docs: update docs (#916)
* fix: re-run script
* test: fix noxfile
diff --git a/docs/dyn/dlp_v2.projects.content.html b/docs/dyn/dlp_v2.projects.content.html
index 04ef37a..1c4845c 100644
--- a/docs/dyn/dlp_v2.projects.content.html
+++ b/docs/dyn/dlp_v2.projects.content.html
@@ -103,8 +103,8 @@
{ # Request to de-identify a list of items.
"item": { # Container structure for the content to inspect. # The item to de-identify. Will be treated as text.
"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
- "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
"data": "A String", # Content data to inspect or redact.
+ "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
},
"value": "A String", # String data to inspect or redact.
"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
@@ -121,9 +121,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -148,13 +145,16 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
],
},
@@ -181,6 +181,164 @@
# inspect_template_name argument.
# When used with redactContent only info_types and min_likelihood are currently
# used.
+ "minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is
+ # POSSIBLE.
+ # See https://cloud.google.com/dlp/docs/likelihood to learn more.
+ "contentOptions": [ # List of options defining data content to scan.
+ # If empty, text, images, and other content will be included.
+ "A String",
+ ],
+ "infoTypes": [ # Restricts what info_types to look for. The values must correspond to
+ # InfoType values returned by ListInfoTypes or listed at
+ # https://cloud.google.com/dlp/docs/infotypes-reference.
+ #
+ # When no InfoTypes or CustomInfoTypes are specified in a request, the
+ # system may automatically choose what detectors to run. By default this may
+ # be all types, but may change over time as detectors are updated.
+ #
+ # If you need precise control and predictability as to what detectors are
+ # run you should specify specific InfoTypes listed in the reference,
+ # otherwise a default list will be used, which may change over time.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
+ "excludeInfoTypes": True or False, # When true, excludes type information of the findings.
+ "customInfoTypes": [ # CustomInfoTypes provided by the user. See
+ # https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
+ { # Custom information type provided by the user. Used to find domain-specific
+ # sensitive information configurable to the data in question.
+ "surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that
+ # support reversing.
+ # such as
+ # [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).
+ # These types of transformations are
+ # those that perform pseudonymization, thereby producing a "surrogate" as
+ # output. This should be used in conjunction with a field on the
+ # transformation such as `surrogate_info_type`. This CustomInfoType does
+ # not support the use of `detection_rules`.
+ },
+ "likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be
+ # altered by a detection rule if the finding meets the criteria specified by
+ # the rule. Defaults to `VERY_LIKELY` if not specified.
+ "infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in
+ # infoType, when the name matches one of existing infoTypes and that infoType
+ # is specified in `InspectContent.info_types` field. Specifying the latter
+ # adds findings to the one detected by the system. If built-in info type is
+ # not specified in `InspectContent.info_types` list then the name is treated
+ # as a custom info type.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.
+ "groupIndexes": [ # The index of the submatch to extract as findings. When not
+ # specified, the entire match is returned. No more than 3 may be included.
+ 42,
+ ],
+ "pattern": "A String", # Pattern defining the regular expression. Its syntax
+ # (https://github.com/google/re2/wiki/Syntax) can be found under the
+ # google/re2 repository on GitHub.
+ },
+ "detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.
+ # Rules are applied in order that they are specified. Not supported for the
+ # `surrogate_type` CustomInfoType.
+ { # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a
+ # `CustomInfoType` to alter behavior under certain circumstances, depending
+ # on the specific details of the rule. Not supported for the `surrogate_type`
+ # custom infoType.
+ "hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.
+ # proximity of hotwords.
+ "likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.
+ # part of a detection rule.
+ "relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of
+ # levels. For example, if a finding would be `POSSIBLE` without the
+ # detection rule and `relative_likelihood` is 1, then it is upgraded to
+ # `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.
+ # Likelihood may never drop below `VERY_UNLIKELY` or exceed
+ # `VERY_LIKELY`, so applying an adjustment of 1 followed by an
+ # adjustment of -1 when base likelihood is `VERY_LIKELY` will result in
+ # a final likelihood of `LIKELY`.
+ "fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.
+ },
+ "hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.
+ "groupIndexes": [ # The index of the submatch to extract as findings. When not
+ # specified, the entire match is returned. No more than 3 may be included.
+ 42,
+ ],
+ "pattern": "A String", # Pattern defining the regular expression. Its syntax
+ # (https://github.com/google/re2/wiki/Syntax) can be found under the
+ # google/re2 repository on GitHub.
+ },
+ "proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.
+ # The total length of the window cannot exceed 1000 characters. Note that
+ # the finding itself will be included in the window, so that hotwords may
+ # be used to match substrings of the finding itself. For example, the
+ # certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be
+ # adjusted upwards if the area code is known to be the local area code of
+ # a company office using the hotword regex "\(xxx\)", where "xxx"
+ # is the area code in question.
+ # rule.
+ "windowBefore": 42, # Number of characters before the finding to consider.
+ "windowAfter": 42, # Number of characters after the finding to consider.
+ },
+ },
+ },
+ ],
+ "exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding
+ # to be returned. It still can be used for rules matching.
+ "dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.
+ # be used to match sensitive information specific to the data, such as a list
+ # of employee IDs or job titles.
+ #
+ # Dictionary words are case-insensitive and all characters other than letters
+ # and digits in the unicode [Basic Multilingual
+ # Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)
+ # will be replaced with whitespace when scanning for matches, so the
+ # dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",
+ # "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters
+ # surrounding any match must be of a different type than the adjacent
+ # characters within the word, so letters must be next to non-letters and
+ # digits next to non-digits. For example, the dictionary word "jen" will
+ # match the first three letters of the text "jen123" but will return no
+ # matches for "jennifer".
+ #
+ # Dictionary words containing a large number of characters that are not
+ # letters or digits may result in unexpected findings because such characters
+ # are treated as whitespace. The
+ # [limits](https://cloud.google.com/dlp/limits) page contains details about
+ # the size limits of dictionaries. For dictionaries that do not fit within
+ # these constraints, consider using `LargeCustomDictionaryConfig` in the
+ # `StoredInfoType` API.
+ "wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.
+ "words": [ # Words or phrases defining the dictionary. The dictionary must contain
+ # at least one phrase and every phrase must contain at least 2 characters
+ # that are letters or digits. [required]
+ "A String",
+ ],
+ },
+ "cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file
+ # is accepted.
+ "path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.
+ # Example: gs://[BUCKET_NAME]/dictionary.txt
+ },
+ },
+ "storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in
+ # `InspectDataSource`. Not currently supported in `InspectContent`.
+ "name": "A String", # Resource name of the requested `StoredInfoType`, for example
+ # `organizations/433245324/storedInfoTypes/432452342` or
+ # `projects/project-id/storedInfoTypes/432452342`.
+ "createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for
+ # inspection was created. Output-only field, populated by the system.
+ },
+ },
+ ],
"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is
# included in the response; see Finding.quote.
"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.
@@ -332,168 +490,634 @@
# When set within `InspectContentRequest`, the maximum returned is 2000
# regardless if this is set higher.
},
- "contentOptions": [ # List of options defining data content to scan.
- # If empty, text, images, and other content will be included.
- "A String",
- ],
- "infoTypes": [ # Restricts what info_types to look for. The values must correspond to
- # InfoType values returned by ListInfoTypes or listed at
- # https://cloud.google.com/dlp/docs/infotypes-reference.
- #
- # When no InfoTypes or CustomInfoTypes are specified in a request, the
- # system may automatically choose what detectors to run. By default this may
- # be all types, but may change over time as detectors are updated.
- #
- # If you need precise control and predictability as to what detectors are
- # run you should specify specific InfoTypes listed in the reference,
- # otherwise a default list will be used, which may change over time.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
- "minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is
- # POSSIBLE.
- # See https://cloud.google.com/dlp/docs/likelihood to learn more.
- "excludeInfoTypes": True or False, # When true, excludes type information of the findings.
- "customInfoTypes": [ # CustomInfoTypes provided by the user. See
- # https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
- { # Custom information type provided by the user. Used to find domain-specific
- # sensitive information configurable to the data in question.
- "likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be
- # altered by a detection rule if the finding meets the criteria specified by
- # the rule. Defaults to `VERY_LIKELY` if not specified.
- "infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in
- # infoType, when the name matches one of existing infoTypes and that infoType
- # is specified in `InspectContent.info_types` field. Specifying the latter
- # adds findings to the one detected by the system. If built-in info type is
- # not specified in `InspectContent.info_types` list then the name is treated
- # as a custom info type.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.
- "groupIndexes": [ # The index of the submatch to extract as findings. When not
- # specified, the entire match is returned. No more than 3 may be included.
- 42,
- ],
- "pattern": "A String", # Pattern defining the regular expression. Its syntax
- # (https://github.com/google/re2/wiki/Syntax) can be found under the
- # google/re2 repository on GitHub.
- },
- "detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.
- # Rules are applied in order that they are specified. Not supported for the
- # `surrogate_type` CustomInfoType.
- { # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a
- # `CustomInfoType` to alter behavior under certain circumstances, depending
- # on the specific details of the rule. Not supported for the `surrogate_type`
- # custom infoType.
- "hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.
- # proximity of hotwords.
- "likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.
- # part of a detection rule.
- "relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of
- # levels. For example, if a finding would be `POSSIBLE` without the
- # detection rule and `relative_likelihood` is 1, then it is upgraded to
- # `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.
- # Likelihood may never drop below `VERY_UNLIKELY` or exceed
- # `VERY_LIKELY`, so applying an adjustment of 1 followed by an
- # adjustment of -1 when base likelihood is `VERY_LIKELY` will result in
- # a final likelihood of `LIKELY`.
- "fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.
- },
- "hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.
- "groupIndexes": [ # The index of the submatch to extract as findings. When not
- # specified, the entire match is returned. No more than 3 may be included.
- 42,
- ],
- "pattern": "A String", # Pattern defining the regular expression. Its syntax
- # (https://github.com/google/re2/wiki/Syntax) can be found under the
- # google/re2 repository on GitHub.
- },
- "proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.
- # The total length of the window cannot exceed 1000 characters. Note that
- # the finding itself will be included in the window, so that hotwords may
- # be used to match substrings of the finding itself. For example, the
- # certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be
- # adjusted upwards if the area code is known to be the local area code of
- # a company office using the hotword regex "\(xxx\)", where "xxx"
- # is the area code in question.
- # rule.
- "windowBefore": 42, # Number of characters before the finding to consider.
- "windowAfter": 42, # Number of characters after the finding to consider.
- },
- },
- },
- ],
- "exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding
- # to be returned. It still can be used for rules matching.
- "dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.
- # be used to match sensitive information specific to the data, such as a list
- # of employee IDs or job titles.
- #
- # Dictionary words are case-insensitive and all characters other than letters
- # and digits in the unicode [Basic Multilingual
- # Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)
- # will be replaced with whitespace when scanning for matches, so the
- # dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",
- # "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters
- # surrounding any match must be of a different type than the adjacent
- # characters within the word, so letters must be next to non-letters and
- # digits next to non-digits. For example, the dictionary word "jen" will
- # match the first three letters of the text "jen123" but will return no
- # matches for "jennifer".
- #
- # Dictionary words containing a large number of characters that are not
- # letters or digits may result in unexpected findings because such characters
- # are treated as whitespace. The
- # [limits](https://cloud.google.com/dlp/limits) page contains details about
- # the size limits of dictionaries. For dictionaries that do not fit within
- # these constraints, consider using `LargeCustomDictionaryConfig` in the
- # `StoredInfoType` API.
- "wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.
- "words": [ # Words or phrases defining the dictionary. The dictionary must contain
- # at least one phrase and every phrase must contain at least 2 characters
- # that are letters or digits. [required]
- "A String",
- ],
- },
- "cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file
- # is accepted.
- "path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.
- # Example: gs://[BUCKET_NAME]/dictionary.txt
- },
- },
- "storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in
- # `InspectDataSource`. Not currently supported in `InspectContent`.
- "name": "A String", # Resource name of the requested `StoredInfoType`, for example
- # `organizations/433245324/storedInfoTypes/432452342` or
- # `projects/project-id/storedInfoTypes/432452342`.
- "createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for
- # inspection was created. Output-only field, populated by the system.
- },
- "surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that
- # support reversing.
- # such as
- # [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).
- # These types of transformations are
- # those that perform pseudonymization, thereby producing a "surrogate" as
- # output. This should be used in conjunction with a field on the
- # transformation such as `surrogate_info_type`. This CustomInfoType does
- # not support the use of `detection_rules`.
- },
- },
- ],
},
"deidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the de-identification of the content item.
# Items specified here will override the template referenced by the
# deidentify_template_name argument.
+ "infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text
+ # transformation everywhere.
+ # apply various `PrimitiveTransformation`s to each finding, where the
+ # transformation is applied to only values that were identified as a specific
+ # info_type.
+ "transformations": [ # Required. Transformation for each infoType. Cannot specify more than one
+ # for a given infoType.
+ { # A transformation to apply to text that is identified as a specific
+ # info_type.
+ "primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
+ "timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
+ # portion of the value.
+ "partToExtract": "A String", # The part of the time to keep.
+ },
+ "dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift
+ # same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting
+ # to learn more.
+ "context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.
+ # If set, must also set cryptoKey. If set, shift will be consistent for the
+ # given context.
+ "name": "A String", # Name describing the field.
+ },
+ "upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this
+ # range (inclusive ends). Negative means shift to earlier in time. Must not
+ # be more than 365250 days (1000 years) each direction.
+ #
+ # For example, 3 means shift date to at most 3 days into the future.
+ "lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This
+ # results in the same shift for the same context and crypto_key. If
+ # set, must also set context. Can only be applied to table items.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ },
+ "replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
+ },
+ "cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto
+ # Uses SHA-256.
+ # The key size must be either 32 or 64 bytes.
+ # Outputs a base64 encoded representation of the hashed output
+ # (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
+ # Currently, only string and integer values can be hashed.
+ # See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ },
+ "cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
+ # (FPE) with the FFX mode of operation; however when used in the
+ # `ReidentifyContent` API method, it serves the opposite function by reversing
+ # the surrogate back into the original identifier. The identifier must be
+ # encoded as ASCII. For a given crypto key and context, the same identifier
+ # will be replaced with the same surrogate. Identifiers must be at least two
+ # characters long. In the case that the identifier is the empty string, it will
+ # be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn
+ # more.
+ #
+ # Note: We recommend using CryptoDeterministicConfig for all use cases which
+ # do not require preserving the input alphabet space and size, plus warrant
+ # referential integrity.
+ "surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
+ # This annotation will be applied to the surrogate by prefixing it with
+ # the name of the custom infoType followed by the number of
+ # characters comprising the surrogate. The following scheme defines the
+ # format: info_type_name(surrogate_character_count):surrogate
+ #
+ # For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and
+ # the surrogate is 'abc', the full replacement value
+ # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
+ #
+ # This annotation identifies the surrogate when inspecting content using the
+ # custom infoType
+ # [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).
+ # This facilitates reversal of the surrogate when it occurs in free text.
+ #
+ # In order for inspection to work properly, the name of this infoType must
+ # not occur naturally anywhere in your data; otherwise, inspection may
+ # find a surrogate that does not correspond to an actual identifier.
+ # Therefore, choose your custom infoType name carefully after considering
+ # what your data looks like. One way to select a name that has a high chance
+ # of yielding reliable detection is to include one or more unicode characters
+ # that are highly improbable to exist in your data.
+ # For example, assuming your data is entered from a regular ASCII keyboard,
+ # the symbol with the hex code point 29DD might be used like so:
+ # ⧝MY_TOKEN_TYPE
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same
+ # identifier in two different contexts won't be given the same surrogate. If
+ # the context is not set, a default tweak will be used.
+ #
+ # If the context is set but:
+ #
+ # 1. there is no record present when transforming a given value or
+ # 1. the field is not present when transforming a given value,
+ #
+ # a default tweak will be used.
+ #
+ # Note that case (1) is expected when an `InfoTypeTransformation` is
+ # applied to both structured and non-structured `ContentItem`s.
+ # Currently, the referenced field may be of value type integer or string.
+ #
+ # The tweak is constructed as a sequence of bytes in big endian byte order
+ # such that:
+ #
+ # - a 64 bit integer is encoded followed by a single byte of value 1
+ # - a string is encoded in UTF-8 format followed by a single byte of value 2
+ "name": "A String", # Name describing the field.
+ },
+ "radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
+ },
+ "cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
+ # input. Outputs a base64 encoded representation of the encrypted output.
+ # Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
+ "surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.
+ # This annotation will be applied to the surrogate by prefixing it with
+ # the name of the custom info type followed by the number of
+ # characters comprising the surrogate. The following scheme defines the
+ # format: {info type name}({surrogate character count}):{surrogate}
+ #
+ # For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and
+ # the surrogate is 'abc', the full replacement value
+ # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
+ #
+ # This annotation identifies the surrogate when inspecting content using the
+ # custom info type 'Surrogate'. This facilitates reversal of the
+ # surrogate when it occurs in free text.
+ #
+ # Note: For record transformations where the entire cell in a table is being
+ # transformed, surrogates are not mandatory. Surrogates are used to denote
+ # the location of the token and are necessary for re-identification in free
+ # form text.
+ #
+ # In order for inspection to work properly, the name of this info type must
+ # not occur naturally anywhere in your data; otherwise, inspection may either
+ #
+ # - reverse a surrogate that does not correspond to an actual identifier
+ # - be unable to parse the surrogate and result in an error
+ #
+ # Therefore, choose your custom info type name carefully after considering
+ # what your data looks like. One way to select a name that has a high chance
+ # of yielding reliable detection is to include one or more unicode characters
+ # that are highly improbable to exist in your data.
+ # For example, assuming your data is entered from a regular ASCII keyboard,
+ # the symbol with the hex code point 29DD might be used like so:
+ # ⧝MY_TOKEN_TYPE.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining
+ # referential integrity such that the same identifier in two different
+ # contexts will be given a distinct surrogate. The context is appended to
+ # plaintext value being encrypted. On decryption the provided context is
+ # validated against the value used during encryption. If a context was
+ # provided during encryption, same context must be provided during decryption
+ # as well.
+ #
+ # If the context is not set, plaintext would be used as is for encryption.
+ # If the context is set but:
+ #
+ # 1. there is no record present when transforming a given value or
+ # 2. the field is not present when transforming a given value,
+ #
+ # plaintext would be used as is for encryption.
+ #
+ # Note that case (1) is expected when an `InfoTypeTransformation` is
+ # applied to both structured and non-structured `ContentItem`s.
+ "name": "A String", # Name describing the field.
+ },
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ },
+ "bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
+ # replacement values are dynamically provided by the user for custom behavior,
+ # such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
+ # This can be used on
+ # data of type: number, long, string, timestamp.
+ # If the bound `Value` type differs from the type of data being transformed, we
+ # will first attempt converting the type of the data to be transformed to match
+ # the type of the bound before comparing.
+ # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
+ "buckets": [ # Set of buckets. Ranges must be non-overlapping.
+ { # Bucket is represented as a range, along with replacement values.
+ "replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
+ # the default behavior will be to hyphenate the min-max range.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ ],
+ },
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
+ "replaceConfig": { # Replace each input value with a given `Value`. # Replace
+ "newValue": { # Set of primitive values supported by the system. # Value to replace it with.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
+ # Bucketing transformation can provide all of this functionality,
+ # but requires more configuration. This message is provided as a convenience to
+ # the user for simple bucketing strategies.
+ #
+ # The transformed value will be a hyphenated string of
+ # {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20
+ # all values that are within this bucket will be replaced with "10-20".
+ #
+ # This can be used on data of type: double, long.
+ #
+ # If the bound Value type differs from the type of data
+ # being transformed, we will first attempt converting the type of the data to
+ # be transformed to match the type of the bound before comparing.
+ #
+ # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
+ "upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
+ # grouped together into a single bucket; for example if `upper_bound` = 89,
+ # then all values greater than 89 are replaced with the value "89+".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
+ # `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
+ # following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
+ # 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
+ },
+ },
+ "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
+ # this transformation to apply to all findings that correspond to
+ # infoTypes that were requested in `InspectConfig`.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
+ },
+ ],
+ },
"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default
# mode is `TransformationErrorHandling.ThrowError`.
# transformation error occurs when the requested transformation is incompatible
@@ -515,89 +1139,6 @@
# specific locations within structured datasets, such as transforming
# a column within a table.
# table.
- "recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that
- # match any suppression rule are omitted from the output.
- { # Configuration to suppress records whose suppression conditions evaluate to
- # true.
- "condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being
- # evaluated to be suppressed from the transformed content.
- # a field.
- "expressions": { # An expression, consisting or an operator and conditions. # An expression.
- "logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently
- # only supported value is `AND`.
- "conditions": { # A collection of conditions. # Conditions to apply to the expression.
- "conditions": [ # A collection of conditions.
- { # The field type of `value` and `field` do not need to match to be
- # considered equal, but not all comparisons are possible.
- # EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,
- # but all other comparisons are invalid with incompatible types.
- # A `value` of type:
- #
- # - `string` can be compared against all other types
- # - `boolean` can only be compared against other booleans
- # - `integer` can be compared against doubles or a string if the string value
- # can be parsed as an integer.
- # - `double` can be compared against integers or a string if the string can
- # be parsed as a double.
- # - `Timestamp` can be compared against strings in RFC 3339 date string
- # format.
- # - `TimeOfDay` can be compared against timestamps and strings in the format
- # of 'HH:mm:ss'.
- #
- # If we fail to compare do to type mismatch, a warning will be given and
- # the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
- "value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- },
- ],
- },
- },
- },
- },
- ],
"fieldTransformations": [ # Transform the record by applying various field transformations.
{ # The transformation to apply to the field.
"fields": [ # Required. Input field(s) to apply the transformation to.
@@ -614,17 +1155,6 @@
# for a given infoType.
{ # A transformation to apply to text that is identified as a specific
# info_type.
- "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
- # this transformation to apply to all findings that correspond to
- # infoTypes that were requested in `InspectConfig`.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
# portion of the value.
@@ -651,14 +1181,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -672,6 +1194,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -688,14 +1218,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -709,6 +1231,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -724,14 +1254,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -791,14 +1313,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -812,7 +1326,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -880,14 +1410,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -901,12 +1423,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -918,89 +1444,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -1008,9 +1451,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1035,17 +1475,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -1053,9 +1583,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1080,44 +1607,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -1134,49 +1635,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -1185,9 +1643,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1212,20 +1667,106 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
+ "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
+ # this transformation to apply to all findings that correspond to
+ # infoTypes that were requested in `InspectConfig`.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
},
],
},
@@ -1255,14 +1796,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -1276,6 +1809,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -1292,14 +1833,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -1313,6 +1846,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -1328,14 +1869,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -1395,14 +1928,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -1416,7 +1941,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -1484,14 +2025,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -1505,12 +2038,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -1522,89 +2059,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -1612,9 +2066,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1639,17 +2090,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -1657,9 +2198,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1684,44 +2222,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -1738,49 +2250,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -1789,9 +2258,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1816,18 +2282,93 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the
@@ -1864,19 +2405,12 @@
#
# If we fail to compare do to type mismatch, a warning will be given and
# the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
# Note that for the purposes of inspection or transformation, the number
# of bytes considered to comprise a 'Value' is based on its representation
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -1901,14 +2435,21 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
],
},
@@ -1916,627 +2457,86 @@
},
},
],
- },
- "infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text
- # transformation everywhere.
- # apply various `PrimitiveTransformation`s to each finding, where the
- # transformation is applied to only values that were identified as a specific
- # info_type.
- "transformations": [ # Required. Transformation for each infoType. Cannot specify more than one
- # for a given infoType.
- { # A transformation to apply to text that is identified as a specific
- # info_type.
- "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
- # this transformation to apply to all findings that correspond to
- # infoTypes that were requested in `InspectConfig`.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
- "primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
- "timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
- # portion of the value.
- "partToExtract": "A String", # The part of the time to keep.
- },
- "dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift
- # same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting
- # to learn more.
- "context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.
- # If set, must also set cryptoKey. If set, shift will be consistent for the
- # given context.
- "name": "A String", # Name describing the field.
- },
- "upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this
- # range (inclusive ends). Negative means shift to earlier in time. Must not
- # be more than 365250 days (1000 years) each direction.
- #
- # For example, 3 means shift date to at most 3 days into the future.
- "lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This
- # results in the same shift for the same context and crypto_key. If
- # set, must also set context. Can only be applied to table items.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
- },
- "cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto
- # Uses SHA-256.
- # The key size must be either 32 or 64 bytes.
- # Outputs a base64 encoded representation of the hashed output
- # (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
- # Currently, only string and integer values can be hashed.
- # See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
- # (FPE) with the FFX mode of operation; however when used in the
- # `ReidentifyContent` API method, it serves the opposite function by reversing
- # the surrogate back into the original identifier. The identifier must be
- # encoded as ASCII. For a given crypto key and context, the same identifier
- # will be replaced with the same surrogate. Identifiers must be at least two
- # characters long. In the case that the identifier is the empty string, it will
- # be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn
- # more.
- #
- # Note: We recommend using CryptoDeterministicConfig for all use cases which
- # do not require preserving the input alphabet space and size, plus warrant
- # referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
- "surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
- # This annotation will be applied to the surrogate by prefixing it with
- # the name of the custom infoType followed by the number of
- # characters comprising the surrogate. The following scheme defines the
- # format: info_type_name(surrogate_character_count):surrogate
- #
- # For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and
- # the surrogate is 'abc', the full replacement value
- # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
- #
- # This annotation identifies the surrogate when inspecting content using the
- # custom infoType
- # [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).
- # This facilitates reversal of the surrogate when it occurs in free text.
- #
- # In order for inspection to work properly, the name of this infoType must
- # not occur naturally anywhere in your data; otherwise, inspection may
- # find a surrogate that does not correspond to an actual identifier.
- # Therefore, choose your custom infoType name carefully after considering
- # what your data looks like. One way to select a name that has a high chance
- # of yielding reliable detection is to include one or more unicode characters
- # that are highly improbable to exist in your data.
- # For example, assuming your data is entered from a regular ASCII keyboard,
- # the symbol with the hex code point 29DD might be used like so:
- # ⧝MY_TOKEN_TYPE
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same
- # identifier in two different contexts won't be given the same surrogate. If
- # the context is not set, a default tweak will be used.
- #
- # If the context is set but:
- #
- # 1. there is no record present when transforming a given value or
- # 1. the field is not present when transforming a given value,
- #
- # a default tweak will be used.
- #
- # Note that case (1) is expected when an `InfoTypeTransformation` is
- # applied to both structured and non-structured `ContentItem`s.
- # Currently, the referenced field may be of value type integer or string.
- #
- # The tweak is constructed as a sequence of bytes in big endian byte order
- # such that:
- #
- # - a 64 bit integer is encoded followed by a single byte of value 1
- # - a string is encoded in UTF-8 format followed by a single byte of value 2
- "name": "A String", # Name describing the field.
- },
- "radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
- # input. Outputs a base64 encoded representation of the encrypted output.
- # Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
- "surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.
- # This annotation will be applied to the surrogate by prefixing it with
- # the name of the custom info type followed by the number of
- # characters comprising the surrogate. The following scheme defines the
- # format: {info type name}({surrogate character count}):{surrogate}
- #
- # For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and
- # the surrogate is 'abc', the full replacement value
- # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
- #
- # This annotation identifies the surrogate when inspecting content using the
- # custom info type 'Surrogate'. This facilitates reversal of the
- # surrogate when it occurs in free text.
- #
- # Note: For record transformations where the entire cell in a table is being
- # transformed, surrogates are not mandatory. Surrogates are used to denote
- # the location of the token and are necessary for re-identification in free
- # form text.
- #
- # In order for inspection to work properly, the name of this info type must
- # not occur naturally anywhere in your data; otherwise, inspection may either
- #
- # - reverse a surrogate that does not correspond to an actual identifier
- # - be unable to parse the surrogate and result in an error
- #
- # Therefore, choose your custom info type name carefully after considering
- # what your data looks like. One way to select a name that has a high chance
- # of yielding reliable detection is to include one or more unicode characters
- # that are highly improbable to exist in your data.
- # For example, assuming your data is entered from a regular ASCII keyboard,
- # the symbol with the hex code point 29DD might be used like so:
- # ⧝MY_TOKEN_TYPE.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining
- # referential integrity such that the same identifier in two different
- # contexts will be given a distinct surrogate. The context is appended to
- # plaintext value being encrypted. On decryption the provided context is
- # validated against the value used during encryption. If a context was
- # provided during encryption, same context must be provided during decryption
- # as well.
- #
- # If the context is not set, plaintext would be used as is for encryption.
- # If the context is set but:
- #
- # 1. there is no record present when transforming a given value or
- # 2. the field is not present when transforming a given value,
- #
- # plaintext would be used as is for encryption.
- #
- # Note that case (1) is expected when an `InfoTypeTransformation` is
- # applied to both structured and non-structured `ContentItem`s.
- "name": "A String", # Name describing the field.
- },
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
- "bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
- # replacement values are dynamically provided by the user for custom behavior,
- # such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
- # This can be used on
- # data of type: number, long, string, timestamp.
- # If the bound `Value` type differs from the type of data being transformed, we
- # will first attempt converting the type of the data to be transformed to match
- # the type of the bound before comparing.
- # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "buckets": [ # Set of buckets. Ranges must be non-overlapping.
- { # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
+ "recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that
+ # match any suppression rule are omitted from the output.
+ { # Configuration to suppress records whose suppression conditions evaluate to
+ # true.
+ "condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being
+ # evaluated to be suppressed from the transformed content.
+ # a field.
+ "expressions": { # An expression, consisting or an operator and conditions. # An expression.
+ "logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently
+ # only supported value is `AND`.
+ "conditions": { # A collection of conditions. # Conditions to apply to the expression.
+ "conditions": [ # A collection of conditions.
+ { # The field type of `value` and `field` do not need to match to be
+ # considered equal, but not all comparisons are possible.
+ # EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,
+ # but all other comparisons are invalid with incompatible types.
+ # A `value` of type:
+ #
+ # - `string` can be compared against all other types
+ # - `boolean` can only be compared against other booleans
+ # - `integer` can be compared against doubles or a string if the string value
+ # can be parsed as an integer.
+ # - `double` can be compared against integers or a string if the string can
+ # be parsed as a double.
+ # - `Timestamp` can be compared against strings in RFC 3339 date string
+ # format.
+ # - `TimeOfDay` can be compared against timestamps and strings in the format
+ # of 'HH:mm:ss'.
+ #
+ # If we fail to compare do to type mismatch, a warning will be given and
+ # the condition will evaluate to false.
+ "value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
},
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
- # the default behavior will be to hyphenate the min-max range.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- },
- ],
- },
- "replaceConfig": { # Replace each input value with a given `Value`. # Replace
- "newValue": { # Set of primitive values supported by the system. # Value to replace it with.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
+ ],
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
- "fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
- # Bucketing transformation can provide all of this functionality,
- # but requires more configuration. This message is provided as a convenience to
- # the user for simple bucketing strategies.
- #
- # The transformed value will be a hyphenated string of
- # {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20
- # all values that are within this bucket will be replaced with "10-20".
- #
- # This can be used on data of type: double, long.
- #
- # If the bound Value type differs from the type of data
- # being transformed, we will first attempt converting the type of the data to
- # be transformed to match the type of the bound before comparing.
- #
- # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
- # grouped together into a single bucket; for example if `upper_bound` = 89,
- # then all values greater than 89 are replaced with the value "89+".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
- # `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
- # following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
- # 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
- },
},
},
],
@@ -2555,71 +2555,6 @@
An object of the form:
{ # Results of de-identifying a ContentItem.
- "item": { # Container structure for the content to inspect. # The de-identified item.
- "byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
- "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
- "data": "A String", # Content data to inspect or redact.
- },
- "value": "A String", # String data to inspect or redact.
- "table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
- # https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
- # learn more.
- # See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
- # learn more.
- "rows": [ # Rows of the table.
- { # Values of the row.
- "values": [ # Individual cells.
- { # Set of primitive values supported by the system.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- ],
- },
- ],
- "headers": [ # Headers of the table.
- { # General identifier of a data field in a storage service.
- "name": "A String", # Name describing the field.
- },
- ],
- },
- },
"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made on the `item`.
"transformationSummaries": [ # Transformations applied to the dataset.
{ # Summary of a single transformation.
@@ -2643,17 +2578,6 @@
# for a given infoType.
{ # A transformation to apply to text that is identified as a specific
# info_type.
- "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
- # this transformation to apply to all findings that correspond to
- # infoTypes that were requested in `InspectConfig`.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
# portion of the value.
@@ -2680,14 +2604,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -2701,6 +2617,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -2717,14 +2641,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -2738,6 +2654,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -2753,14 +2677,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -2820,14 +2736,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -2841,7 +2749,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -2909,14 +2833,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -2930,12 +2846,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -2947,89 +2867,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -3037,9 +2874,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3064,17 +2898,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -3082,9 +3006,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3109,44 +3030,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -3163,49 +3058,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -3214,9 +3066,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3241,20 +3090,106 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
+ "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
+ # this transformation to apply to all findings that correspond to
+ # infoTypes that were requested in `InspectConfig`.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
},
],
},
@@ -3284,14 +3219,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -3305,6 +3232,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -3321,14 +3256,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -3342,6 +3269,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -3357,14 +3292,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -3424,14 +3351,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -3445,7 +3364,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -3513,14 +3448,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -3534,12 +3461,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -3551,89 +3482,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -3641,9 +3489,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3668,17 +3513,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -3686,9 +3621,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3713,44 +3645,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -3767,49 +3673,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -3818,9 +3681,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3845,18 +3705,93 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the
@@ -3893,19 +3828,12 @@
#
# If we fail to compare do to type mismatch, a warning will be given and
# the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
# Note that for the purposes of inspection or transformation, the number
# of bytes considered to comprise a 'Value' is based on its representation
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -3930,14 +3858,21 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
],
},
@@ -3945,9 +3880,6 @@
},
},
],
- "field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.
- "name": "A String", # Name describing the field.
- },
"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.
"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
# portion of the value.
@@ -3974,14 +3906,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -3995,6 +3919,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -4011,14 +3943,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -4032,6 +3956,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -4047,14 +3979,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -4114,14 +4038,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -4135,7 +4051,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -4203,14 +4135,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -4224,12 +4148,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -4241,89 +4169,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -4331,9 +4176,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -4358,17 +4200,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -4376,9 +4308,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -4403,44 +4332,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -4457,49 +4360,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -4508,9 +4368,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -4535,19 +4392,97 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
},
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
+ },
+ },
+ "field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.
+ "name": "A String", # Name describing the field.
},
"transformedBytes": "A String", # Total size in bytes that were transformed in some way.
"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.
@@ -4579,19 +4514,12 @@
#
# If we fail to compare do to type mismatch, a warning will be given and
# the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
# Note that for the purposes of inspection or transformation, the number
# of bytes considered to comprise a 'Value' is based on its representation
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -4616,14 +4544,21 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
],
},
@@ -4640,41 +4575,20 @@
"results": [ # Collection of all transformations that took place or had an error.
{ # A collection that informs the user the number of times a particular
# `TransformationResultCode` and error details occurred.
- "code": "A String", # Outcome of the transformation.
- "count": "A String", # Number of transformations counted by this result.
"details": "A String", # A place for warnings or errors to show up if a transformation didn't
# work as expected.
+ "code": "A String", # Outcome of the transformation.
+ "count": "A String", # Number of transformations counted by this result.
},
],
},
],
"transformedBytes": "A String", # Total size in bytes that were transformed in some way.
},
- }</pre>
-</div>
-
-<div class="method">
- <code class="details" id="inspect">inspect(parent, body=None, x__xgafv=None)</code>
- <pre>Finds potentially sensitive info in content.
-This method has limits on input size, processing time, and output size.
-
-When no InfoTypes or CustomInfoTypes are specified in this request, the
-system will automatically choose what detectors to run. By default this may
-be all types, but may change over time as detectors are updated.
-
-For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images
-and https://cloud.google.com/dlp/docs/inspecting-text,
-
-Args:
- parent: string, The parent resource name, for example projects/my-project-id. (required)
- body: object, The request body.
- The object takes the form of:
-
-{ # Request to search for potentially sensitive info in a ContentItem.
- "item": { # Container structure for the content to inspect. # The item to inspect.
+ "item": { # Container structure for the content to inspect. # The de-identified item.
"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
- "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
"data": "A String", # Content data to inspect or redact.
+ "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
},
"value": "A String", # String data to inspect or redact.
"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
@@ -4691,9 +4605,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -4718,13 +4629,102 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ ],
+ },
+ ],
+ "headers": [ # Headers of the table.
+ { # General identifier of a data field in a storage service.
+ "name": "A String", # Name describing the field.
+ },
+ ],
+ },
+ },
+ }</pre>
+</div>
+
+<div class="method">
+ <code class="details" id="inspect">inspect(parent, body=None, x__xgafv=None)</code>
+ <pre>Finds potentially sensitive info in content.
+This method has limits on input size, processing time, and output size.
+
+When no InfoTypes or CustomInfoTypes are specified in this request, the
+system will automatically choose what detectors to run. By default this may
+be all types, but may change over time as detectors are updated.
+
+For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images
+and https://cloud.google.com/dlp/docs/inspecting-text,
+
+Args:
+ parent: string, The parent resource name, for example projects/my-project-id. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request to search for potentially sensitive info in a ContentItem.
+ "item": { # Container structure for the content to inspect. # The item to inspect.
+ "byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
+ "data": "A String", # Content data to inspect or redact.
+ "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
+ },
+ "value": "A String", # String data to inspect or redact.
+ "table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
+ # https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
+ # learn more.
+ # See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
+ # learn more.
+ "rows": [ # Rows of the table.
+ { # Values of the row.
+ "values": [ # Individual cells.
+ { # Set of primitive values supported by the system.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
],
},
@@ -4745,6 +4745,164 @@
# the template referenced by the inspect_template_name argument.
# When used with redactContent only info_types and min_likelihood are currently
# used.
+ "minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is
+ # POSSIBLE.
+ # See https://cloud.google.com/dlp/docs/likelihood to learn more.
+ "contentOptions": [ # List of options defining data content to scan.
+ # If empty, text, images, and other content will be included.
+ "A String",
+ ],
+ "infoTypes": [ # Restricts what info_types to look for. The values must correspond to
+ # InfoType values returned by ListInfoTypes or listed at
+ # https://cloud.google.com/dlp/docs/infotypes-reference.
+ #
+ # When no InfoTypes or CustomInfoTypes are specified in a request, the
+ # system may automatically choose what detectors to run. By default this may
+ # be all types, but may change over time as detectors are updated.
+ #
+ # If you need precise control and predictability as to what detectors are
+ # run you should specify specific InfoTypes listed in the reference,
+ # otherwise a default list will be used, which may change over time.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
+ "excludeInfoTypes": True or False, # When true, excludes type information of the findings.
+ "customInfoTypes": [ # CustomInfoTypes provided by the user. See
+ # https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
+ { # Custom information type provided by the user. Used to find domain-specific
+ # sensitive information configurable to the data in question.
+ "surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that
+ # support reversing.
+ # such as
+ # [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).
+ # These types of transformations are
+ # those that perform pseudonymization, thereby producing a "surrogate" as
+ # output. This should be used in conjunction with a field on the
+ # transformation such as `surrogate_info_type`. This CustomInfoType does
+ # not support the use of `detection_rules`.
+ },
+ "likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be
+ # altered by a detection rule if the finding meets the criteria specified by
+ # the rule. Defaults to `VERY_LIKELY` if not specified.
+ "infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in
+ # infoType, when the name matches one of existing infoTypes and that infoType
+ # is specified in `InspectContent.info_types` field. Specifying the latter
+ # adds findings to the one detected by the system. If built-in info type is
+ # not specified in `InspectContent.info_types` list then the name is treated
+ # as a custom info type.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.
+ "groupIndexes": [ # The index of the submatch to extract as findings. When not
+ # specified, the entire match is returned. No more than 3 may be included.
+ 42,
+ ],
+ "pattern": "A String", # Pattern defining the regular expression. Its syntax
+ # (https://github.com/google/re2/wiki/Syntax) can be found under the
+ # google/re2 repository on GitHub.
+ },
+ "detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.
+ # Rules are applied in order that they are specified. Not supported for the
+ # `surrogate_type` CustomInfoType.
+ { # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a
+ # `CustomInfoType` to alter behavior under certain circumstances, depending
+ # on the specific details of the rule. Not supported for the `surrogate_type`
+ # custom infoType.
+ "hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.
+ # proximity of hotwords.
+ "likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.
+ # part of a detection rule.
+ "relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of
+ # levels. For example, if a finding would be `POSSIBLE` without the
+ # detection rule and `relative_likelihood` is 1, then it is upgraded to
+ # `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.
+ # Likelihood may never drop below `VERY_UNLIKELY` or exceed
+ # `VERY_LIKELY`, so applying an adjustment of 1 followed by an
+ # adjustment of -1 when base likelihood is `VERY_LIKELY` will result in
+ # a final likelihood of `LIKELY`.
+ "fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.
+ },
+ "hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.
+ "groupIndexes": [ # The index of the submatch to extract as findings. When not
+ # specified, the entire match is returned. No more than 3 may be included.
+ 42,
+ ],
+ "pattern": "A String", # Pattern defining the regular expression. Its syntax
+ # (https://github.com/google/re2/wiki/Syntax) can be found under the
+ # google/re2 repository on GitHub.
+ },
+ "proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.
+ # The total length of the window cannot exceed 1000 characters. Note that
+ # the finding itself will be included in the window, so that hotwords may
+ # be used to match substrings of the finding itself. For example, the
+ # certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be
+ # adjusted upwards if the area code is known to be the local area code of
+ # a company office using the hotword regex "\(xxx\)", where "xxx"
+ # is the area code in question.
+ # rule.
+ "windowBefore": 42, # Number of characters before the finding to consider.
+ "windowAfter": 42, # Number of characters after the finding to consider.
+ },
+ },
+ },
+ ],
+ "exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding
+ # to be returned. It still can be used for rules matching.
+ "dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.
+ # be used to match sensitive information specific to the data, such as a list
+ # of employee IDs or job titles.
+ #
+ # Dictionary words are case-insensitive and all characters other than letters
+ # and digits in the unicode [Basic Multilingual
+ # Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)
+ # will be replaced with whitespace when scanning for matches, so the
+ # dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",
+ # "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters
+ # surrounding any match must be of a different type than the adjacent
+ # characters within the word, so letters must be next to non-letters and
+ # digits next to non-digits. For example, the dictionary word "jen" will
+ # match the first three letters of the text "jen123" but will return no
+ # matches for "jennifer".
+ #
+ # Dictionary words containing a large number of characters that are not
+ # letters or digits may result in unexpected findings because such characters
+ # are treated as whitespace. The
+ # [limits](https://cloud.google.com/dlp/limits) page contains details about
+ # the size limits of dictionaries. For dictionaries that do not fit within
+ # these constraints, consider using `LargeCustomDictionaryConfig` in the
+ # `StoredInfoType` API.
+ "wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.
+ "words": [ # Words or phrases defining the dictionary. The dictionary must contain
+ # at least one phrase and every phrase must contain at least 2 characters
+ # that are letters or digits. [required]
+ "A String",
+ ],
+ },
+ "cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file
+ # is accepted.
+ "path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.
+ # Example: gs://[BUCKET_NAME]/dictionary.txt
+ },
+ },
+ "storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in
+ # `InspectDataSource`. Not currently supported in `InspectContent`.
+ "name": "A String", # Resource name of the requested `StoredInfoType`, for example
+ # `organizations/433245324/storedInfoTypes/432452342` or
+ # `projects/project-id/storedInfoTypes/432452342`.
+ "createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for
+ # inspection was created. Output-only field, populated by the system.
+ },
+ },
+ ],
"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is
# included in the response; see Finding.quote.
"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.
@@ -4896,164 +5054,6 @@
# When set within `InspectContentRequest`, the maximum returned is 2000
# regardless if this is set higher.
},
- "contentOptions": [ # List of options defining data content to scan.
- # If empty, text, images, and other content will be included.
- "A String",
- ],
- "infoTypes": [ # Restricts what info_types to look for. The values must correspond to
- # InfoType values returned by ListInfoTypes or listed at
- # https://cloud.google.com/dlp/docs/infotypes-reference.
- #
- # When no InfoTypes or CustomInfoTypes are specified in a request, the
- # system may automatically choose what detectors to run. By default this may
- # be all types, but may change over time as detectors are updated.
- #
- # If you need precise control and predictability as to what detectors are
- # run you should specify specific InfoTypes listed in the reference,
- # otherwise a default list will be used, which may change over time.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
- "minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is
- # POSSIBLE.
- # See https://cloud.google.com/dlp/docs/likelihood to learn more.
- "excludeInfoTypes": True or False, # When true, excludes type information of the findings.
- "customInfoTypes": [ # CustomInfoTypes provided by the user. See
- # https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
- { # Custom information type provided by the user. Used to find domain-specific
- # sensitive information configurable to the data in question.
- "likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be
- # altered by a detection rule if the finding meets the criteria specified by
- # the rule. Defaults to `VERY_LIKELY` if not specified.
- "infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in
- # infoType, when the name matches one of existing infoTypes and that infoType
- # is specified in `InspectContent.info_types` field. Specifying the latter
- # adds findings to the one detected by the system. If built-in info type is
- # not specified in `InspectContent.info_types` list then the name is treated
- # as a custom info type.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.
- "groupIndexes": [ # The index of the submatch to extract as findings. When not
- # specified, the entire match is returned. No more than 3 may be included.
- 42,
- ],
- "pattern": "A String", # Pattern defining the regular expression. Its syntax
- # (https://github.com/google/re2/wiki/Syntax) can be found under the
- # google/re2 repository on GitHub.
- },
- "detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.
- # Rules are applied in order that they are specified. Not supported for the
- # `surrogate_type` CustomInfoType.
- { # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a
- # `CustomInfoType` to alter behavior under certain circumstances, depending
- # on the specific details of the rule. Not supported for the `surrogate_type`
- # custom infoType.
- "hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.
- # proximity of hotwords.
- "likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.
- # part of a detection rule.
- "relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of
- # levels. For example, if a finding would be `POSSIBLE` without the
- # detection rule and `relative_likelihood` is 1, then it is upgraded to
- # `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.
- # Likelihood may never drop below `VERY_UNLIKELY` or exceed
- # `VERY_LIKELY`, so applying an adjustment of 1 followed by an
- # adjustment of -1 when base likelihood is `VERY_LIKELY` will result in
- # a final likelihood of `LIKELY`.
- "fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.
- },
- "hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.
- "groupIndexes": [ # The index of the submatch to extract as findings. When not
- # specified, the entire match is returned. No more than 3 may be included.
- 42,
- ],
- "pattern": "A String", # Pattern defining the regular expression. Its syntax
- # (https://github.com/google/re2/wiki/Syntax) can be found under the
- # google/re2 repository on GitHub.
- },
- "proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.
- # The total length of the window cannot exceed 1000 characters. Note that
- # the finding itself will be included in the window, so that hotwords may
- # be used to match substrings of the finding itself. For example, the
- # certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be
- # adjusted upwards if the area code is known to be the local area code of
- # a company office using the hotword regex "\(xxx\)", where "xxx"
- # is the area code in question.
- # rule.
- "windowBefore": 42, # Number of characters before the finding to consider.
- "windowAfter": 42, # Number of characters after the finding to consider.
- },
- },
- },
- ],
- "exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding
- # to be returned. It still can be used for rules matching.
- "dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.
- # be used to match sensitive information specific to the data, such as a list
- # of employee IDs or job titles.
- #
- # Dictionary words are case-insensitive and all characters other than letters
- # and digits in the unicode [Basic Multilingual
- # Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)
- # will be replaced with whitespace when scanning for matches, so the
- # dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",
- # "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters
- # surrounding any match must be of a different type than the adjacent
- # characters within the word, so letters must be next to non-letters and
- # digits next to non-digits. For example, the dictionary word "jen" will
- # match the first three letters of the text "jen123" but will return no
- # matches for "jennifer".
- #
- # Dictionary words containing a large number of characters that are not
- # letters or digits may result in unexpected findings because such characters
- # are treated as whitespace. The
- # [limits](https://cloud.google.com/dlp/limits) page contains details about
- # the size limits of dictionaries. For dictionaries that do not fit within
- # these constraints, consider using `LargeCustomDictionaryConfig` in the
- # `StoredInfoType` API.
- "wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.
- "words": [ # Words or phrases defining the dictionary. The dictionary must contain
- # at least one phrase and every phrase must contain at least 2 characters
- # that are letters or digits. [required]
- "A String",
- ],
- },
- "cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file
- # is accepted.
- "path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.
- # Example: gs://[BUCKET_NAME]/dictionary.txt
- },
- },
- "storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in
- # `InspectDataSource`. Not currently supported in `InspectContent`.
- "name": "A String", # Resource name of the requested `StoredInfoType`, for example
- # `organizations/433245324/storedInfoTypes/432452342` or
- # `projects/project-id/storedInfoTypes/432452342`.
- "createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for
- # inspection was created. Output-only field, populated by the system.
- },
- "surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that
- # support reversing.
- # such as
- # [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).
- # These types of transformations are
- # those that perform pseudonymization, thereby producing a "surrogate" as
- # output. This should be used in conjunction with a field on the
- # transformation such as `surrogate_info_type`. This CustomInfoType does
- # not support the use of `detection_rules`.
- },
- },
- ],
},
"locationId": "A String", # The geographic location to process content inspection. Reserved for future
# extensions.
@@ -5073,9 +5073,6 @@
"result": { # All the findings for a single scanned item. # The findings.
"findings": [ # List of findings for an item.
{ # Represents a piece of potentially sensitive content.
- "resourceName": "A String", # The job that stored the finding.
- "triggerName": "A String", # Job trigger name, if applicable, for this finding.
- "jobCreateTime": "A String", # Time the job started that produced this finding.
"quoteInfo": { # Message for infoType-dependent details parsed from quote. # Contains data parsed from quotes. Only populated if include_quote was set
# to true and a supported infoType was requested. Currently supported
# infoTypes: DATE, DATE_OF_BIRTH and TIME.
@@ -5108,15 +5105,23 @@
"time": { # Represents a time of day. The date and time zone are either not significant # Time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
},
},
+ "infoType": { # Type of information detected by the API. # The type of content that might have been found.
+ # Provided if `excluded_types` is false.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
"labels": { # The labels associated with this `Finding`.
#
# Label keys must be between 1 and 63 characters long and must conform
@@ -5132,14 +5137,6 @@
# * `"pipeline" : "etl"`
"a_key": "A String",
},
- "infoType": { # Type of information detected by the API. # The type of content that might have been found.
- # Provided if `excluded_types` is false.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
"likelihood": "A String", # Confidence of how likely it is that the `info_type` is correct.
"name": "A String", # Resource name in format
# projects/{project}/locations/{location}/findings/{finding} Populated only
@@ -5161,11 +5158,6 @@
},
"container": { # Represents a container that may contain DLP findings. # Information about the container where this finding occurred, if available.
# Examples of a container include a file, table, or database record.
- "fullPath": "A String", # A string representation of the full container name.
- # Examples:
- # - BigQuery: 'Project:DataSetId.TableId'
- # - Google Cloud Storage: 'gs://Bucket/folders/filename.txt'
- "type": "A String", # Container type, for example BigQuery or Google Cloud Storage.
"updateTime": "A String", # Findings container modification timestamp, if applicable.
# For Google Cloud Storage contains last file modification timestamp.
# For BigQuery table contains last_modified_time property.
@@ -5178,19 +5170,26 @@
# is `gs://bucket`
"projectId": "A String", # Project where the finding was found.
# Can be different from the project that owns the finding.
+ "version": "A String", # Findings container version, if available
+ # ("generation" for Google Cloud Storage).
"relativePath": "A String", # The rest of the path after the root.
# Examples:
# - For BigQuery table `project_id:dataset_id.table_id`, the relative path is
# `table_id`
# - Google Cloud Storage file `gs://bucket/folder/filename.txt`, the relative
# path is `folder/filename.txt`
- "version": "A String", # Findings container version, if available
- # ("generation" for Google Cloud Storage).
+ "fullPath": "A String", # A string representation of the full container name.
+ # Examples:
+ # - BigQuery: 'Project:DataSetId.TableId'
+ # - Google Cloud Storage: 'gs://Bucket/folders/filename.txt'
+ "type": "A String", # Container type, for example BigQuery or Google Cloud Storage.
},
"contentLocations": [ # List of nested objects pointing to the precise location of the finding
# within the file or record.
{ # Precise location of the finding within a document, record, image, or metadata
# container.
+ "containerVersion": "A String", # Findings container version, if available
+ # ("generation" for Google Cloud Storage).
"containerName": "A String", # Name of the container where the finding is located.
# The top level name is the source file name or table name. Names of some
# common storage containers are formatted as follows:
@@ -5218,15 +5217,22 @@
# inside of Finding.
},
"recordKey": { # Message for a unique key indicating a record that contains a finding. # Key of the finding.
- "idValues": [ # Values of identifying columns in the given row. Order of values matches
- # the order of `identifying_fields` specified in the scanning request.
- "A String",
- ],
"datastoreKey": { # Record key for a finding in Cloud Datastore.
"entityKey": { # A unique identifier for a Datastore entity. # Datastore entity key.
# If a key's partition ID or any of its path kinds or names are
# reserved/read-only, the key is reserved/read-only.
# A reserved/read-only key is forbidden in certain documented contexts.
+ "partitionId": { # Datastore partition ID. # Entities are partitioned into subsets, currently identified by a project
+ # ID and namespace ID.
+ # Queries are scoped to a single partition.
+ # A partition ID identifies a grouping of entities. The grouping is always
+ # by project and namespace, however the namespace ID may be empty.
+ #
+ # A partition ID contains several dimensions:
+ # project ID and namespace ID.
+ "projectId": "A String", # The ID of the project to which the entities belong.
+ "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+ },
"path": [ # The entity path.
# An entity path consists of one or more elements composed of a kind and a
# string or numerical identifier, which identify entities. The first
@@ -5253,20 +5259,14 @@
# Cannot be `""`.
},
],
- "partitionId": { # Datastore partition ID. # Entities are partitioned into subsets, currently identified by a project
- # ID and namespace ID.
- # Queries are scoped to a single partition.
- # A partition ID identifies a grouping of entities. The grouping is always
- # by project and namespace, however the namespace ID may be empty.
- #
- # A partition ID contains several dimensions:
- # project ID and namespace ID.
- "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
- "projectId": "A String", # The ID of the project to which the entities belong.
- },
},
},
"bigQueryKey": { # Row key for identifying a record in BigQuery table.
+ "rowNumber": "A String", # Row number inferred at the time the table was scanned. This value is
+ # nondeterministic, cannot be queried, and may be null for inspection
+ # jobs. To locate findings within a table, specify
+ # `inspect_job.storage_config.big_query_options.identifying_fields` in
+ # `CreateDlpJobRequest`.
"tableReference": { # Message defining the location of a BigQuery table. A table is uniquely # Complete BigQuery table reference.
# identified by its project_id, dataset_id, and table_name. Within a query
# a table is often referenced with a string in the format of:
@@ -5277,12 +5277,11 @@
"datasetId": "A String", # Dataset ID of the table.
"tableId": "A String", # Name of the table.
},
- "rowNumber": "A String", # Row number inferred at the time the table was scanned. This value is
- # nondeterministic, cannot be queried, and may be null for inspection
- # jobs. To locate findings within a table, specify
- # `inspect_job.storage_config.big_query_options.identifying_fields` in
- # `CreateDlpJobRequest`.
},
+ "idValues": [ # Values of identifying columns in the given row. Order of values matches
+ # the order of `identifying_fields` specified in the scanning request.
+ "A String",
+ ],
},
},
"containerTimestamp": "A String", # Findings container modification timestamp, if applicable.
@@ -5290,10 +5289,10 @@
# For BigQuery table contains last_modified_time property.
# For Datastore - not populated.
"metadataLocation": { # Metadata Location # Location within the metadata for inspected content.
+ "type": "A String", # Type of metadata containing the finding.
"storageLabel": { # Storage metadata label to indicate which metadata entry contains findings. # Storage metadata.
"key": "A String",
},
- "type": "A String", # Type of metadata containing the finding.
},
"imageLocation": { # Location of the finding within an image. # Location within an image's pixels.
"boundingBoxes": [ # Bounding boxes locating the pixels within the image containing the finding.
@@ -5305,8 +5304,6 @@
},
],
},
- "containerVersion": "A String", # Findings container version, if available
- # ("generation" for Google Cloud Storage).
},
],
},
@@ -5317,6 +5314,9 @@
# in length, the quote may be omitted.
"createTime": "A String", # Timestamp when finding was detected.
"jobName": "A String", # The job that stored the finding.
+ "jobCreateTime": "A String", # Time the job started that produced this finding.
+ "triggerName": "A String", # Job trigger name, if applicable, for this finding.
+ "resourceName": "A String", # The job that stored the finding.
},
],
"findingsTruncated": True or False, # If true, then this item might have more findings than were returned,
@@ -5342,79 +5342,167 @@
The object takes the form of:
{ # Request to re-identify an item.
- "item": { # Container structure for the content to inspect. # The item to re-identify. Will be treated as text.
- "byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
- "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
- "data": "A String", # Content data to inspect or redact.
- },
- "value": "A String", # String data to inspect or redact.
- "table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
- # https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
- # learn more.
- # See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
- # learn more.
- "rows": [ # Rows of the table.
- { # Values of the row.
- "values": [ # Individual cells.
- { # Set of primitive values supported by the system.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- ],
- },
- ],
- "headers": [ # Headers of the table.
- { # General identifier of a data field in a storage service.
- "name": "A String", # Name describing the field.
- },
- ],
- },
- },
- "inspectTemplateName": "A String", # Template to use. Any configuration directly specified in
- # `inspect_config` will override those set in the template. Singular fields
- # that are set in this request will replace their corresponding fields in the
- # template. Repeated fields are appended. Singular sub-messages and groups
- # are recursively merged.
"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.
# When used with redactContent only info_types and min_likelihood are currently
# used.
+ "minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is
+ # POSSIBLE.
+ # See https://cloud.google.com/dlp/docs/likelihood to learn more.
+ "contentOptions": [ # List of options defining data content to scan.
+ # If empty, text, images, and other content will be included.
+ "A String",
+ ],
+ "infoTypes": [ # Restricts what info_types to look for. The values must correspond to
+ # InfoType values returned by ListInfoTypes or listed at
+ # https://cloud.google.com/dlp/docs/infotypes-reference.
+ #
+ # When no InfoTypes or CustomInfoTypes are specified in a request, the
+ # system may automatically choose what detectors to run. By default this may
+ # be all types, but may change over time as detectors are updated.
+ #
+ # If you need precise control and predictability as to what detectors are
+ # run you should specify specific InfoTypes listed in the reference,
+ # otherwise a default list will be used, which may change over time.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
+ "excludeInfoTypes": True or False, # When true, excludes type information of the findings.
+ "customInfoTypes": [ # CustomInfoTypes provided by the user. See
+ # https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
+ { # Custom information type provided by the user. Used to find domain-specific
+ # sensitive information configurable to the data in question.
+ "surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that
+ # support reversing.
+ # such as
+ # [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).
+ # These types of transformations are
+ # those that perform pseudonymization, thereby producing a "surrogate" as
+ # output. This should be used in conjunction with a field on the
+ # transformation such as `surrogate_info_type`. This CustomInfoType does
+ # not support the use of `detection_rules`.
+ },
+ "likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be
+ # altered by a detection rule if the finding meets the criteria specified by
+ # the rule. Defaults to `VERY_LIKELY` if not specified.
+ "infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in
+ # infoType, when the name matches one of existing infoTypes and that infoType
+ # is specified in `InspectContent.info_types` field. Specifying the latter
+ # adds findings to the one detected by the system. If built-in info type is
+ # not specified in `InspectContent.info_types` list then the name is treated
+ # as a custom info type.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.
+ "groupIndexes": [ # The index of the submatch to extract as findings. When not
+ # specified, the entire match is returned. No more than 3 may be included.
+ 42,
+ ],
+ "pattern": "A String", # Pattern defining the regular expression. Its syntax
+ # (https://github.com/google/re2/wiki/Syntax) can be found under the
+ # google/re2 repository on GitHub.
+ },
+ "detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.
+ # Rules are applied in order that they are specified. Not supported for the
+ # `surrogate_type` CustomInfoType.
+ { # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a
+ # `CustomInfoType` to alter behavior under certain circumstances, depending
+ # on the specific details of the rule. Not supported for the `surrogate_type`
+ # custom infoType.
+ "hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.
+ # proximity of hotwords.
+ "likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.
+ # part of a detection rule.
+ "relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of
+ # levels. For example, if a finding would be `POSSIBLE` without the
+ # detection rule and `relative_likelihood` is 1, then it is upgraded to
+ # `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.
+ # Likelihood may never drop below `VERY_UNLIKELY` or exceed
+ # `VERY_LIKELY`, so applying an adjustment of 1 followed by an
+ # adjustment of -1 when base likelihood is `VERY_LIKELY` will result in
+ # a final likelihood of `LIKELY`.
+ "fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.
+ },
+ "hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.
+ "groupIndexes": [ # The index of the submatch to extract as findings. When not
+ # specified, the entire match is returned. No more than 3 may be included.
+ 42,
+ ],
+ "pattern": "A String", # Pattern defining the regular expression. Its syntax
+ # (https://github.com/google/re2/wiki/Syntax) can be found under the
+ # google/re2 repository on GitHub.
+ },
+ "proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.
+ # The total length of the window cannot exceed 1000 characters. Note that
+ # the finding itself will be included in the window, so that hotwords may
+ # be used to match substrings of the finding itself. For example, the
+ # certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be
+ # adjusted upwards if the area code is known to be the local area code of
+ # a company office using the hotword regex "\(xxx\)", where "xxx"
+ # is the area code in question.
+ # rule.
+ "windowBefore": 42, # Number of characters before the finding to consider.
+ "windowAfter": 42, # Number of characters after the finding to consider.
+ },
+ },
+ },
+ ],
+ "exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding
+ # to be returned. It still can be used for rules matching.
+ "dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.
+ # be used to match sensitive information specific to the data, such as a list
+ # of employee IDs or job titles.
+ #
+ # Dictionary words are case-insensitive and all characters other than letters
+ # and digits in the unicode [Basic Multilingual
+ # Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)
+ # will be replaced with whitespace when scanning for matches, so the
+ # dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",
+ # "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters
+ # surrounding any match must be of a different type than the adjacent
+ # characters within the word, so letters must be next to non-letters and
+ # digits next to non-digits. For example, the dictionary word "jen" will
+ # match the first three letters of the text "jen123" but will return no
+ # matches for "jennifer".
+ #
+ # Dictionary words containing a large number of characters that are not
+ # letters or digits may result in unexpected findings because such characters
+ # are treated as whitespace. The
+ # [limits](https://cloud.google.com/dlp/limits) page contains details about
+ # the size limits of dictionaries. For dictionaries that do not fit within
+ # these constraints, consider using `LargeCustomDictionaryConfig` in the
+ # `StoredInfoType` API.
+ "wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.
+ "words": [ # Words or phrases defining the dictionary. The dictionary must contain
+ # at least one phrase and every phrase must contain at least 2 characters
+ # that are letters or digits. [required]
+ "A String",
+ ],
+ },
+ "cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file
+ # is accepted.
+ "path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.
+ # Example: gs://[BUCKET_NAME]/dictionary.txt
+ },
+ },
+ "storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in
+ # `InspectDataSource`. Not currently supported in `InspectContent`.
+ "name": "A String", # Resource name of the requested `StoredInfoType`, for example
+ # `organizations/433245324/storedInfoTypes/432452342` or
+ # `projects/project-id/storedInfoTypes/432452342`.
+ "createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for
+ # inspection was created. Output-only field, populated by the system.
+ },
+ },
+ ],
"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is
# included in the response; see Finding.quote.
"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.
@@ -5566,164 +5654,6 @@
# When set within `InspectContentRequest`, the maximum returned is 2000
# regardless if this is set higher.
},
- "contentOptions": [ # List of options defining data content to scan.
- # If empty, text, images, and other content will be included.
- "A String",
- ],
- "infoTypes": [ # Restricts what info_types to look for. The values must correspond to
- # InfoType values returned by ListInfoTypes or listed at
- # https://cloud.google.com/dlp/docs/infotypes-reference.
- #
- # When no InfoTypes or CustomInfoTypes are specified in a request, the
- # system may automatically choose what detectors to run. By default this may
- # be all types, but may change over time as detectors are updated.
- #
- # If you need precise control and predictability as to what detectors are
- # run you should specify specific InfoTypes listed in the reference,
- # otherwise a default list will be used, which may change over time.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
- "minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is
- # POSSIBLE.
- # See https://cloud.google.com/dlp/docs/likelihood to learn more.
- "excludeInfoTypes": True or False, # When true, excludes type information of the findings.
- "customInfoTypes": [ # CustomInfoTypes provided by the user. See
- # https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
- { # Custom information type provided by the user. Used to find domain-specific
- # sensitive information configurable to the data in question.
- "likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be
- # altered by a detection rule if the finding meets the criteria specified by
- # the rule. Defaults to `VERY_LIKELY` if not specified.
- "infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in
- # infoType, when the name matches one of existing infoTypes and that infoType
- # is specified in `InspectContent.info_types` field. Specifying the latter
- # adds findings to the one detected by the system. If built-in info type is
- # not specified in `InspectContent.info_types` list then the name is treated
- # as a custom info type.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.
- "groupIndexes": [ # The index of the submatch to extract as findings. When not
- # specified, the entire match is returned. No more than 3 may be included.
- 42,
- ],
- "pattern": "A String", # Pattern defining the regular expression. Its syntax
- # (https://github.com/google/re2/wiki/Syntax) can be found under the
- # google/re2 repository on GitHub.
- },
- "detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.
- # Rules are applied in order that they are specified. Not supported for the
- # `surrogate_type` CustomInfoType.
- { # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a
- # `CustomInfoType` to alter behavior under certain circumstances, depending
- # on the specific details of the rule. Not supported for the `surrogate_type`
- # custom infoType.
- "hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.
- # proximity of hotwords.
- "likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.
- # part of a detection rule.
- "relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of
- # levels. For example, if a finding would be `POSSIBLE` without the
- # detection rule and `relative_likelihood` is 1, then it is upgraded to
- # `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.
- # Likelihood may never drop below `VERY_UNLIKELY` or exceed
- # `VERY_LIKELY`, so applying an adjustment of 1 followed by an
- # adjustment of -1 when base likelihood is `VERY_LIKELY` will result in
- # a final likelihood of `LIKELY`.
- "fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.
- },
- "hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.
- "groupIndexes": [ # The index of the submatch to extract as findings. When not
- # specified, the entire match is returned. No more than 3 may be included.
- 42,
- ],
- "pattern": "A String", # Pattern defining the regular expression. Its syntax
- # (https://github.com/google/re2/wiki/Syntax) can be found under the
- # google/re2 repository on GitHub.
- },
- "proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.
- # The total length of the window cannot exceed 1000 characters. Note that
- # the finding itself will be included in the window, so that hotwords may
- # be used to match substrings of the finding itself. For example, the
- # certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be
- # adjusted upwards if the area code is known to be the local area code of
- # a company office using the hotword regex "\(xxx\)", where "xxx"
- # is the area code in question.
- # rule.
- "windowBefore": 42, # Number of characters before the finding to consider.
- "windowAfter": 42, # Number of characters after the finding to consider.
- },
- },
- },
- ],
- "exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding
- # to be returned. It still can be used for rules matching.
- "dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.
- # be used to match sensitive information specific to the data, such as a list
- # of employee IDs or job titles.
- #
- # Dictionary words are case-insensitive and all characters other than letters
- # and digits in the unicode [Basic Multilingual
- # Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)
- # will be replaced with whitespace when scanning for matches, so the
- # dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",
- # "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters
- # surrounding any match must be of a different type than the adjacent
- # characters within the word, so letters must be next to non-letters and
- # digits next to non-digits. For example, the dictionary word "jen" will
- # match the first three letters of the text "jen123" but will return no
- # matches for "jennifer".
- #
- # Dictionary words containing a large number of characters that are not
- # letters or digits may result in unexpected findings because such characters
- # are treated as whitespace. The
- # [limits](https://cloud.google.com/dlp/limits) page contains details about
- # the size limits of dictionaries. For dictionaries that do not fit within
- # these constraints, consider using `LargeCustomDictionaryConfig` in the
- # `StoredInfoType` API.
- "wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.
- "words": [ # Words or phrases defining the dictionary. The dictionary must contain
- # at least one phrase and every phrase must contain at least 2 characters
- # that are letters or digits. [required]
- "A String",
- ],
- },
- "cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file
- # is accepted.
- "path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.
- # Example: gs://[BUCKET_NAME]/dictionary.txt
- },
- },
- "storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in
- # `InspectDataSource`. Not currently supported in `InspectContent`.
- "name": "A String", # Resource name of the requested `StoredInfoType`, for example
- # `organizations/433245324/storedInfoTypes/432452342` or
- # `projects/project-id/storedInfoTypes/432452342`.
- "createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for
- # inspection was created. Output-only field, populated by the system.
- },
- "surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that
- # support reversing.
- # such as
- # [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).
- # These types of transformations are
- # those that perform pseudonymization, thereby producing a "surrogate" as
- # output. This should be used in conjunction with a field on the
- # transformation such as `surrogate_info_type`. This CustomInfoType does
- # not support the use of `detection_rules`.
- },
- },
- ],
},
"locationId": "A String", # The geographic location to process content reidentification. Reserved for
# future extensions.
@@ -5743,6 +5673,630 @@
#
# - `CryptoDeterministicConfig`
# - `CryptoReplaceFfxFpeConfig`
+ "infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text
+ # transformation everywhere.
+ # apply various `PrimitiveTransformation`s to each finding, where the
+ # transformation is applied to only values that were identified as a specific
+ # info_type.
+ "transformations": [ # Required. Transformation for each infoType. Cannot specify more than one
+ # for a given infoType.
+ { # A transformation to apply to text that is identified as a specific
+ # info_type.
+ "primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
+ "timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
+ # portion of the value.
+ "partToExtract": "A String", # The part of the time to keep.
+ },
+ "dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift
+ # same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting
+ # to learn more.
+ "context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.
+ # If set, must also set cryptoKey. If set, shift will be consistent for the
+ # given context.
+ "name": "A String", # Name describing the field.
+ },
+ "upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this
+ # range (inclusive ends). Negative means shift to earlier in time. Must not
+ # be more than 365250 days (1000 years) each direction.
+ #
+ # For example, 3 means shift date to at most 3 days into the future.
+ "lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This
+ # results in the same shift for the same context and crypto_key. If
+ # set, must also set context. Can only be applied to table items.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ },
+ "replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
+ },
+ "cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto
+ # Uses SHA-256.
+ # The key size must be either 32 or 64 bytes.
+ # Outputs a base64 encoded representation of the hashed output
+ # (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
+ # Currently, only string and integer values can be hashed.
+ # See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ },
+ "cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
+ # (FPE) with the FFX mode of operation; however when used in the
+ # `ReidentifyContent` API method, it serves the opposite function by reversing
+ # the surrogate back into the original identifier. The identifier must be
+ # encoded as ASCII. For a given crypto key and context, the same identifier
+ # will be replaced with the same surrogate. Identifiers must be at least two
+ # characters long. In the case that the identifier is the empty string, it will
+ # be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn
+ # more.
+ #
+ # Note: We recommend using CryptoDeterministicConfig for all use cases which
+ # do not require preserving the input alphabet space and size, plus warrant
+ # referential integrity.
+ "surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
+ # This annotation will be applied to the surrogate by prefixing it with
+ # the name of the custom infoType followed by the number of
+ # characters comprising the surrogate. The following scheme defines the
+ # format: info_type_name(surrogate_character_count):surrogate
+ #
+ # For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and
+ # the surrogate is 'abc', the full replacement value
+ # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
+ #
+ # This annotation identifies the surrogate when inspecting content using the
+ # custom infoType
+ # [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).
+ # This facilitates reversal of the surrogate when it occurs in free text.
+ #
+ # In order for inspection to work properly, the name of this infoType must
+ # not occur naturally anywhere in your data; otherwise, inspection may
+ # find a surrogate that does not correspond to an actual identifier.
+ # Therefore, choose your custom infoType name carefully after considering
+ # what your data looks like. One way to select a name that has a high chance
+ # of yielding reliable detection is to include one or more unicode characters
+ # that are highly improbable to exist in your data.
+ # For example, assuming your data is entered from a regular ASCII keyboard,
+ # the symbol with the hex code point 29DD might be used like so:
+ # ⧝MY_TOKEN_TYPE
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same
+ # identifier in two different contexts won't be given the same surrogate. If
+ # the context is not set, a default tweak will be used.
+ #
+ # If the context is set but:
+ #
+ # 1. there is no record present when transforming a given value or
+ # 1. the field is not present when transforming a given value,
+ #
+ # a default tweak will be used.
+ #
+ # Note that case (1) is expected when an `InfoTypeTransformation` is
+ # applied to both structured and non-structured `ContentItem`s.
+ # Currently, the referenced field may be of value type integer or string.
+ #
+ # The tweak is constructed as a sequence of bytes in big endian byte order
+ # such that:
+ #
+ # - a 64 bit integer is encoded followed by a single byte of value 1
+ # - a string is encoded in UTF-8 format followed by a single byte of value 2
+ "name": "A String", # Name describing the field.
+ },
+ "radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
+ },
+ "cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
+ # input. Outputs a base64 encoded representation of the encrypted output.
+ # Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
+ "surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.
+ # This annotation will be applied to the surrogate by prefixing it with
+ # the name of the custom info type followed by the number of
+ # characters comprising the surrogate. The following scheme defines the
+ # format: {info type name}({surrogate character count}):{surrogate}
+ #
+ # For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and
+ # the surrogate is 'abc', the full replacement value
+ # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
+ #
+ # This annotation identifies the surrogate when inspecting content using the
+ # custom info type 'Surrogate'. This facilitates reversal of the
+ # surrogate when it occurs in free text.
+ #
+ # Note: For record transformations where the entire cell in a table is being
+ # transformed, surrogates are not mandatory. Surrogates are used to denote
+ # the location of the token and are necessary for re-identification in free
+ # form text.
+ #
+ # In order for inspection to work properly, the name of this info type must
+ # not occur naturally anywhere in your data; otherwise, inspection may either
+ #
+ # - reverse a surrogate that does not correspond to an actual identifier
+ # - be unable to parse the surrogate and result in an error
+ #
+ # Therefore, choose your custom info type name carefully after considering
+ # what your data looks like. One way to select a name that has a high chance
+ # of yielding reliable detection is to include one or more unicode characters
+ # that are highly improbable to exist in your data.
+ # For example, assuming your data is entered from a regular ASCII keyboard,
+ # the symbol with the hex code point 29DD might be used like so:
+ # ⧝MY_TOKEN_TYPE.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining
+ # referential integrity such that the same identifier in two different
+ # contexts will be given a distinct surrogate. The context is appended to
+ # plaintext value being encrypted. On decryption the provided context is
+ # validated against the value used during encryption. If a context was
+ # provided during encryption, same context must be provided during decryption
+ # as well.
+ #
+ # If the context is not set, plaintext would be used as is for encryption.
+ # If the context is set but:
+ #
+ # 1. there is no record present when transforming a given value or
+ # 2. the field is not present when transforming a given value,
+ #
+ # plaintext would be used as is for encryption.
+ #
+ # Note that case (1) is expected when an `InfoTypeTransformation` is
+ # applied to both structured and non-structured `ContentItem`s.
+ "name": "A String", # Name describing the field.
+ },
+ "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.
+ # a key encryption key (KEK) stored by KMS).
+ # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
+ # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
+ # unwrap the data crypto key.
+ "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
+ # leaking the key. Choose another type of key if possible.
+ "key": "A String", # Required. A 128/192/256 bit key.
+ },
+ "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
+ # It will be discarded after the request finishes.
+ "name": "A String", # Required. Name of the key.
+ # This is an arbitrary string used to differentiate different keys.
+ # A unique key is generated per name: two separate `TransientCryptoKey`
+ # protos share the same generated key if their names are the same.
+ # When the data crypto key is generated, this name is not used in any way
+ # (repeating the api call will result in a different key being generated).
+ },
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
+ },
+ },
+ "bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
+ # replacement values are dynamically provided by the user for custom behavior,
+ # such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
+ # This can be used on
+ # data of type: number, long, string, timestamp.
+ # If the bound `Value` type differs from the type of data being transformed, we
+ # will first attempt converting the type of the data to be transformed to match
+ # the type of the bound before comparing.
+ # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
+ "buckets": [ # Set of buckets. Ranges must be non-overlapping.
+ { # Bucket is represented as a range, along with replacement values.
+ "replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
+ # the default behavior will be to hyphenate the min-max range.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ ],
+ },
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
+ "replaceConfig": { # Replace each input value with a given `Value`. # Replace
+ "newValue": { # Set of primitive values supported by the system. # Value to replace it with.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
+ # Bucketing transformation can provide all of this functionality,
+ # but requires more configuration. This message is provided as a convenience to
+ # the user for simple bucketing strategies.
+ #
+ # The transformed value will be a hyphenated string of
+ # {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20
+ # all values that are within this bucket will be replaced with "10-20".
+ #
+ # This can be used on data of type: double, long.
+ #
+ # If the bound Value type differs from the type of data
+ # being transformed, we will first attempt converting the type of the data to
+ # be transformed to match the type of the bound before comparing.
+ #
+ # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
+ "upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
+ # grouped together into a single bucket; for example if `upper_bound` = 89,
+ # then all values greater than 89 are replaced with the value "89+".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
+ # `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
+ # following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
+ # 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
+ },
+ },
+ "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
+ # this transformation to apply to all findings that correspond to
+ # infoTypes that were requested in `InspectConfig`.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
+ },
+ ],
+ },
"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default
# mode is `TransformationErrorHandling.ThrowError`.
# transformation error occurs when the requested transformation is incompatible
@@ -5764,89 +6318,6 @@
# specific locations within structured datasets, such as transforming
# a column within a table.
# table.
- "recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that
- # match any suppression rule are omitted from the output.
- { # Configuration to suppress records whose suppression conditions evaluate to
- # true.
- "condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being
- # evaluated to be suppressed from the transformed content.
- # a field.
- "expressions": { # An expression, consisting or an operator and conditions. # An expression.
- "logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently
- # only supported value is `AND`.
- "conditions": { # A collection of conditions. # Conditions to apply to the expression.
- "conditions": [ # A collection of conditions.
- { # The field type of `value` and `field` do not need to match to be
- # considered equal, but not all comparisons are possible.
- # EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,
- # but all other comparisons are invalid with incompatible types.
- # A `value` of type:
- #
- # - `string` can be compared against all other types
- # - `boolean` can only be compared against other booleans
- # - `integer` can be compared against doubles or a string if the string value
- # can be parsed as an integer.
- # - `double` can be compared against integers or a string if the string can
- # be parsed as a double.
- # - `Timestamp` can be compared against strings in RFC 3339 date string
- # format.
- # - `TimeOfDay` can be compared against timestamps and strings in the format
- # of 'HH:mm:ss'.
- #
- # If we fail to compare do to type mismatch, a warning will be given and
- # the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
- "value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- },
- ],
- },
- },
- },
- },
- ],
"fieldTransformations": [ # Transform the record by applying various field transformations.
{ # The transformation to apply to the field.
"fields": [ # Required. Input field(s) to apply the transformation to.
@@ -5863,17 +6334,6 @@
# for a given infoType.
{ # A transformation to apply to text that is identified as a specific
# info_type.
- "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
- # this transformation to apply to all findings that correspond to
- # infoTypes that were requested in `InspectConfig`.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
# portion of the value.
@@ -5900,14 +6360,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -5921,6 +6373,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -5937,14 +6397,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -5958,6 +6410,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -5973,14 +6433,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -6040,14 +6492,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -6061,7 +6505,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -6129,14 +6589,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -6150,12 +6602,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -6167,89 +6623,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -6257,9 +6630,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -6284,17 +6654,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -6302,9 +6762,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -6329,44 +6786,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -6383,49 +6814,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -6434,9 +6822,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -6461,20 +6846,106 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
+ "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
+ # this transformation to apply to all findings that correspond to
+ # infoTypes that were requested in `InspectConfig`.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
},
],
},
@@ -6504,14 +6975,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -6525,6 +6988,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -6541,14 +7012,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -6562,6 +7025,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -6577,14 +7048,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -6644,14 +7107,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -6665,7 +7120,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -6733,14 +7204,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -6754,12 +7217,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -6771,89 +7238,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -6861,9 +7245,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -6888,17 +7269,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -6906,9 +7377,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -6933,44 +7401,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -6987,49 +7429,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -7038,9 +7437,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -7065,18 +7461,93 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the
@@ -7113,19 +7584,12 @@
#
# If we fail to compare do to type mismatch, a warning will be given and
# the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
# Note that for the purposes of inspection or transformation, the number
# of bytes considered to comprise a 'Value' is based on its representation
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -7150,14 +7614,104 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
+ },
+ ],
+ },
+ },
+ },
+ },
+ ],
+ "recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that
+ # match any suppression rule are omitted from the output.
+ { # Configuration to suppress records whose suppression conditions evaluate to
+ # true.
+ "condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being
+ # evaluated to be suppressed from the transformed content.
+ # a field.
+ "expressions": { # An expression, consisting or an operator and conditions. # An expression.
+ "logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently
+ # only supported value is `AND`.
+ "conditions": { # A collection of conditions. # Conditions to apply to the expression.
+ "conditions": [ # A collection of conditions.
+ { # The field type of `value` and `field` do not need to match to be
+ # considered equal, but not all comparisons are possible.
+ # EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,
+ # but all other comparisons are invalid with incompatible types.
+ # A `value` of type:
+ #
+ # - `string` can be compared against all other types
+ # - `boolean` can only be compared against other booleans
+ # - `integer` can be compared against doubles or a string if the string value
+ # can be parsed as an integer.
+ # - `double` can be compared against integers or a string if the string can
+ # be parsed as a double.
+ # - `Timestamp` can be compared against strings in RFC 3339 date string
+ # format.
+ # - `TimeOfDay` can be compared against timestamps and strings in the format
+ # of 'HH:mm:ss'.
+ #
+ # If we fail to compare do to type mismatch, a warning will be given and
+ # the condition will evaluate to false.
+ "value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
],
},
@@ -7166,631 +7720,77 @@
},
],
},
- "infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text
- # transformation everywhere.
- # apply various `PrimitiveTransformation`s to each finding, where the
- # transformation is applied to only values that were identified as a specific
- # info_type.
- "transformations": [ # Required. Transformation for each infoType. Cannot specify more than one
- # for a given infoType.
- { # A transformation to apply to text that is identified as a specific
- # info_type.
- "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
- # this transformation to apply to all findings that correspond to
- # infoTypes that were requested in `InspectConfig`.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
+ },
+ "item": { # Container structure for the content to inspect. # The item to re-identify. Will be treated as text.
+ "byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
+ "data": "A String", # Content data to inspect or redact.
+ "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
+ },
+ "value": "A String", # String data to inspect or redact.
+ "table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
+ # https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
+ # learn more.
+ # See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
+ # learn more.
+ "rows": [ # Rows of the table.
+ { # Values of the row.
+ "values": [ # Individual cells.
+ { # Set of primitive values supported by the system.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
],
- "primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
- "timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
- # portion of the value.
- "partToExtract": "A String", # The part of the time to keep.
- },
- "dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift
- # same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting
- # to learn more.
- "context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.
- # If set, must also set cryptoKey. If set, shift will be consistent for the
- # given context.
- "name": "A String", # Name describing the field.
- },
- "upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this
- # range (inclusive ends). Negative means shift to earlier in time. Must not
- # be more than 365250 days (1000 years) each direction.
- #
- # For example, 3 means shift date to at most 3 days into the future.
- "lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This
- # results in the same shift for the same context and crypto_key. If
- # set, must also set context. Can only be applied to table items.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
- },
- "cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto
- # Uses SHA-256.
- # The key size must be either 32 or 64 bytes.
- # Outputs a base64 encoded representation of the hashed output
- # (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
- # Currently, only string and integer values can be hashed.
- # See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
- # (FPE) with the FFX mode of operation; however when used in the
- # `ReidentifyContent` API method, it serves the opposite function by reversing
- # the surrogate back into the original identifier. The identifier must be
- # encoded as ASCII. For a given crypto key and context, the same identifier
- # will be replaced with the same surrogate. Identifiers must be at least two
- # characters long. In the case that the identifier is the empty string, it will
- # be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn
- # more.
- #
- # Note: We recommend using CryptoDeterministicConfig for all use cases which
- # do not require preserving the input alphabet space and size, plus warrant
- # referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
- "surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
- # This annotation will be applied to the surrogate by prefixing it with
- # the name of the custom infoType followed by the number of
- # characters comprising the surrogate. The following scheme defines the
- # format: info_type_name(surrogate_character_count):surrogate
- #
- # For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and
- # the surrogate is 'abc', the full replacement value
- # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
- #
- # This annotation identifies the surrogate when inspecting content using the
- # custom infoType
- # [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).
- # This facilitates reversal of the surrogate when it occurs in free text.
- #
- # In order for inspection to work properly, the name of this infoType must
- # not occur naturally anywhere in your data; otherwise, inspection may
- # find a surrogate that does not correspond to an actual identifier.
- # Therefore, choose your custom infoType name carefully after considering
- # what your data looks like. One way to select a name that has a high chance
- # of yielding reliable detection is to include one or more unicode characters
- # that are highly improbable to exist in your data.
- # For example, assuming your data is entered from a regular ASCII keyboard,
- # the symbol with the hex code point 29DD might be used like so:
- # ⧝MY_TOKEN_TYPE
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same
- # identifier in two different contexts won't be given the same surrogate. If
- # the context is not set, a default tweak will be used.
- #
- # If the context is set but:
- #
- # 1. there is no record present when transforming a given value or
- # 1. the field is not present when transforming a given value,
- #
- # a default tweak will be used.
- #
- # Note that case (1) is expected when an `InfoTypeTransformation` is
- # applied to both structured and non-structured `ContentItem`s.
- # Currently, the referenced field may be of value type integer or string.
- #
- # The tweak is constructed as a sequence of bytes in big endian byte order
- # such that:
- #
- # - a 64 bit integer is encoded followed by a single byte of value 1
- # - a string is encoded in UTF-8 format followed by a single byte of value 2
- "name": "A String", # Name describing the field.
- },
- "radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
- # input. Outputs a base64 encoded representation of the encrypted output.
- # Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
- "surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.
- # This annotation will be applied to the surrogate by prefixing it with
- # the name of the custom info type followed by the number of
- # characters comprising the surrogate. The following scheme defines the
- # format: {info type name}({surrogate character count}):{surrogate}
- #
- # For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and
- # the surrogate is 'abc', the full replacement value
- # will be: 'MY_TOKEN_INFO_TYPE(3):abc'
- #
- # This annotation identifies the surrogate when inspecting content using the
- # custom info type 'Surrogate'. This facilitates reversal of the
- # surrogate when it occurs in free text.
- #
- # Note: For record transformations where the entire cell in a table is being
- # transformed, surrogates are not mandatory. Surrogates are used to denote
- # the location of the token and are necessary for re-identification in free
- # form text.
- #
- # In order for inspection to work properly, the name of this info type must
- # not occur naturally anywhere in your data; otherwise, inspection may either
- #
- # - reverse a surrogate that does not correspond to an actual identifier
- # - be unable to parse the surrogate and result in an error
- #
- # Therefore, choose your custom info type name carefully after considering
- # what your data looks like. One way to select a name that has a high chance
- # of yielding reliable detection is to include one or more unicode characters
- # that are highly improbable to exist in your data.
- # For example, assuming your data is entered from a regular ASCII keyboard,
- # the symbol with the hex code point 29DD might be used like so:
- # ⧝MY_TOKEN_TYPE.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- "context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining
- # referential integrity such that the same identifier in two different
- # contexts will be given a distinct surrogate. The context is appended to
- # plaintext value being encrypted. On decryption the provided context is
- # validated against the value used during encryption. If a context was
- # provided during encryption, same context must be provided during decryption
- # as well.
- #
- # If the context is not set, plaintext would be used as is for encryption.
- # If the context is set but:
- #
- # 1. there is no record present when transforming a given value or
- # 2. the field is not present when transforming a given value,
- #
- # plaintext would be used as is for encryption.
- #
- # Note that case (1) is expected when an `InfoTypeTransformation` is
- # applied to both structured and non-structured `ContentItem`s.
- "name": "A String", # Name describing the field.
- },
- "cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.
- # a key encryption key (KEK) stored by KMS).
- # When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
- # IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
- # unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
- "unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
- # leaking the key. Choose another type of key if possible.
- "key": "A String", # Required. A 128/192/256 bit key.
- },
- "transient": { # Use this to have a random data crypto key generated. # Transient crypto key
- # It will be discarded after the request finishes.
- "name": "A String", # Required. Name of the key.
- # This is an arbitrary string used to differentiate different keys.
- # A unique key is generated per name: two separate `TransientCryptoKey`
- # protos share the same generated key if their names are the same.
- # When the data crypto key is generated, this name is not used in any way
- # (repeating the api call will result in a different key being generated).
- },
- },
- },
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
- "bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
- # replacement values are dynamically provided by the user for custom behavior,
- # such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
- # This can be used on
- # data of type: number, long, string, timestamp.
- # If the bound `Value` type differs from the type of data being transformed, we
- # will first attempt converting the type of the data to be transformed to match
- # the type of the bound before comparing.
- # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "buckets": [ # Set of buckets. Ranges must be non-overlapping.
- { # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
- # the default behavior will be to hyphenate the min-max range.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- },
- ],
- },
- "replaceConfig": { # Replace each input value with a given `Value`. # Replace
- "newValue": { # Set of primitive values supported by the system. # Value to replace it with.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- },
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
- "fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
- # Bucketing transformation can provide all of this functionality,
- # but requires more configuration. This message is provided as a convenience to
- # the user for simple bucketing strategies.
- #
- # The transformed value will be a hyphenated string of
- # {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20
- # all values that are within this bucket will be replaced with "10-20".
- #
- # This can be used on data of type: double, long.
- #
- # If the bound Value type differs from the type of data
- # being transformed, we will first attempt converting the type of the data to
- # be transformed to match the type of the bound before comparing.
- #
- # See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
- # grouped together into a single bucket; for example if `upper_bound` = 89,
- # then all values greater than 89 are replaced with the value "89+".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
- # `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
- # following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
- # 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
- },
- },
+ },
+ ],
+ "headers": [ # Headers of the table.
+ { # General identifier of a data field in a storage service.
+ "name": "A String", # Name describing the field.
},
],
},
},
+ "inspectTemplateName": "A String", # Template to use. Any configuration directly specified in
+ # `inspect_config` will override those set in the template. Singular fields
+ # that are set in this request will replace their corresponding fields in the
+ # template. Repeated fields are appended. Singular sub-messages and groups
+ # are recursively merged.
}
x__xgafv: string, V1 error format.
@@ -7825,17 +7825,6 @@
# for a given infoType.
{ # A transformation to apply to text that is identified as a specific
# info_type.
- "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
- # this transformation to apply to all findings that correspond to
- # infoTypes that were requested in `InspectConfig`.
- { # Type of information detected by the API.
- "name": "A String", # Name of the information type. Either a name of your choosing when
- # creating a CustomInfoType, or one of the names listed
- # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
- # a built-in type. InfoType names should conform to the pattern
- # `[a-zA-Z0-9_]{1,64}`.
- },
- ],
"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.
"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
# portion of the value.
@@ -7862,14 +7851,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -7883,6 +7864,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -7899,14 +7888,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -7920,6 +7901,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -7935,14 +7924,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -8002,14 +7983,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -8023,7 +7996,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -8091,14 +8080,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -8112,12 +8093,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -8129,89 +8114,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -8219,9 +8121,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -8246,17 +8145,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -8264,9 +8253,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -8291,44 +8277,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -8345,49 +8305,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -8396,9 +8313,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -8423,20 +8337,106 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
+ "infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause
+ # this transformation to apply to all findings that correspond to
+ # infoTypes that were requested in `InspectConfig`.
+ { # Type of information detected by the API.
+ "name": "A String", # Name of the information type. Either a name of your choosing when
+ # creating a CustomInfoType, or one of the names listed
+ # at https://cloud.google.com/dlp/docs/infotypes-reference when specifying
+ # a built-in type. InfoType names should conform to the pattern
+ # `[a-zA-Z0-9_]{1,64}`.
+ },
+ ],
},
],
},
@@ -8466,14 +8466,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -8487,6 +8479,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -8503,14 +8503,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -8524,6 +8516,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -8539,14 +8539,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -8606,14 +8598,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -8627,7 +8611,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -8695,14 +8695,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -8716,12 +8708,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -8733,89 +8729,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -8823,9 +8736,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -8850,17 +8760,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -8868,9 +8868,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -8895,44 +8892,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -8949,49 +8920,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -9000,9 +8928,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9027,18 +8952,93 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ },
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
},
},
"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the
@@ -9075,19 +9075,12 @@
#
# If we fail to compare do to type mismatch, a warning will be given and
# the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
# Note that for the purposes of inspection or transformation, the number
# of bytes considered to comprise a 'Value' is based on its representation
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9112,14 +9105,21 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
],
},
@@ -9127,9 +9127,6 @@
},
},
],
- "field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.
- "name": "A String", # Name describing the field.
- },
"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.
"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction
# portion of the value.
@@ -9156,14 +9153,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -9177,6 +9166,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype
@@ -9193,14 +9190,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -9214,6 +9203,14 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe
@@ -9229,14 +9226,6 @@
# Note: We recommend using CryptoDeterministicConfig for all use cases which
# do not require preserving the input alphabet space and size, plus warrant
# referential integrity.
- "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
- # that the FFX mode natively supports. This happens before/after
- # encryption/decryption.
- # Each character listed must appear only once.
- # Number of characters must be in the range [2, 95].
- # This must be encoded as ASCII.
- # The order of characters does not matter.
- "commonAlphabet": "A String", # Common alphabets.
"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.
# This annotation will be applied to the surrogate by prefixing it with
# the name of the custom infoType followed by the number of
@@ -9296,14 +9285,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -9317,7 +9298,23 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
+ "customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters
+ # that the FFX mode natively supports. This happens before/after
+ # encryption/decryption.
+ # Each character listed must appear only once.
+ # Number of characters must be in the range [2, 95].
+ # This must be encoded as ASCII.
+ # The order of characters does not matter.
+ "commonAlphabet": "A String", # Common alphabets.
},
"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto
# input. Outputs a base64 encoded representation of the encrypted output.
@@ -9385,14 +9382,6 @@
# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
# unwrap the data crypto key.
- "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
- # The wrapped key must be a 128/192/256 bit key.
- # Authorization requires the following IAM permissions when sending a request
- # to perform a crypto transformation using a kms-wrapped crypto key:
- # dlp.kms.encrypt
- "wrappedKey": "A String", # Required. The wrapped data crypto key.
- "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
- },
"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key
# leaking the key. Choose another type of key if possible.
"key": "A String", # Required. A 128/192/256 bit key.
@@ -9406,12 +9395,16 @@
# When the data crypto key is generated, this name is not used in any way
# (repeating the api call will result in a different key being generated).
},
+ "kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key
+ # The wrapped key must be a 128/192/256 bit key.
+ # Authorization requires the following IAM permissions when sending a request
+ # to perform a crypto transformation using a kms-wrapped crypto key:
+ # dlp.kms.encrypt
+ "cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.
+ "wrappedKey": "A String", # Required. The wrapped data crypto key.
+ },
},
},
- "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
- # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
- # output would be 'My phone number is '.
- },
"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing
# replacement values are dynamically provided by the user for custom behavior,
# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
@@ -9423,89 +9416,6 @@
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
"buckets": [ # Set of buckets. Ranges must be non-overlapping.
{ # Bucket is represented as a range, along with replacement values.
- "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
- # used.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
- "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided
# the default behavior will be to hyphenate the min-max range.
# Note that for the purposes of inspection or transformation, the number
@@ -9513,9 +9423,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9540,17 +9447,107 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if
+ # used.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
+ "max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
],
},
+ "redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact
+ # transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
+ # output would be 'My phone number is '.
+ },
"replaceConfig": { # Replace each input value with a given `Value`. # Replace
"newValue": { # Set of primitive values supported by the system. # Value to replace it with.
# Note that for the purposes of inspection or transformation, the number
@@ -9558,9 +9555,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9585,44 +9579,18 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
},
- "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
- # fixed character. Masking can start from the beginning or end of the string.
- # This can be used on data of any type (numbers, longs, and so on) and when
- # de-identifying structured data we'll attempt to preserve the original data's
- # type. (This allows you to take a long like 123 and modify it to a string like
- # **3.
- "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
- # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
- # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
- # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
- # is `true`, then the string `12345` is masked as `12***`.
- "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
- # characters. For example, if the input string is `555-555-5555` and you
- # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
- # returns `***-**5-5555`.
- { # Characters to skip when doing deidentification of a value. These will be left
- # alone and skipped.
- "charactersToSkip": "A String", # Characters to not transform when masking.
- "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
- # punctuation.
- },
- ],
- "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
- # masked. Skipped characters do not count towards this tally.
- "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
- # alphabetic string such as a name, or `0` for a numeric string such as ZIP
- # code or credit card number. This string must have a length of 1. If not
- # supplied, this value defaults to `*` for strings, and `0` for digits.
- },
"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing
# Bucketing transformation can provide all of this functionality,
# but requires more configuration. This message is provided as a convenience to
@@ -9639,49 +9607,6 @@
# be transformed to match the type of the bound before comparing.
#
# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
- "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
- # grouped together into a single bucket; for example if `lower_bound` = 10,
- # then all values less than 10 are replaced with the value "-10".
- # Note that for the purposes of inspection or transformation, the number
- # of bytes considered to comprise a 'Value' is based on its representation
- # as a UTF-8 encoded string. For example, if 'integer_value' is set to
- # 123456789, the number of bytes would be counted as 9, even though an
- # int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
- "timestampValue": "A String", # timestamp
- "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
- # and time zone are either specified elsewhere or are not significant. The date
- # is relative to the Proleptic Gregorian Calendar. This can represent:
- #
- # * A full date, with non-zero year, month and day values
- # * A month and day value, with a zero year, e.g. an anniversary
- # * A year on its own, with zero month and day values
- # * A year and month value, with a zero day, e.g. a credit card expiration date
- #
- # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
- "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
- # a year.
- "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
- # month and day.
- "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
- # if specifying a year by itself or a year and month where the day is not
- # significant.
- },
- "stringValue": "A String", # string
- "integerValue": "A String", # integer
- "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
- # or are specified elsewhere. An API may choose to allow leap seconds. Related
- # types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
- "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
- # to allow the value "24:00:00" for scenarios like business closing time.
- "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
- },
- },
"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are
# grouped together into a single bucket; for example if `upper_bound` = 89,
# then all values greater than 89 are replaced with the value "89+".
@@ -9690,9 +9615,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9717,19 +9639,97 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if
# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
+ "lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are
+ # grouped together into a single bucket; for example if `lower_bound` = 10,
+ # then all values less than 10 are replaced with the value "-10".
+ # Note that for the purposes of inspection or transformation, the number
+ # of bytes considered to comprise a 'Value' is based on its representation
+ # as a UTF-8 encoded string. For example, if 'integer_value' is set to
+ # 123456789, the number of bytes would be counted as 9, even though an
+ # int64 only holds up to 8 bytes of data.
+ "timestampValue": "A String", # timestamp
+ "dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
+ # and time zone are either specified elsewhere or are not significant. The date
+ # is relative to the Proleptic Gregorian Calendar. This can represent:
+ #
+ # * A full date, with non-zero year, month and day values
+ # * A month and day value, with a zero year, e.g. an anniversary
+ # * A year on its own, with zero month and day values
+ # * A year and month value, with a zero day, e.g. a credit card expiration date
+ #
+ # Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
+ "year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without
+ # a year.
+ "month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a
+ # month and day.
+ "day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0
+ # if specifying a year by itself or a year and month where the day is not
+ # significant.
+ },
+ "stringValue": "A String", # string
+ "integerValue": "A String", # integer
+ "timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
+ # or are specified elsewhere. An API may choose to allow leap seconds. Related
+ # types are google.type.Date and `google.protobuf.Timestamp`.
+ "hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
+ # to allow the value "24:00:00" for scenarios like business closing time.
+ "minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
+ },
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
+ },
},
+ "characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask
+ # fixed character. Masking can start from the beginning or end of the string.
+ # This can be used on data of any type (numbers, longs, and so on) and when
+ # de-identifying structured data we'll attempt to preserve the original data's
+ # type. (This allows you to take a long like 123 and modify it to a string like
+ # **3.
+ "charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing
+ # characters. For example, if the input string is `555-555-5555` and you
+ # instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP
+ # returns `***-**5-5555`.
+ { # Characters to skip when doing deidentification of a value. These will be left
+ # alone and skipped.
+ "charactersToSkip": "A String", # Characters to not transform when masking.
+ "commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing
+ # punctuation.
+ },
+ ],
+ "numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be
+ # masked. Skipped characters do not count towards this tally.
+ "maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an
+ # alphabetic string such as a name, or `0` for a numeric string such as ZIP
+ # code or credit card number. This string must have a length of 1. If not
+ # supplied, this value defaults to `*` for strings, and `0` for digits.
+ "reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is
+ # `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the
+ # input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
+ # If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`
+ # is `true`, then the string `12345` is masked as `12***`.
+ },
+ },
+ "field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.
+ "name": "A String", # Name describing the field.
},
"transformedBytes": "A String", # Total size in bytes that were transformed in some way.
"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.
@@ -9761,19 +9761,12 @@
#
# If we fail to compare do to type mismatch, a warning will be given and
# the condition will evaluate to false.
- "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
- "name": "A String", # Name describing the field.
- },
- "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]
# Note that for the purposes of inspection or transformation, the number
# of bytes considered to comprise a 'Value' is based on its representation
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9798,14 +9791,21 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
+ "field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.
+ "name": "A String", # Name describing the field.
+ },
+ "operator": "A String", # Required. Operator used to compare the field or infoType to the value.
},
],
},
@@ -9822,10 +9822,10 @@
"results": [ # Collection of all transformations that took place or had an error.
{ # A collection that informs the user the number of times a particular
# `TransformationResultCode` and error details occurred.
- "code": "A String", # Outcome of the transformation.
- "count": "A String", # Number of transformations counted by this result.
"details": "A String", # A place for warnings or errors to show up if a transformation didn't
# work as expected.
+ "code": "A String", # Outcome of the transformation.
+ "count": "A String", # Number of transformations counted by this result.
},
],
},
@@ -9834,8 +9834,8 @@
},
"item": { # Container structure for the content to inspect. # The re-identified item.
"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.
- "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
"data": "A String", # Content data to inspect or redact.
+ "type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.
},
"value": "A String", # String data to inspect or redact.
"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See
@@ -9852,9 +9852,6 @@
# as a UTF-8 encoded string. For example, if 'integer_value' is set to
# 123456789, the number of bytes would be counted as 9, even though an
# int64 only holds up to 8 bytes of data.
- "booleanValue": True or False, # boolean
- "floatValue": 3.14, # float
- "dayOfWeekValue": "A String", # day of week
"timestampValue": "A String", # timestamp
"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date
# and time zone are either specified elsewhere or are not significant. The date
@@ -9879,13 +9876,16 @@
"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day
# or are specified elsewhere. An API may choose to allow leap seconds. Related
# types are google.type.Date and `google.protobuf.Timestamp`.
- "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
- # allow the value 60 if it allows leap-seconds.
- "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose
# to allow the value "24:00:00" for scenarios like business closing time.
"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.
+ "seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may
+ # allow the value 60 if it allows leap-seconds.
+ "nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
},
+ "booleanValue": True or False, # boolean
+ "floatValue": 3.14, # float
+ "dayOfWeekValue": "A String", # day of week
},
],
},