Skip to content

Commit 81e759d

Browse files
gcf-owl-bot[bot]d-googdanieljbruce
authored
feat: [dlp] add secrets discovery support (#5380)
* feat: add secrets discovery support docs: Updated method documentation PiperOrigin-RevId: 636593602 Source-Link: googleapis/googleapis@1834a96 Source-Link: googleapis/googleapis-gen@ca0da7b Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLXByaXZhY3ktZGxwLy5Pd2xCb3QueWFtbCIsImgiOiJjYTBkYTdiM2QyNTIxOGRjNjZjNGJhMzY3NTI1OTI5NTljNjNhZDAzIn0= * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: Daniel Bankhead <[email protected]> Co-authored-by: danieljbruce <[email protected]>
1 parent 2c879f6 commit 81e759d

10 files changed

Lines changed: 873 additions & 59 deletions

File tree

‎packages/google-privacy-dlp/protos/google/privacy/dlp/v2/dlp.proto‎

Lines changed: 59 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1853,7 +1853,7 @@ message InspectDataSourceDetails {
18531853
// inspect job.
18541854
repeated InfoTypeStats info_type_stats = 3;
18551855

1856-
// Number of rows scanned post sampling and time filtering (Applicable for
1856+
// Number of rows scanned after sampling and time filtering (applicable for
18571857
// row based stores such as BigQuery).
18581858
int64 num_rows_processed = 5;
18591859

@@ -1989,6 +1989,9 @@ message InfoTypeCategory {
19891989
// The infoType is typically used in Australia.
19901990
AUSTRALIA = 3;
19911991

1992+
// The infoType is typically used in Azerbaijan.
1993+
AZERBAIJAN = 48;
1994+
19921995
// The infoType is typically used in Belgium.
19931996
BELGIUM = 4;
19941997

@@ -3938,7 +3941,7 @@ message Error {
39383941
repeated google.protobuf.Timestamp timestamps = 2;
39393942
}
39403943

3941-
// Contains a configuration to make api calls on a repeating basis.
3944+
// Contains a configuration to make API calls on a repeating basis.
39423945
// See
39433946
// https://cloud.google.com/sensitive-data-protection/docs/concepts-job-triggers
39443947
// to learn more.
@@ -4773,13 +4776,9 @@ message DataProfileAction {
47734776
// New profile (not a re-profile).
47744777
NEW_PROFILE = 1;
47754778

4776-
// Changed one of the following profile metrics:
4777-
// * Data risk score
4778-
// * Sensitivity score
4779-
// * Resource visibility
4780-
// * Encryption type
4781-
// * Predicted infoTypes
4782-
// * Other infoTypes
4779+
// One of the following profile metrics changed: Data risk score,
4780+
// Sensitivity score, Resource visibility, Encryption type, Predicted
4781+
// infoTypes, Other infoTypes
47834782
CHANGED_PROFILE = 2;
47844783

47854784
// Table data risk score or sensitivity score increased.
@@ -5036,6 +5035,11 @@ message DiscoveryTarget {
50365035
// Cloud SQL target for Discovery. The first target to match a table will be
50375036
// the one applied.
50385037
CloudSqlDiscoveryTarget cloud_sql_target = 2;
5038+
5039+
// Discovery target that looks for credentials and secrets stored in cloud
5040+
// resource metadata and reports them as vulnerabilities to Security Command
5041+
// Center. Only one target of this type is allowed.
5042+
SecretsDiscoveryTarget secrets_target = 3;
50395043
}
50405044
}
50415045

@@ -5088,6 +5092,11 @@ message DiscoveryBigQueryFilter {
50885092
// configuration. If none is specified, a default one will be added
50895093
// automatically.
50905094
AllOtherBigQueryTables other_tables = 2;
5095+
5096+
// The table to scan. Discovery configurations including this can only
5097+
// include one DiscoveryTarget (the DiscoveryTarget with this
5098+
// TableReference).
5099+
TableReference table_reference = 3;
50915100
}
50925101
}
50935102

@@ -5272,7 +5281,7 @@ message DatabaseResourceRegexes {
52725281
// under the google/re2 repository on GitHub.
52735282
message DatabaseResourceRegex {
52745283
// For organizations, if unset, will match all projects. Has no effect
5275-
// for Data Profile configurations created within a project.
5284+
// for configurations created within a project.
52765285
string project_id_regex = 1;
52775286

52785287
// Regex to test the instance name against. If empty, all instances match.
@@ -5294,12 +5303,19 @@ message AllOtherDatabaseResources {}
52945303
// Identifies a single database resource, like a table within a database.
52955304
message DatabaseResourceReference {
52965305
// Required. If within a project-level config, then this must match the
5297-
// config's project id.
5306+
// config's project ID.
52985307
string project_id = 1 [(google.api.field_behavior) = REQUIRED];
52995308

53005309
// Required. The instance where this resource is located. For example: Cloud
5301-
// SQL's instance id.
5310+
// SQL instance ID.
53025311
string instance = 2 [(google.api.field_behavior) = REQUIRED];
5312+
5313+
// Required. Name of a database within the instance.
5314+
string database = 3 [(google.api.field_behavior) = REQUIRED];
5315+
5316+
// Required. Name of a database resource, for example, a table within the
5317+
// database.
5318+
string database_resource = 4 [(google.api.field_behavior) = REQUIRED];
53035319
}
53045320

53055321
// Requirements that must be true before a table is profiled for the
@@ -5313,10 +5329,10 @@ message DiscoveryCloudSqlConditions {
53135329
// Include all supported database engines.
53145330
ALL_SUPPORTED_DATABASE_ENGINES = 1;
53155331

5316-
// MySql database.
5332+
// MySQL database.
53175333
MYSQL = 2;
53185334

5319-
// PostGres database.
5335+
// PostgreSQL database.
53205336
POSTGRES = 3;
53215337
}
53225338

@@ -5347,14 +5363,14 @@ message DiscoveryCloudSqlConditions {
53475363
// New tables are scanned as quickly as possible depending on system
53485364
// capacity.
53495365
message DiscoveryCloudSqlGenerationCadence {
5350-
// How frequency to modify the profile when the table's schema is modified.
5366+
// How frequently to modify the profile when the table's schema is modified.
53515367
message SchemaModifiedCadence {
53525368
// The type of modification that causes a profile update.
53535369
enum CloudSqlSchemaModification {
53545370
// Unused.
53555371
SQL_SCHEMA_MODIFICATION_UNSPECIFIED = 0;
53565372

5357-
// New columns has appeared.
5373+
// New columns have appeared.
53585374
NEW_COLUMNS = 1;
53595375

53605376
// Columns have been removed from the table.
@@ -5375,11 +5391,25 @@ message DiscoveryCloudSqlGenerationCadence {
53755391

53765392
// Data changes (non-schema changes) in Cloud SQL tables can't trigger
53775393
// reprofiling. If you set this field, profiles are refreshed at this
5378-
// frequency regardless of whether the underlying tables have changes.
5394+
// frequency regardless of whether the underlying tables have changed.
53795395
// Defaults to never.
53805396
DataProfileUpdateFrequency refresh_frequency = 2;
53815397
}
53825398

5399+
// Discovery target for credentials and secrets in cloud resource metadata.
5400+
//
5401+
// This target does not include any filtering or frequency controls. Cloud
5402+
// DLP will scan cloud resource metadata for secrets daily.
5403+
//
5404+
// No inspect template should be included in the discovery config for a
5405+
// security benchmarks scan. Instead, the built-in list of secrets and
5406+
// credentials infoTypes will be used (see
5407+
// https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference#credentials_and_secrets).
5408+
//
5409+
// Credentials and secrets discovered will be reported as vulnerabilities to
5410+
// Security Command Center.
5411+
message SecretsDiscoveryTarget {}
5412+
53835413
// The location to begin a discovery scan. Denotes an organization ID or folder
53845414
// ID within an organization.
53855415
message DiscoveryStartingLocation {
@@ -6523,8 +6553,8 @@ enum ResourceVisibility {
65236553
RESOURCE_VISIBILITY_PUBLIC = 10;
65246554

65256555
// May contain public items.
6526-
// For example, if a GCS bucket has uniform bucket level access disabled, some
6527-
// objects inside it may be public.
6556+
// For example, if a Cloud Storage bucket has uniform bucket level access
6557+
// disabled, some objects inside it may be public.
65286558
RESOURCE_VISIBILITY_INCONCLUSIVE = 15;
65296559

65306560
// Visible only to specific users.
@@ -7049,8 +7079,7 @@ message ListConnectionsRequest {
70497079
// results. If set, all other request fields must match the original request.
70507080
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
70517081

7052-
// Optional. * Supported fields/values
7053-
// - `state` - MISSING|AVAILABLE|ERROR
7082+
// Optional. Supported field/value: `state` - MISSING|AVAILABLE|ERROR
70547083
string filter = 4 [(google.api.field_behavior) = OPTIONAL];
70557084
}
70567085

@@ -7072,8 +7101,7 @@ message SearchConnectionsRequest {
70727101
// results. If set, all other request fields must match the original request.
70737102
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
70747103

7075-
// Optional. * Supported fields/values
7076-
// - `state` - MISSING|AVAILABLE|ERROR
7104+
// Optional. Supported field/value: - `state` - MISSING|AVAILABLE|ERROR
70777105
string filter = 4 [(google.api.field_behavior) = OPTIONAL];
70787106
}
70797107

@@ -7168,10 +7196,10 @@ enum ConnectionState {
71687196
// A configured connection that encountered errors during its last use. It
71697197
// will not be used again until it is set to AVAILABLE.
71707198
//
7171-
// If the resolution requires external action, then a request to set the
7172-
// status to AVAILABLE will mark this connection for use. Otherwise, any
7173-
// changes to the connection properties will automatically mark it as
7174-
// AVAILABLE.
7199+
// If the resolution requires external action, then the client must send a
7200+
// request to set the status to AVAILABLE when the connection is ready for
7201+
// use. If the resolution doesn't require external action, then any changes to
7202+
// the connection properties will automatically mark it as AVAILABLE.
71757203
ERROR = 3;
71767204
}
71777205

@@ -7189,8 +7217,8 @@ message SecretManagerCredential {
71897217
[(google.api.field_behavior) = REQUIRED];
71907218
}
71917219

7192-
// Use IAM auth to connect. This requires the Cloud SQL IAM feature to be
7193-
// enabled on the instance, which is not the default for Cloud SQL.
7220+
// Use IAM authentication to connect. This requires the Cloud SQL IAM feature
7221+
// to be enabled on the instance, which is not the default for Cloud SQL.
71947222
// See https://cloud.google.com/sql/docs/postgres/authentication and
71957223
// https://cloud.google.com/sql/docs/mysql/authentication.
71967224
message CloudSqlIamCredential {}
@@ -7200,13 +7228,13 @@ message CloudSqlProperties {
72007228
// Database engine of a Cloud SQL instance.
72017229
// New values may be added over time.
72027230
enum DatabaseEngine {
7203-
// An engine that is not currently supported by SDP.
7231+
// An engine that is not currently supported by Sensitive Data Protection.
72047232
DATABASE_ENGINE_UNKNOWN = 0;
72057233

72067234
// Cloud SQL for MySQL instance.
72077235
DATABASE_ENGINE_MYSQL = 1;
72087236

7209-
// Cloud SQL for Postgres instance.
7237+
// Cloud SQL for PostgreSQL instance.
72107238
DATABASE_ENGINE_POSTGRES = 2;
72117239
}
72127240

‎packages/google-privacy-dlp/protos/google/privacy/dlp/v2/storage.proto‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -859,6 +859,16 @@ message BigQueryTable {
859859
string table_id = 3;
860860
}
861861

862+
// Message defining the location of a BigQuery table with the projectId inferred
863+
// from the parent project.
864+
message TableReference {
865+
// Dataset ID of the table.
866+
string dataset_id = 1;
867+
868+
// Name of the table.
869+
string table_id = 2;
870+
}
871+
862872
// Message defining a field of a BigQuery table.
863873
message BigQueryField {
864874
// Source table of the field.

0 commit comments

Comments
 (0)