// *** WARNING: this file was generated by pulumi-java-gen. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

package com.pulumi.aws.kms.outputs;

import com.pulumi.core.annotations.CustomType;
import java.lang.String;
import java.util.Map;
import java.util.Objects;
import javax.annotation.Nullable;

@CustomType
public final class GrantConstraint {
    /**
     * @return A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with `encryption_context_subset`.
     * 
     */
    private @Nullable Map<String,String> encryptionContextEquals;
    /**
     * @return A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with `encryption_context_equals`.
     * 
     */
    private @Nullable Map<String,String> encryptionContextSubset;

    private GrantConstraint() {}
    /**
     * @return A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with `encryption_context_subset`.
     * 
     */
    public Map<String,String> encryptionContextEquals() {
        return this.encryptionContextEquals == null ? Map.of() : this.encryptionContextEquals;
    }
    /**
     * @return A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with `encryption_context_equals`.
     * 
     */
    public Map<String,String> encryptionContextSubset() {
        return this.encryptionContextSubset == null ? Map.of() : this.encryptionContextSubset;
    }

    public static Builder builder() {
        return new Builder();
    }

    public static Builder builder(GrantConstraint defaults) {
        return new Builder(defaults);
    }
    @CustomType.Builder
    public static final class Builder {
        private @Nullable Map<String,String> encryptionContextEquals;
        private @Nullable Map<String,String> encryptionContextSubset;
        public Builder() {}
        public Builder(GrantConstraint defaults) {
    	      Objects.requireNonNull(defaults);
    	      this.encryptionContextEquals = defaults.encryptionContextEquals;
    	      this.encryptionContextSubset = defaults.encryptionContextSubset;
        }

        @CustomType.Setter
        public Builder encryptionContextEquals(@Nullable Map<String,String> encryptionContextEquals) {
            this.encryptionContextEquals = encryptionContextEquals;
            return this;
        }
        @CustomType.Setter
        public Builder encryptionContextSubset(@Nullable Map<String,String> encryptionContextSubset) {
            this.encryptionContextSubset = encryptionContextSubset;
            return this;
        }
        public GrantConstraint build() {
            final var o = new GrantConstraint();
            o.encryptionContextEquals = encryptionContextEquals;
            o.encryptionContextSubset = encryptionContextSubset;
            return o;
        }
    }
}
