package awsroute53

import (
	"github.com/aws/aws-cdk-go/awscdk/v2/awskms"
)

// Options for enabling key signing from a hosted zone.
//
// Example:
//   kmsKey := kms.NewKey(this, jsii.String("KmsCMK"), &KeyProps{
//   	KeySpec: kms.KeySpec_ECC_NIST_P256,
//   	KeyUsage: kms.KeyUsage_SIGN_VERIFY,
//   })
//   hostedZone := route53.NewHostedZone(this, jsii.String("HostedZone"), &HostedZoneProps{
//   	ZoneName: jsii.String("example.com"),
//   })
//   // Enable DNSSEC signing for the zone
//   hostedZone.EnableDnssec(&ZoneSigningOptions{
//   	KmsKey: KmsKey,
//   })
//
type ZoneSigningOptions struct {
	// The customer-managed KMS key that that will be used to sign the records.
	//
	// The KMS Key must be unique for each KSK within a hosted zone. Additionally, the
	// KMS key must be an asymetric customer-managed key using the ECC_NIST_P256 algorithm.
	// See: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-cmk-requirements.html
	//
	KmsKey awskms.IKey `field:"required" json:"kmsKey" yaml:"kmsKey"`
	// The name for the key signing key.
	//
	// This name must be unique within a hosted zone.
	// Default: an autogenerated name.
	//
	KeySigningKeyName *string `field:"optional" json:"keySigningKeyName" yaml:"keySigningKeyName"`
}

