Skip to content

Commit 106d029

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: [dlp] action for publishing data profiles to SecOps (formelly known as Chronicle) (#5691)
* feat: action for publishing data profiles to SecOps (formelly known as Chronicle) feat: action for publishing data profiles to Security Command Center feat: discovery configs for AWS S3 buckets docs: small improvements and clarifications PiperOrigin-RevId: 676184918 Source-Link: googleapis/googleapis@607c2ae Source-Link: googleapis/googleapis-gen@f92f1ae Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLXByaXZhY3ktZGxwLy5Pd2xCb3QueWFtbCIsImgiOiJmOTJmMWFlMTk4OTU5MzBhY2E2YWQxMWFhZWIxZDRkOWNkN2E2MWExIn0= * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 02aeffb commit 106d029

7 files changed

Lines changed: 13333 additions & 6659 deletions

File tree

‎packages/google-privacy-dlp/protos/google/privacy/dlp/v2/dlp.proto‎

Lines changed: 268 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4897,6 +4897,12 @@ message DataProfileAction {
48974897
ERROR_CHANGED = 4;
48984898
}
48994899

4900+
// Message expressing intention to publish to Google Security Operations.
4901+
message PublishToChronicle {}
4902+
4903+
// If set, a summary finding will be created/updated in SCC for each profile.
4904+
message PublishToSecurityCommandCenter {}
4905+
49004906
// If set, attaches the [tags]
49014907
// (https://cloud.google.com/resource-manager/docs/tags/tags-overview)
49024908
// provided to profiled resources. Tags support [access
@@ -4959,6 +4965,15 @@ message DataProfileAction {
49594965
// Publish a message into the Pub/Sub topic.
49604966
PubSubNotification pub_sub_notification = 2;
49614967

4968+
// Publishes generated data profiles to Google Security Operations.
4969+
// For more information, see [Use Sensitive Data Protection data in
4970+
// context-aware
4971+
// analytics](https://cloud.google.com/chronicle/docs/detection/usecase-dlp-high-risk-user-download).
4972+
PublishToChronicle publish_to_chronicle = 3;
4973+
4974+
// Publishes findings to SCC for each data profile.
4975+
PublishToSecurityCommandCenter publish_to_scc = 4;
4976+
49624977
// Tags the profiled resources with the specified tag values.
49634978
TagResources tag_resources = 8;
49644979
}
@@ -4980,6 +4995,9 @@ message DataProfileJobConfig {
49804995
// that are profiled, and the Cloud DLP API must be enabled.
49814996
string project_id = 5;
49824997

4998+
// Must be set only when scanning other clouds.
4999+
OtherCloudDiscoveryStartingLocation other_cloud_starting_location = 8;
5000+
49835001
// Detection logic for profile generation.
49845002
//
49855003
// Not all template features are used by profiles. FindingLimits,
@@ -5144,6 +5162,9 @@ message DiscoveryConfig {
51445162
// Only set when the parent is an org.
51455163
OrgConfig org_config = 2;
51465164

5165+
// Must be set only when scanning other clouds.
5166+
OtherCloudDiscoveryStartingLocation other_cloud_starting_location = 12;
5167+
51475168
// Detection logic for profile generation.
51485169
//
51495170
// Not all template features are used by Discovery. FindingLimits,
@@ -5210,6 +5231,10 @@ message DiscoveryTarget {
52105231
// Cloud Storage target for Discovery. The first target to match a table
52115232
// will be the one applied.
52125233
CloudStorageDiscoveryTarget cloud_storage_target = 4;
5234+
5235+
// Other clouds target for discovery. The first target to match a resource
5236+
// will be the one applied.
5237+
OtherCloudDiscoveryTarget other_cloud_target = 5;
52135238
}
52145239
}
52155240

@@ -5821,6 +5846,208 @@ message DiscoveryFileStoreConditions {
58215846
}
58225847
}
58235848

5849+
// Target used to match against for discovery of resources from other clouds.
5850+
// An [AWS connector in Security Command Center
5851+
// (Enterprise](https://cloud.google.com/security-command-center/docs/connect-scc-to-aws)
5852+
// is required to use this feature.
5853+
message OtherCloudDiscoveryTarget {
5854+
// Required. The type of data profiles generated by this discovery target.
5855+
// Supported values are:
5856+
// * aws/s3/bucket
5857+
DataSourceType data_source_type = 1 [(google.api.field_behavior) = REQUIRED];
5858+
5859+
// Required. The resources that the discovery cadence applies to. The
5860+
// first target with a matching filter will be the one to apply to a resource.
5861+
DiscoveryOtherCloudFilter filter = 2 [(google.api.field_behavior) = REQUIRED];
5862+
5863+
// Optional. In addition to matching the filter, these conditions must be true
5864+
// before a profile is generated.
5865+
DiscoveryOtherCloudConditions conditions = 3
5866+
[(google.api.field_behavior) = OPTIONAL];
5867+
5868+
// Type of cadence.
5869+
oneof cadence {
5870+
// How often and when to update data profiles. New resources that match both
5871+
// the filter and conditions are scanned as quickly as possible depending on
5872+
// system capacity.
5873+
DiscoveryOtherCloudGenerationCadence generation_cadence = 4;
5874+
5875+
// Disable profiling for resources that match this filter.
5876+
Disabled disabled = 5;
5877+
}
5878+
}
5879+
5880+
// Determines which resources from the other cloud will have profiles generated.
5881+
// Includes the ability to filter by resource names.
5882+
message DiscoveryOtherCloudFilter {
5883+
// Whether the filter applies to a specific set of resources or all
5884+
// other resources. The first filter to match will be applied, regardless of
5885+
// the condition. Defaults to `others` if none is set.
5886+
oneof filter {
5887+
// A collection of resources for this filter to apply to.
5888+
OtherCloudResourceCollection collection = 1;
5889+
5890+
// The resource to scan. Configs using this filter can only have one target
5891+
// (the target with this single resource reference).
5892+
OtherCloudSingleResourceReference single_resource = 2;
5893+
5894+
// Optional. Catch-all. This should always be the last target in the list
5895+
// because anything above it will apply first. Should only appear once in a
5896+
// configuration. If none is specified, a default one will be added
5897+
// automatically.
5898+
AllOtherResources others = 100 [(google.api.field_behavior) = OPTIONAL];
5899+
}
5900+
}
5901+
5902+
// Match resources using regex filters.
5903+
message OtherCloudResourceCollection {
5904+
// The first filter containing a pattern that matches a resource will be used.
5905+
oneof pattern {
5906+
// A collection of regular expressions to match a resource against.
5907+
OtherCloudResourceRegexes include_regexes = 1;
5908+
}
5909+
}
5910+
5911+
// A collection of regular expressions to determine what resources to match
5912+
// against.
5913+
message OtherCloudResourceRegexes {
5914+
// A group of regular expression patterns to match against one or more
5915+
// resources.
5916+
// Maximum of 100 entries. The sum of all regular expression's length can't
5917+
// exceed 10 KiB.
5918+
repeated OtherCloudResourceRegex patterns = 1;
5919+
}
5920+
5921+
// A pattern to match against one or more resources. At least one pattern must
5922+
// be specified. Regular expressions use RE2
5923+
// [syntax](https://github.com/google/re2/wiki/Syntax); a guide can be found
5924+
// under the google/re2 repository on GitHub.
5925+
message OtherCloudResourceRegex {
5926+
// The type of resource regex to use.
5927+
oneof resource_regex {
5928+
// Regex for Amazon S3 buckets.
5929+
AmazonS3BucketRegex amazon_s3_bucket_regex = 1;
5930+
}
5931+
}
5932+
5933+
// AWS account regex.
5934+
message AwsAccountRegex {
5935+
// Optional. Regex to test the AWS account ID against.
5936+
// If empty, all accounts match.
5937+
string account_id_regex = 1 [(google.api.field_behavior) = OPTIONAL];
5938+
}
5939+
5940+
// Amazon S3 bucket regex.
5941+
message AmazonS3BucketRegex {
5942+
// The AWS account regex.
5943+
AwsAccountRegex aws_account_regex = 1;
5944+
5945+
// Optional. Regex to test the bucket name against.
5946+
// If empty, all buckets match.
5947+
string bucket_name_regex = 2 [(google.api.field_behavior) = OPTIONAL];
5948+
}
5949+
5950+
// Identifies a single resource, like a single Amazon S3 bucket.
5951+
message OtherCloudSingleResourceReference {
5952+
// The resource to scan.
5953+
oneof resource {
5954+
// Amazon S3 bucket.
5955+
AmazonS3Bucket amazon_s3_bucket = 1;
5956+
}
5957+
}
5958+
5959+
// AWS account.
5960+
message AwsAccount {
5961+
// Required. AWS account ID.
5962+
string account_id = 1 [(google.api.field_behavior) = REQUIRED];
5963+
}
5964+
5965+
// Amazon S3 bucket.
5966+
message AmazonS3Bucket {
5967+
// The AWS account.
5968+
AwsAccount aws_account = 1;
5969+
5970+
// Required. The bucket name.
5971+
string bucket_name = 2 [(google.api.field_behavior) = REQUIRED];
5972+
}
5973+
5974+
// Requirements that must be true before a resource is profiled for the first
5975+
// time.
5976+
message DiscoveryOtherCloudConditions {
5977+
// Minimum age a resource must be before Cloud DLP can profile it. Value must
5978+
// be 1 hour or greater.
5979+
google.protobuf.Duration min_age = 1;
5980+
5981+
// The conditions to apply.
5982+
oneof conditions {
5983+
// Amazon S3 bucket conditions.
5984+
AmazonS3BucketConditions amazon_s3_bucket_conditions = 2;
5985+
}
5986+
}
5987+
5988+
// Amazon S3 bucket conditions.
5989+
message AmazonS3BucketConditions {
5990+
// Supported Amazon S3 bucket types.
5991+
// Defaults to TYPE_ALL_SUPPORTED.
5992+
enum BucketType {
5993+
// Unused.
5994+
TYPE_UNSPECIFIED = 0;
5995+
5996+
// All supported classes.
5997+
TYPE_ALL_SUPPORTED = 1;
5998+
5999+
// A general purpose Amazon S3 bucket.
6000+
TYPE_GENERAL_PURPOSE = 2;
6001+
}
6002+
6003+
// Supported Amazon S3 object storage classes.
6004+
// Defaults to ALL_SUPPORTED_CLASSES.
6005+
enum ObjectStorageClass {
6006+
// Unused.
6007+
UNSPECIFIED = 0;
6008+
6009+
// All supported classes.
6010+
ALL_SUPPORTED_CLASSES = 1;
6011+
6012+
// Standard object class.
6013+
STANDARD = 2;
6014+
6015+
// Standard - infrequent access object class.
6016+
STANDARD_INFREQUENT_ACCESS = 4;
6017+
6018+
// Glacier - instant retrieval object class.
6019+
GLACIER_INSTANT_RETRIEVAL = 6;
6020+
6021+
// Objects in the S3 Intelligent-Tiering access tiers.
6022+
INTELLIGENT_TIERING = 7;
6023+
}
6024+
6025+
// Optional. Bucket types that should be profiled.
6026+
// Optional. Defaults to TYPE_ALL_SUPPORTED if unspecified.
6027+
repeated BucketType bucket_types = 1 [(google.api.field_behavior) = OPTIONAL];
6028+
6029+
// Optional. Object classes that should be profiled.
6030+
// Optional. Defaults to ALL_SUPPORTED_CLASSES if unspecified.
6031+
repeated ObjectStorageClass object_storage_classes = 2
6032+
[(google.api.field_behavior) = OPTIONAL];
6033+
}
6034+
6035+
// How often existing resources should have their profiles refreshed.
6036+
// New resources are scanned as quickly as possible depending on system
6037+
// capacity.
6038+
message DiscoveryOtherCloudGenerationCadence {
6039+
// Optional. Frequency to update profiles regardless of whether the underlying
6040+
// resource has changes. Defaults to never.
6041+
DataProfileUpdateFrequency refresh_frequency = 1
6042+
[(google.api.field_behavior) = OPTIONAL];
6043+
6044+
// Optional. Governs when to update data profiles when the inspection rules
6045+
// defined by the `InspectTemplate` change.
6046+
// If not set, changing the template will not cause a data profile to update.
6047+
DiscoveryInspectTemplateModifiedCadence inspect_template_modified_cadence = 2
6048+
[(google.api.field_behavior) = OPTIONAL];
6049+
}
6050+
58246051
// The location to begin a discovery scan. Denotes an organization ID or folder
58256052
// ID within an organization.
58266053
message DiscoveryStartingLocation {
@@ -5834,6 +6061,31 @@ message DiscoveryStartingLocation {
58346061
}
58356062
}
58366063

6064+
// The other cloud starting location for discovery.
6065+
message OtherCloudDiscoveryStartingLocation {
6066+
// The AWS starting location for discovery.
6067+
message AwsDiscoveryStartingLocation {
6068+
// The scope of this starting location.
6069+
oneof scope {
6070+
// The AWS account ID that this discovery config applies to.
6071+
// Within an AWS organization, you can find the AWS account ID inside an
6072+
// AWS account ARN. Example:
6073+
// arn:{partition}:organizations::{management_account_id}:account/{org_id}/{account_id}
6074+
string account_id = 2;
6075+
6076+
// All AWS assets stored in Asset Inventory that didn't match other AWS
6077+
// discovery configs.
6078+
bool all_asset_inventory_assets = 3;
6079+
}
6080+
}
6081+
6082+
// The other cloud starting location for discovery.
6083+
oneof location {
6084+
// The AWS starting location for discovery.
6085+
AwsDiscoveryStartingLocation aws_location = 1;
6086+
}
6087+
}
6088+
58376089
// Match discovery resources not covered by any other filter.
58386090
message AllOtherResources {}
58396091

@@ -6946,7 +7198,7 @@ message ProjectDataProfile {
69467198
// The resource name of the profile.
69477199
string name = 1;
69487200

6949-
// Project ID that was profiled.
7201+
// Project ID or account that was profiled.
69507202
string project_id = 2;
69517203

69527204
// The last time the profile was generated.
@@ -7364,6 +7616,7 @@ message ColumnDataProfile {
73647616
// The profile for a file store.
73657617
//
73667618
// * Cloud Storage: maps 1:1 with a bucket.
7619+
// * Amazon S3: maps 1:1 with a bucket.
73677620
message FileStoreDataProfile {
73687621
option (google.api.resource) = {
73697622
type: "dlp.googleapis.com/FileStoreDataProfile"
@@ -7396,12 +7649,15 @@ message FileStoreDataProfile {
73967649
string project_data_profile = 3;
73977650

73987651
// The Google Cloud project ID that owns the resource.
7652+
// For Amazon S3 buckets, this is the AWS Account Id.
73997653
string project_id = 4;
74007654

74017655
// The location of the file store.
74027656
//
74037657
// * Cloud Storage:
74047658
// https://cloud.google.com/storage/docs/locations#available-locations
7659+
// * Amazon S3:
7660+
// https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints
74057661
string file_store_location = 5;
74067662

74077663
// For resources that have multiple storage locations, these are those
@@ -7419,10 +7675,14 @@ message FileStoreDataProfile {
74197675
// The file store path.
74207676
//
74217677
// * Cloud Storage: `gs://{bucket}`
7678+
// * Amazon S3: `s3://{bucket}`
74227679
string file_store_path = 6;
74237680

74247681
// The resource name of the resource profiled.
74257682
// https://cloud.google.com/apis/design/resource_names#full_resource_name
7683+
//
7684+
// Example format of an S3 bucket full resource name:
7685+
// `//cloudasset.googleapis.com/organizations/{org_id}/otherCloudConnections/aws/arn:aws:s3:::{bucket_name}`
74267686
string full_resource = 24;
74277687

74287688
// The snapshot of the configurations used to generate the profile.
@@ -7599,6 +7859,7 @@ message ListFileStoreDataProfilesRequest {
75997859
// * A restriction has the form of `{field} {operator} {value}`.
76007860
// * Supported fields/values:
76017861
// - `project_id` - The Google Cloud project ID.
7862+
// - `account_id` - The AWS account ID.
76027863
// - `file_store_path` - The path like "gs://bucket".
76037864
// - `data_source_type` - The profile's data source type, like
76047865
// "google/storage/bucket".
@@ -7995,7 +8256,12 @@ message DeleteTableDataProfileRequest {
79958256
// Message used to identify the type of resource being profiled.
79968257
message DataSourceType {
79978258
// Output only. An identifying string to the type of resource being profiled.
7998-
// Current values: google/bigquery/table, google/project
8259+
// Current values:
8260+
//
8261+
// * google/bigquery/table
8262+
// * google/project
8263+
// * google/sql/table
8264+
// * google/gcs/bucket
79998265
string data_source = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
80008266
}
80018267

0 commit comments

Comments
 (0)