Skip to content

Commit ed9918e

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: added deidentify replacement dictionaries
feat: added field for BigQuery inspect template inclusion lists feat: added field to support infotype versioning PiperOrigin-RevId: 413780624
1 parent 116f657 commit ed9918e

2 files changed

Lines changed: 106 additions & 61 deletions

File tree

‎google/privacy/dlp/v2/dlp.proto‎

Lines changed: 83 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2020 Google LLC
1+
// Copyright 2021 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -360,6 +360,10 @@ service DlpService {
360360
post: "/v2/{parent=projects/*/locations/*}/jobTriggers"
361361
body: "*"
362362
}
363+
additional_bindings {
364+
post: "/v2/{parent=organizations/*/locations/*}/jobTriggers"
365+
body: "*"
366+
}
363367
};
364368
option (google.api.method_signature) = "parent,job_trigger";
365369
}
@@ -374,16 +378,17 @@ service DlpService {
374378
patch: "/v2/{name=projects/*/locations/*/jobTriggers/*}"
375379
body: "*"
376380
}
381+
additional_bindings {
382+
patch: "/v2/{name=organizations/*/locations/*/jobTriggers/*}"
383+
body: "*"
384+
}
377385
};
378386
option (google.api.method_signature) = "name,job_trigger,update_mask";
379387
}
380388

381389
// Inspect hybrid content and store findings to a trigger. The inspection
382390
// will be processed asynchronously. To review the findings monitor the
383391
// jobs within the trigger.
384-
// Early access feature is in a pre-release state and might change or have
385-
// limited support. For more information, see
386-
// https://cloud.google.com/products#product-launch-stages.
387392
rpc HybridInspectJobTrigger(HybridInspectJobTriggerRequest) returns (HybridInspectResponse) {
388393
option (google.api.http) = {
389394
post: "/v2/{name=projects/*/locations/*/jobTriggers/*}:hybridInspect"
@@ -400,6 +405,9 @@ service DlpService {
400405
additional_bindings {
401406
get: "/v2/{name=projects/*/locations/*/jobTriggers/*}"
402407
}
408+
additional_bindings {
409+
get: "/v2/{name=organizations/*/locations/*/jobTriggers/*}"
410+
}
403411
};
404412
option (google.api.method_signature) = "name";
405413
}
@@ -412,6 +420,9 @@ service DlpService {
412420
additional_bindings {
413421
get: "/v2/{parent=projects/*/locations/*}/jobTriggers"
414422
}
423+
additional_bindings {
424+
get: "/v2/{parent=organizations/*/locations/*}/jobTriggers"
425+
}
415426
};
416427
option (google.api.method_signature) = "parent";
417428
}
@@ -424,6 +435,9 @@ service DlpService {
424435
additional_bindings {
425436
delete: "/v2/{name=projects/*/locations/*/jobTriggers/*}"
426437
}
438+
additional_bindings {
439+
delete: "/v2/{name=organizations/*/locations/*/jobTriggers/*}"
440+
}
427441
};
428442
option (google.api.method_signature) = "name";
429443
}
@@ -470,6 +484,9 @@ service DlpService {
470484
additional_bindings {
471485
get: "/v2/{parent=projects/*/locations/*}/dlpJobs"
472486
}
487+
additional_bindings {
488+
get: "/v2/{parent=organizations/*/locations/*}/dlpJobs"
489+
}
473490
};
474491
option (google.api.method_signature) = "parent";
475492
}
@@ -623,11 +640,8 @@ service DlpService {
623640
}
624641

625642
// Inspect hybrid content and store findings to a job.
626-
// To review the findings inspect the job. Inspection will occur
643+
// To review the findings, inspect the job. Inspection will occur
627644
// asynchronously.
628-
// Early access feature is in a pre-release state and might change or have
629-
// limited support. For more information, see
630-
// https://cloud.google.com/products#product-launch-stages.
631645
rpc HybridInspectDlpJob(HybridInspectDlpJobRequest) returns (HybridInspectResponse) {
632646
option (google.api.http) = {
633647
post: "/v2/{name=projects/*/locations/*/dlpJobs/*}:hybridInspect"
@@ -638,9 +652,6 @@ service DlpService {
638652

639653
// Finish a running hybrid DlpJob. Triggers the finalization steps and running
640654
// of any enabled actions that have not yet run.
641-
// Early access feature is in a pre-release state and might change or have
642-
// limited support. For more information, see
643-
// https://cloud.google.com/products#product-launch-stages.
644655
rpc FinishDlpJob(FinishDlpJobRequest) returns (google.protobuf.Empty) {
645656
option (google.api.http) = {
646657
post: "/v2/{name=projects/*/locations/*/dlpJobs/*}:finish"
@@ -708,7 +719,8 @@ message InspectionRuleSet {
708719
// When used with redactContent only info_types and min_likelihood are currently
709720
// used.
710721
message InspectConfig {
711-
// Configuration to control the number of findings returned.
722+
// Configuration to control the number of findings returned. Cannot be set if
723+
// de-identification is requested.
712724
message FindingLimits {
713725
// Max findings configuration per infoType, per content item or long
714726
// running DlpJob.
@@ -782,7 +794,9 @@ message InspectConfig {
782794

783795
// Container for bytes to inspect or redact.
784796
message ByteContentItem {
785-
// The type of data being sent for inspection.
797+
// The type of data being sent for inspection. To learn more, see
798+
// [Supported file
799+
// types](https://cloud.google.com/dlp/docs/supported-file-types).
786800
enum BytesType {
787801
// Unused
788802
BYTES_TYPE_UNSPECIFIED = 0;
@@ -845,9 +859,9 @@ message ContentItem {
845859
}
846860
}
847861

848-
// Structured content to inspect. Up to 50,000 `Value`s per request allowed.
849-
// See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
850-
// learn more.
862+
// Structured content to inspect. Up to 50,000 `Value`s per request allowed. See
863+
// https://cloud.google.com/dlp/docs/inspecting-structured-text#inspecting_a_table
864+
// to learn more.
851865
message Table {
852866
// Values of the row.
853867
message Row {
@@ -945,6 +959,9 @@ message Finding {
945959
string job_name = 13 [(google.api.resource_reference) = {
946960
type: "dlp.googleapis.com/DlpJob"
947961
}];
962+
963+
// The unique finding id.
964+
string finding_id = 15;
948965
}
949966

950967
// Specifies the location of the finding.
@@ -1488,16 +1505,13 @@ message InspectDataSourceDetails {
14881505
repeated InfoTypeStats info_type_stats = 3;
14891506

14901507
// Statistics related to the processing of hybrid inspect.
1491-
// Early access feature is in a pre-release state and might change or have
1492-
// limited support. For more information, see
1493-
// https://cloud.google.com/products#product-launch-stages.
14941508
HybridInspectStatistics hybrid_stats = 7;
14951509
}
14961510

14971511
// The configuration used for this job.
14981512
RequestedOptions requested_options = 2;
14991513

1500-
// A summary of the outcome of this inspect job.
1514+
// A summary of the outcome of this inspection job.
15011515
Result result = 3;
15021516
}
15031517

@@ -2200,7 +2214,7 @@ message TransformationErrorHandling {
22002214
// A rule for transforming a value.
22012215
message PrimitiveTransformation {
22022216
oneof transformation {
2203-
// Replace
2217+
// Replace with a specified value.
22042218
ReplaceValueConfig replace_config = 1;
22052219

22062220
// Redact
@@ -2232,6 +2246,9 @@ message PrimitiveTransformation {
22322246

22332247
// Deterministic Crypto
22342248
CryptoDeterministicConfig crypto_deterministic_config = 12;
2249+
2250+
// Replace with a value randomly drawn (with replacement) from a dictionary.
2251+
ReplaceDictionaryConfig replace_dictionary_config = 13;
22352252
}
22362253
}
22372254

@@ -2282,7 +2299,9 @@ message CryptoHashConfig {
22822299
// input. Outputs a base64 encoded representation of the encrypted output.
22832300
// Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
22842301
message CryptoDeterministicConfig {
2285-
// The key used by the encryption function.
2302+
// The key used by the encryption function. For deterministic encryption
2303+
// using AES-SIV, the provided key is internally expanded to 64 bytes prior to
2304+
// use.
22862305
CryptoKey crypto_key = 1;
22872306

22882307
// The custom info type to annotate the surrogate with.
@@ -2346,6 +2365,16 @@ message ReplaceValueConfig {
23462365
Value new_value = 1;
23472366
}
23482367

2368+
// Replace each input value with a value randomly selected from the dictionary.
2369+
message ReplaceDictionaryConfig {
2370+
oneof type {
2371+
// A list of words to select from for random replacement. The
2372+
// [limits](https://cloud.google.com/dlp/limits) page contains details about
2373+
// the size limits of dictionaries.
2374+
CustomInfoType.Dictionary.WordList word_list = 1;
2375+
}
2376+
}
2377+
23492378
// Replace each matching finding with the name of the info_type.
23502379
message ReplaceWithInfoTypeConfig {
23512380

@@ -2429,8 +2458,8 @@ message CharacterMaskConfig {
24292458
// the user for simple bucketing strategies.
24302459
//
24312460
// The transformed value will be a hyphenated string of
2432-
// {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20
2433-
// all values that are within this bucket will be replaced with "10-20".
2461+
// {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound
2462+
// = 20, all values that are within this bucket will be replaced with "10-20".
24342463
//
24352464
// This can be used on data of type: double, long.
24362465
//
@@ -2593,10 +2622,11 @@ message CryptoReplaceFfxFpeConfig {
25932622
}
25942623

25952624
// This is a data encryption key (DEK) (as opposed to
2596-
// a key encryption key (KEK) stored by KMS).
2597-
// When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
2598-
// IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
2599-
// unwrap the data crypto key.
2625+
// a key encryption key (KEK) stored by Cloud Key Management Service
2626+
// (Cloud KMS).
2627+
// When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate
2628+
// IAM policy on the KEK to ensure an attacker cannot
2629+
// unwrap the DEK.
26002630
message CryptoKey {
26012631
// Sources of crypto keys.
26022632
oneof source {
@@ -2606,7 +2636,7 @@ message CryptoKey {
26062636
// Unwrapped crypto key
26072637
UnwrappedCryptoKey unwrapped = 2;
26082638

2609-
// Kms wrapped key
2639+
// Key wrapped using Cloud KMS
26102640
KmsWrappedCryptoKey kms_wrapped = 3;
26112641
}
26122642
}
@@ -2631,10 +2661,16 @@ message UnwrappedCryptoKey {
26312661
}
26322662

26332663
// Include to use an existing data crypto key wrapped by KMS.
2634-
// The wrapped key must be a 128/192/256 bit key.
2664+
// The wrapped key must be a 128-, 192-, or 256-bit key.
26352665
// Authorization requires the following IAM permissions when sending a request
2636-
// to perform a crypto transformation using a kms-wrapped crypto key:
2666+
// to perform a crypto transformation using a KMS-wrapped crypto key:
26372667
// dlp.kms.encrypt
2668+
//
2669+
// For more information, see [Creating a wrapped key]
2670+
// (https://cloud.google.com/dlp/docs/create-wrapped-key).
2671+
//
2672+
// Note: When you use Cloud KMS for cryptographic operations,
2673+
// [charges apply](https://cloud.google.com/kms/pricing).
26382674
message KmsWrappedCryptoKey {
26392675
// Required. The wrapped data crypto key.
26402676
bytes wrapped_key = 1 [(google.api.field_behavior) = REQUIRED];
@@ -2697,6 +2733,9 @@ message InfoTypeTransformations {
26972733
// The transformation to apply to the field.
26982734
message FieldTransformation {
26992735
// Required. Input field(s) to apply the transformation to.
2736+
// When you have columns that reference their position within a list,
2737+
// omit the index from the FieldId. FieldId name matching ignores the index.
2738+
// For example, instead of "contact.nums[0].type", use "contact.nums.type".
27002739
repeated FieldId fields = 1 [(google.api.field_behavior) = REQUIRED];
27012740

27022741
// Only apply the transformation if the condition evaluates to true for the
@@ -2868,7 +2907,7 @@ message TransformationSummary {
28682907
int64 transformed_bytes = 7;
28692908
}
28702909

2871-
// Schedule for triggeredJobs.
2910+
// Schedule for inspect job triggers.
28722911
message Schedule {
28732912
oneof option {
28742913
// With this option a job is started a regular periodic basis. For
@@ -2955,7 +2994,7 @@ message DeidentifyTemplate {
29552994
// Output only. The last update timestamp of an inspectTemplate.
29562995
google.protobuf.Timestamp update_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
29572996

2958-
// ///////////// // The core content of the template // ///////////////
2997+
// The core content of the template.
29592998
DeidentifyConfig deidentify_config = 6;
29602999
}
29613000

@@ -2985,9 +3024,6 @@ message JobTrigger {
29853024
Schedule schedule = 1;
29863025

29873026
// For use with hybrid jobs. Jobs must be manually created and finished.
2988-
// Early access feature is in a pre-release state and might change or have
2989-
// limited support. For more information, see
2990-
// https://cloud.google.com/products#product-launch-stages.
29913027
Manual manual = 2;
29923028
}
29933029
}
@@ -3090,11 +3126,11 @@ message Action {
30903126

30913127
}
30923128

3093-
// Publish findings of a DlpJob to Cloud Data Catalog. Labels summarizing the
3129+
// Publish findings of a DlpJob to Data Catalog. Labels summarizing the
30943130
// results of the DlpJob will be applied to the entry for the resource scanned
3095-
// in Cloud Data Catalog. Any labels previously written by another DlpJob will
3131+
// in Data Catalog. Any labels previously written by another DlpJob will
30963132
// be deleted. InfoType naming patterns are strictly enforced when using this
3097-
// feature. Note that the findings will be persisted in Cloud Data Catalog
3133+
// feature. Note that the findings will be persisted in Data Catalog
30983134
// storage and are governed by Data Catalog service-specific policy, see
30993135
// https://cloud.google.com/terms/service-terms
31003136
// Only a single instance of this action can be specified and only allowed if
@@ -3402,10 +3438,11 @@ message CreateDlpJobRequest {
34023438

34033439
// The configuration details for the specific type of job to run.
34043440
oneof job {
3405-
// Set to control what and how to inspect.
3441+
// An inspection job scans a storage repository for InfoTypes.
34063442
InspectJobConfig inspect_job = 2;
34073443

3408-
// Set to choose what metric to calculate.
3444+
// A risk analysis job calculates re-identification risk metrics for a
3445+
// BigQuery table.
34093446
RiskAnalysisJobConfig risk_job = 3;
34103447
}
34113448

@@ -3477,7 +3514,7 @@ message ListJobTriggersRequest {
34773514
// * Restrictions can be combined by `AND` or `OR` logical operators. A
34783515
// sequence of restrictions implicitly uses `AND`.
34793516
// * A restriction has the form of `{field} {operator} {value}`.
3480-
// * Supported fields/values for inspect jobs:
3517+
// * Supported fields/values for inspect triggers:
34813518
// - `status` - HEALTHY|PAUSED|CANCELLED
34823519
// - `inspected_storage` - DATASTORE|CLOUD_STORAGE|BIGQUERY
34833520
// - 'last_run_time` - RFC 3339 formatted timestamp, surrounded by
@@ -3495,6 +3532,9 @@ message ListJobTriggersRequest {
34953532
// The length of this field should be no more than 500 characters.
34963533
string filter = 5;
34973534

3535+
// The type of jobs. Will use `DlpJobType.INSPECT` if not set.
3536+
DlpJobType type = 6;
3537+
34983538
// Deprecated. This field has no effect.
34993539
string location_id = 7;
35003540
}
@@ -4347,7 +4387,7 @@ enum InfoTypeSupportedBy {
43474387

43484388
// An enum to represent the various types of DLP jobs.
43494389
enum DlpJobType {
4350-
// Unused
4390+
// Defaults to INSPECT_JOB.
43514391
DLP_JOB_TYPE_UNSPECIFIED = 0;
43524392

43534393
// The job inspected Google Cloud for sensitive data.

0 commit comments

Comments
 (0)