google_data_loss_prevention_discovery_config

Configuration for discovery to scan resources for profile generation. Only one discovery configuration may exist per organization, folder, or project.

To get more information about DiscoveryConfig, see:

Example Usage - Dlp Discovery Config Basic

resource "google_data_loss_prevention_discovery_config" "basic" {
    parent = "projects/my-project-name/locations/us"
    location = "us"
    status = "RUNNING"

    targets {
        big_query_target {
            filter {
                other_tables {}
            }
        }
    }
    inspect_templates = ["projects/%{project}/inspectTemplates/${google_data_loss_prevention_inspect_template.basic.name}"]
}

resource "google_data_loss_prevention_inspect_template" "basic" {
    parent = "projects/my-project-name"
    description = "My description"
    display_name = "display_name"

    inspect_config {
        info_types {
            name = "EMAIL_ADDRESS"
        }
    }
}

Example Usage - Dlp Discovery Config Actions

resource "google_data_loss_prevention_discovery_config" "actions" {
    parent = "projects/my-project-name/locations/us"
    location = "us"
    status = "RUNNING"

    targets {
        big_query_target {
            filter {
                other_tables {}
            }
        }
    }
    actions {
        export_data {
            profile_table {
                project_id = "project"
                dataset_id = "dataset"
                table_id = "table"
            }
        }
    }
    actions { 
        pub_sub_notification {
            topic = "projects/%{project}/topics/${google_pubsub_topic.actions.name}"
            event = "NEW_PROFILE"
            pubsub_condition {
                expressions {
                    logical_operator = "OR"
                    conditions {
                        minimum_sensitivity_score = "HIGH"
                    }
                }
            }
            detail_of_message = "TABLE_PROFILE"
        }
    }
    inspect_templates = ["projects/%{project}/inspectTemplates/${google_data_loss_prevention_inspect_template.basic.name}"] 
}

resource "google_pubsub_topic" "actions" {
    name = "fake-topic"
}

resource "google_data_loss_prevention_inspect_template" "basic" {
    parent = "projects/my-project-name"
    description = "My description"
    display_name = "display_name"

    inspect_config {
        info_types {
            name = "EMAIL_ADDRESS"
        }
    }
}

Example Usage - Dlp Discovery Config Org Running

resource "google_data_loss_prevention_discovery_config" "org_running" {
    parent = "organizations/123456789/locations/us"
    location = "us"

    targets {
        big_query_target {
            filter {
                other_tables {}
            }
        }
    }
    org_config {
        project_id = "my-project-name"
        location {
            organization_id = "123456789"
        }
    }
    inspect_templates = ["projects/%{project}/inspectTemplates/${google_data_loss_prevention_inspect_template.basic.name}"] 
    status = "RUNNING"
}

resource "google_data_loss_prevention_inspect_template" "basic" {
    parent = "projects/my-project-name"
    description = "My description"
    display_name = "display_name"

    inspect_config {
        info_types {
            name = "EMAIL_ADDRESS"
        }
    }
}

Example Usage - Dlp Discovery Config Org Folder Paused

resource "google_data_loss_prevention_discovery_config" "org_folder_paused" {
    parent = "organizations/123456789/locations/us"
    location = "us"

    targets {
        big_query_target {
            filter {
                other_tables {}
            }
        }
    }
    org_config {
        project_id = "my-project-name"
        location {
            folder_id = 123
        }
    }
    inspect_templates = ["projects/%{project}/inspectTemplates/${google_data_loss_prevention_inspect_template.basic.name}"]
    status = "PAUSED"
}

resource "google_data_loss_prevention_inspect_template" "basic" {
    parent = "projects/my-project-name"
    description = "My description"
    display_name = "display_name"

    inspect_config {
        info_types {
            name = "EMAIL_ADDRESS"
        }
    }
}

Example Usage - Dlp Discovery Config Conditions Cadence

resource "google_data_loss_prevention_discovery_config" "conditions_cadence" {
    parent = "projects/my-project-name/locations/us"
    location = "us"
    status = "RUNNING"

    targets {
        big_query_target {
            filter {
                other_tables {}
            }
            conditions {
                type_collection = "BIG_QUERY_COLLECTION_ALL_TYPES"
            }
            cadence {
                schema_modified_cadence {
                    types = ["SCHEMA_NEW_COLUMNS"]
                    frequency = "UPDATE_FREQUENCY_DAILY"
                }
                table_modified_cadence {
                    types = ["TABLE_MODIFIED_TIMESTAMP"]
                    frequency = "UPDATE_FREQUENCY_DAILY"
                }
            }
        }
    }
    inspect_templates = ["projects/%{project}/inspectTemplates/${google_data_loss_prevention_inspect_template.basic.name}"]
}

resource "google_data_loss_prevention_inspect_template" "basic" {
    parent = "projects/my-project-name"
    description = "My description"
    display_name = "display_name"

    inspect_config {
        info_types {
            name = "EMAIL_ADDRESS"
        }
    }
}

Example Usage - Dlp Discovery Config Filter Regexes And Conditions

resource "google_data_loss_prevention_discovery_config" "filter_regexes_and_conditions" {
    parent = "projects/my-project-name/locations/us"
    location = "us"
    status = "RUNNING"

    targets {
        big_query_target {
            filter {
                tables {
                    include_regexes {
                        patterns {
                            project_id_regex = ".*"
                            dataset_id_regex = ".*"
                            table_id_regex = ".*"
                        }
                    }
                }
            }
            conditions {
                created_after = "2023-10-02T15:01:23Z"
                types {
                    types = ["BIG_QUERY_TABLE_TYPE_TABLE", "BIG_QUERY_TABLE_TYPE_EXTERNAL_BIG_LAKE"]
                }
                or_conditions {
                    min_row_count = 10
                    min_age = "10800s"
                }
            }
        }
    }
    targets {
        big_query_target {
            filter {
                other_tables {}
            }
        }
    }
    inspect_templates = ["projects/%{project}/inspectTemplates/${google_data_loss_prevention_inspect_template.basic.name}"] 
}

resource "google_data_loss_prevention_inspect_template" "basic" {
    parent = "projects/my-project-name"
    description = "My description"
    display_name = "display_name"

    inspect_config {
        info_types {
            name = "EMAIL_ADDRESS"
        }
    }
}

Argument Reference

The following arguments are supported:


The org_config block supports:

The location block supports:

The actions block supports:

The export_data block supports:

The profile_table block supports:

The pub_sub_notification block supports:

The pubsub_condition block supports:

The expressions block supports:

The conditions block supports:

The targets block supports:

The big_query_target block supports:

The filter block supports:

The tables block supports:

The include_regexes block supports:

The patterns block supports:

The conditions block supports:

The or_conditions block supports:

The types block supports:

The cadence block supports:

The schema_modified_cadence block supports:

The table_modified_cadence block supports:

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

The errors block contains:

The details block supports:

Timeouts

This resource provides the following Timeouts configuration options:

Import

DiscoveryConfig can be imported using any of these accepted formats:

In Terraform v1.5.0 and later, use an import block to import DiscoveryConfig using one of the formats above. For example:

import {
  id = "{{parent}}/discoveryConfigs/{{name}}"
  to = google_data_loss_prevention_discovery_config.default
}

When using the terraform import command, DiscoveryConfig can be imported using one of the formats above. For example:

$ terraform import google_data_loss_prevention_discovery_config.default {{parent}}/discoveryConfigs/{{name}}
$ terraform import google_data_loss_prevention_discovery_config.default {{parent}}/{{name}}