feat: add Dataplex Catalog action for discovery configs

Google APIs · copybara-github · commit d8bb284d3d55 · 2025-05-27T12:43:42.000-07:00
feat: add a project ID to table reference so that org parents can create single table discovery configs.

feat: new fields for data profile finding.

docs: various doc revisions
PiperOrigin-RevId: 763907074
diff --git a/google/privacy/dlp/v2/dlp.proto b/google/privacy/dlp/v2/dlp.proto
@@ -4199,32 +4199,78 @@ message Action {
   // Compatible with: Inspect
   message PublishFindingsToCloudDataCatalog {}
 
-  // Create a de-identified copy of the requested table or files.
+  // Create a de-identified copy of a storage bucket. Only compatible
+  // with Cloud Storage buckets.
+  //
   //
   // A TransformationDetail will be created for each transformation.
   //
-  // If any rows in BigQuery are skipped during de-identification
-  // (transformation errors or row size exceeds BigQuery insert API limits) they
-  // are placed in the failure output table. If the original row exceeds
-  // the BigQuery insert API limit it will be truncated when written to the
-  // failure output table. The failure output table can be set in the
-  // action.deidentify.output.big_query_output.deidentified_failure_output_table
-  // field, if no table is set, a table will be automatically created in the
-  // same project and dataset as the original table.
   //
-  // Compatible with: Inspect
+  // Compatible with: Inspection of Cloud Storage
   message Deidentify {
     // User specified deidentify templates and configs for structured,
     // unstructured, and image files.
     TransformationConfig transformation_config = 7;
 
-    // Config for storing transformation details. This is separate from the
-    // de-identified content, and contains metadata about the successful
-    // transformations and/or failures that occurred while de-identifying. This
-    // needs to be set in order for users to access information about the status
-    // of each transformation (see
+    // Config for storing transformation details.
+    //
+    // This field specifies the configuration for storing detailed metadata
+    // about each transformation performed during a de-identification process.
+    // The metadata is stored separately from the de-identified content itself
+    // and provides a granular record of both successful transformations and any
+    // failures that occurred.
+    //
+    // Enabling this configuration is essential for users who need to access
+    // comprehensive information about the status, outcome, and specifics of
+    // each transformation. The details are captured in the
     // [TransformationDetails][google.privacy.dlp.v2.TransformationDetails]
-    // message for more information about what is noted).
+    // message for each operation.
+    //
+    // Key use cases:
+    //
+    // * **Auditing and compliance**
+    //     * Provides a verifiable audit trail of de-identification activities,
+    //     which is crucial for meeting regulatory requirements and internal
+    //     data governance policies.
+    //     * Logs what data was transformed, what transformations were applied,
+    //     when they occurred, and their success status. This helps
+    //     demonstrate accountability and due diligence in protecting
+    //     sensitive data.
+    //
+    // * **Troubleshooting and debugging**
+    //     * Offers detailed error messages and context if a transformation
+    //     fails. This information is useful for diagnosing and resolving
+    //     issues in the de-identification pipeline.
+    //     * Helps pinpoint the exact location and nature of failures, speeding
+    //     up the debugging process.
+    //
+    // * **Process verification and quality assurance**
+    //     * Allows users to confirm that de-identification rules and
+    //     transformations were applied correctly and consistently across
+    //     the dataset as intended.
+    //     * Helps in verifying the effectiveness of the chosen
+    //     de-identification strategies.
+    //
+    // * **Data lineage and impact analysis**
+    //     * Creates a record of how data elements were modified, contributing
+    //     to data lineage. This is useful for understanding the provenance
+    //     of de-identified data.
+    //     * Aids in assessing the potential impact of de-identification choices
+    //     on downstream analytical processes or data usability.
+    //
+    // * **Reporting and operational insights**
+    //     * You can analyze the metadata stored in a queryable BigQuery table
+    //     to generate reports on transformation success rates, common
+    //     error types, processing volumes (e.g., transformedBytes), and the
+    //     types of transformations applied.
+    //     * These insights can inform optimization of de-identification
+    //     configurations and resource planning.
+    //
+    // To take advantage of these benefits, set this configuration. The stored
+    // details include a description of the transformation, success or
+    // error codes, error messages, the number of bytes transformed, the
+    // location of the transformed content, and identifiers for the job and
+    // source data.
     TransformationDetailsStorageConfig transformation_details_storage_config =
         3;
 
@@ -4958,6 +5004,18 @@ message DataProfileAction {
   // Center for each profile.
   message PublishToSecurityCommandCenter {}
 
+  // Create Dataplex Catalog aspects for profiled resources with the aspect type
+  // Sensitive Data Protection Profile. To learn more about aspects, see
+  // https://cloud.google.com/sensitive-data-protection/docs/add-aspects.
+  message PublishToDataplexCatalog {
+    // Whether creating a Dataplex Catalog aspect for a profiled resource should
+    // lower the risk of the profile for that resource. This also lowers the
+    // data risk of resources at the lower levels of the resource hierarchy. For
+    // example, reducing the data risk of a table data profile also reduces the
+    // data risk of the constituent column data profiles.
+    bool lower_data_risk_to_low = 1;
+  }
+
   // If set, attaches the [tags]
   // (https://cloud.google.com/resource-manager/docs/tags/tags-overview)
   // provided to profiled resources. Tags support [access
@@ -5031,6 +5089,10 @@ message DataProfileAction {
 
     // Tags the profiled resources with the specified tag values.
     TagResources tag_resources = 8;
+
+    // Publishes a portion of each profile to Dataplex Catalog with the aspect
+    // type Sensitive Data Protection Profile.
+    PublishToDataplexCatalog publish_to_dataplex_catalog = 9;
   }
 }
 
@@ -5065,6 +5127,14 @@ message DataProfileFinding {
 
   // How broadly a resource has been shared.
   ResourceVisibility resource_visibility = 8;
+
+  // The [full resource
+  // name](https://cloud.google.com/apis/design/resource_names#full_resource_name)
+  // of the resource profiled for this finding.
+  string full_resource_name = 9;
+
+  // The type of the resource that was profiled.
+  DataSourceType data_source_type = 10;
 }
 
 // Location of a data profile finding within a resource.
@@ -7989,7 +8059,8 @@ message FileStoreDataProfile {
   // The BigQuery table to which the sample findings are written.
   BigQueryTable sample_findings_table = 22;
 
-  // The file store does not have any files.
+  // The file store does not have any files. If the profiling operation failed,
+  // this is false.
   bool file_store_is_empty = 23;
 
   // The tags attached to the resource, including any tags attached during
diff --git a/google/privacy/dlp/v2/storage.proto b/google/privacy/dlp/v2/storage.proto
@@ -869,6 +869,11 @@ message TableReference {
 
   // Name of the table.
   string table_id = 2;
+
+  // The Google Cloud project ID of the project containing the table.
+  // If omitted, the project ID is inferred from the parent project. This field
+  // is required if the parent resource is an organization.
+  string project_id = 3;
 }
 
 // Message defining a field of a BigQuery table.
