationPeriods: 2,
+            MetricName: "Errors",
+            Namespace: "MyCustomNamespace",
+            Period: 60,
+            Threshold: 10,
+            Statistic: "Sum",
+            ActionsEnabled: false,
+            AlarmActions: undefined,
+            Dimensions: [{ Name: "Service", Value: "checkout" }],
+        });
+    });
+    test("auto-wires specialized Fargate CPU and memory helper alarms", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = { MetricAlarms: [] };
+        const fargate = new FargateBuilder("my-api-service").cluster("my-prod-cluster");
+        const cpuAlarm = new CloudWatchAlarmBuilder("fargate-cpu")
+            .fargateCPU(fargate, 80)
+            .evaluationPeriods(3);
+        await cpuAlarm.deploy();
+        const cpuPutCall = cwCalls.find((c) => c.commandName === "PutMetricAlarmCommand" && c.input.AlarmName === "fargate-cpu");
+        assert.ok(cpuPutCall);
+        assert.deepStrictEqual(cpuPutCall.input, {
+            AlarmName: "fargate-cpu",
+            ComparisonOperator: "GreaterThanOrEqualToThreshold",
+            EvaluationPeriods: 3,
+            MetricName: "CPUUtilization",
+            Namespace: "AWS/ECS",
+            Period: 300,
+            Threshold: 80,
+            Statistic: "Average",
+            ActionsEnabled: false,
+            AlarmActions: undefined,
+            Dimensions: [
+                { Name: "ClusterName", Value: "my-prod-cluster" },
+                { Name: "ServiceName", Value: "my-api-service" },
+            ],
+        });
+        const memAlarm = new CloudWatchAlarmBuilder("fargate-mem").fargateMemory(fargate, 85);
+        await memAlarm.deploy();
+        const memPutCall = cwCalls.find((c) => c.commandName === "PutMetricAlarmCommand" && c.input.AlarmName === "fargate-mem");
+        assert.ok(memPutCall);
+        assert.deepStrictEqual(memPutCall.input.MetricName, "MemoryUtilization");
+        assert.deepStrictEqual(memPutCall.input.Namespace, "AWS/ECS");
+        assert.deepStrictEqual(memPutCall.input.Threshold, 85);
+    });
+    test("auto-wires specialized RDS CPU and storage helper alarms", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = { MetricAlarms: [] };
+        const rds = new RDSBuilder("my-database");
+        const cpuAlarm = new CloudWatchAlarmBuilder("rds-cpu").rdsCPU(rds, 90);
+        await cpuAlarm.deploy();
+        const cpuPutCall = cwCalls.find((c) => c.commandName === "PutMetricAlarmCommand" && c.input.AlarmName === "rds-cpu");
+        assert.ok(cpuPutCall);
+        assert.deepStrictEqual(cpuPutCall.input, {
+            AlarmName: "rds-cpu",
+            ComparisonOperator: "GreaterThanOrEqualToThreshold",
+            EvaluationPeriods: 1,
+            MetricName: "CPUUtilization",
+            Namespace: "AWS/RDS",
+            Period: 300,
+            Threshold: 90,
+            Statistic: "Average",
+            ActionsEnabled: false,
+            AlarmActions: undefined,
+            Dimensions: [{ Name: "DBInstanceIdentifier", Value: "my-database" }],
+        });
+        const storageAlarm = new CloudWatchAlarmBuilder("rds-storage").rdsStorage(rds, 5000000000);
+        await storageAlarm.deploy();
+        const storagePutCall = cwCalls.find((c) => c.commandName === "PutMetricAlarmCommand" && c.input.AlarmName === "rds-storage");
+        assert.ok(storagePutCall);
+        assert.strictEqual(storagePutCall.input.ComparisonOperator, "LessThanThreshold");
+        assert.strictEqual(storagePutCall.input.MetricName, "FreeStorageSpace");
+        assert.strictEqual(storagePutCall.input.Namespace, "AWS/RDS");
+        assert.strictEqual(storagePutCall.input.Threshold, 5000000000);
+    });
+    test("integrates with SNSTopicBuilder eagerly by awaiting its ARN", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = { MetricAlarms: [] };
+        // Set up a mock topic
+        const topic = new SNSTopicBuilder("alert-topic");
+        topic.resolvedArn = "arn:aws:sns:us-east-1:123456789012:alert-topic";
+        topic.out.arn.resolve("arn:aws:sns:us-east-1:123456789012:alert-topic");
+        const alarm = new CloudWatchAlarmBuilder("metric-alarm")
+            .metric("AWS/Billing", "EstimatedCharges")
+            .comparison("GreaterThanThreshold")
+            .threshold(100)
+            .actions(topic);
+        await alarm.deploy();
+        const putCall = cwCalls.find((c) => c.commandName === "PutMetricAlarmCommand");
+        assert.ok(putCall);
+        assert.strictEqual(putCall.input.ActionsEnabled, true);
+        assert.deepStrictEqual(putCall.input.AlarmActions, [
+            "arn:aws:sns:us-east-1:123456789012:alert-topic",
+        ]);
+    });
+    test("destroys an existing alarm successfully", async () => {
+        mockCwResponses["DescribeAlarmsCommand"] = {
+            MetricAlarms: [
+                {
+                    AlarmName: "my-alarm",
+                    AlarmArn: "arn:aws:cloudwatch:us-east-1:123456789012:alarm:my-alarm",
+                },
+            ],
+        };
+        const builder = new CloudWatchAlarmBuilder("my-alarm");
+        await builder.discoveryPromise;
+        const destroyResult = await builder.destroy();
+        assert.deepStrictEqual(destroyResult, { destroyed: "my-alarm" });
+        const deleteCall = cwCalls.find((c) => c.commandName === "DeleteAlarmsCommand");
+        assert.ok(deleteCall);
+        assert.deepStrictEqual(deleteCall.input.AlarmNames, ["my-alarm"]);
+    });
+    test("runs in dry run mode safely", async () => {
+        Config.set({
+            dryRun: true,
+            providers: {
+                aws: { region: "us-east-1" },
+            },
+        });
+        const builder = new CloudWatchAlarmBuilder("my-alarm")
+            .metric("AWS/Billing", "EstimatedCharges")
+            .comparison("GreaterThanThreshold")
+            .threshold(50);
+        const deployResult = await builder.deploy();
+        assert.ok(deployResult.arn.includes("DRYRUN"));
+        assert.ok(!cwCalls.some((c) => c.commandName === "PutMetricAlarmCommand"));
+    });
+});

package/dist/providers/aws/fargate.d.ts

@@ -12,6 +12,8 @@ export declare class FargateBuilder extends BaseBuilder {
     private _securityGroupIds?;
     resolvedArn: string | null;
     constructor(name: string);
+    get clusterName(): string;
+    get serviceName(): string;
     image(img: string): this;
     cpu(units: number): this;
     memory(mb: number): this;

package/dist/providers/aws/fargate.js

@@ -31,6 +31,12 @@ export class FargateBuilder extends BaseBuilder {
         super(name);
         this.discoveryPromise = this.discoverService(name);
     }
+    get clusterName() {
+        return this._clusterName;
+    }
+    get serviceName() {
+        return this.name;
+    }
     image(img) {
         this._image = img;
         return this;

package/dist/providers/aws/iam.d.ts

@@ -0,0 +1,52 @@
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import type { IAMPolicyDocument } from "../../types/aws.js";
+export declare class IAMPolicyBuilder extends BaseBuilder {
+    readonly out: {
+        arn: Output<string>;
+    };
+    private _document?;
+    private _description?;
+    private _path;
+    resolvedArn: string | null;
+    constructor(name: string);
+    private discoverPolicy;
+    document(doc: IAMPolicyDocument): this;
+    description(desc: string): this;
+    path(p: string): this;
+    deploy(): Promise<{
+        name: string;
+        arn: string | null;
+    }>;
+    destroy(): Promise<{
+        destroyed: string;
+    }>;
+}
+export declare class IAMRoleBuilder extends BaseBuilder {
+    readonly out: {
+        arn: Output<string>;
+        name: Output<string>;
+    };
+    private _assumeRolePolicy;
+    private _managedPolicies;
+    private _inlinePolicies;
+    private _description?;
+    private _path;
+    private _maxSessionDuration?;
+    resolvedArn: string | null;
+    constructor(name: string);
+    private discoverRole;
+    assumeRolePolicy(doc: IAMPolicyDocument): this;
+    attach(policyArnOrBuilder: string | IAMPolicyBuilder): this;
+    inlinePolicy(name: string, doc: IAMPolicyDocument): this;
+    description(desc: string): this;
+    path(p: string): this;
+    maxSessionDuration(seconds: number): this;
+    deploy(): Promise<{
+        name: string;
+        arn: string | null;
+    }>;
+    destroy(): Promise<{
+        destroyed: string;
+    }>;
+}