@google-cloud/dlp 3.2.1 → 3.5.0

package/build/protos/google/privacy/dlp/v2/dlp.proto

@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@ syntax = "proto3";
 
 package google.privacy.dlp.v2;
 
+import "google/api/annotations.proto";
 import "google/api/client.proto";
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
@@ -28,7 +29,6 @@ import "google/rpc/status.proto";
 import "google/type/date.proto";
 import "google/type/dayofweek.proto";
 import "google/type/timeofday.proto";
-import "google/api/annotations.proto";
 
 option csharp_namespace = "Google.Cloud.Dlp.V2";
 option go_package = "google.golang.org/genproto/googleapis/privacy/dlp/v2;dlp";
@@ -360,6 +360,10 @@ service DlpService {
         post: "/v2/{parent=projects/*/locations/*}/jobTriggers"
         body: "*"
       }
+      additional_bindings {
+        post: "/v2/{parent=organizations/*/locations/*}/jobTriggers"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "parent,job_trigger";
   }
@@ -374,6 +378,10 @@ service DlpService {
         patch: "/v2/{name=projects/*/locations/*/jobTriggers/*}"
         body: "*"
       }
+      additional_bindings {
+        patch: "/v2/{name=organizations/*/locations/*/jobTriggers/*}"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "name,job_trigger,update_mask";
   }
@@ -381,9 +389,6 @@ service DlpService {
   // Inspect hybrid content and store findings to a trigger. The inspection
   // will be processed asynchronously. To review the findings monitor the
   // jobs within the trigger.
-  // Early access feature is in a pre-release state and might change or have
-  // limited support. For more information, see
-  // https://cloud.google.com/products#product-launch-stages.
   rpc HybridInspectJobTrigger(HybridInspectJobTriggerRequest) returns (HybridInspectResponse) {
     option (google.api.http) = {
       post: "/v2/{name=projects/*/locations/*/jobTriggers/*}:hybridInspect"
@@ -400,6 +405,9 @@ service DlpService {
       additional_bindings {
         get: "/v2/{name=projects/*/locations/*/jobTriggers/*}"
       }
+      additional_bindings {
+        get: "/v2/{name=organizations/*/locations/*/jobTriggers/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -412,6 +420,9 @@ service DlpService {
       additional_bindings {
         get: "/v2/{parent=projects/*/locations/*}/jobTriggers"
       }
+      additional_bindings {
+        get: "/v2/{parent=organizations/*/locations/*}/jobTriggers"
+      }
     };
     option (google.api.method_signature) = "parent";
   }
@@ -424,6 +435,9 @@ service DlpService {
       additional_bindings {
         delete: "/v2/{name=projects/*/locations/*/jobTriggers/*}"
       }
+      additional_bindings {
+        delete: "/v2/{name=organizations/*/locations/*/jobTriggers/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -470,6 +484,9 @@ service DlpService {
       additional_bindings {
         get: "/v2/{parent=projects/*/locations/*}/dlpJobs"
       }
+      additional_bindings {
+        get: "/v2/{parent=organizations/*/locations/*}/dlpJobs"
+      }
     };
     option (google.api.method_signature) = "parent";
   }
@@ -623,11 +640,8 @@ service DlpService {
   }
 
   // Inspect hybrid content and store findings to a job.
-  // To review the findings inspect the job. Inspection will occur
+  // To review the findings, inspect the job. Inspection will occur
   // asynchronously.
-  // Early access feature is in a pre-release state and might change or have
-  // limited support. For more information, see
-  // https://cloud.google.com/products#product-launch-stages.
   rpc HybridInspectDlpJob(HybridInspectDlpJobRequest) returns (HybridInspectResponse) {
     option (google.api.http) = {
       post: "/v2/{name=projects/*/locations/*/dlpJobs/*}:hybridInspect"
@@ -638,9 +652,6 @@ service DlpService {
 
   // Finish a running hybrid DlpJob. Triggers the finalization steps and running
   // of any enabled actions that have not yet run.
-  // Early access feature is in a pre-release state and might change or have
-  // limited support. For more information, see
-  // https://cloud.google.com/products#product-launch-stages.
   rpc FinishDlpJob(FinishDlpJobRequest) returns (google.protobuf.Empty) {
     option (google.api.http) = {
       post: "/v2/{name=projects/*/locations/*/dlpJobs/*}:finish"
@@ -708,7 +719,8 @@ message InspectionRuleSet {
 // When used with redactContent only info_types and min_likelihood are currently
 // used.
 message InspectConfig {
-  // Configuration to control the number of findings returned.
+  // Configuration to control the number of findings returned for inspection.
+  // This is not used for de-identification or data profiling.
   message FindingLimits {
     // Max findings configuration per infoType, per content item or long
     // running DlpJob.
@@ -757,21 +769,23 @@ message InspectConfig {
   Likelihood min_likelihood = 2;
 
   // Configuration to control the number of findings returned.
+  // This is not used for data profiling.
   FindingLimits limits = 3;
 
   // When true, a contextual quote from the data that triggered a finding is
   // included in the response; see Finding.quote.
+  // This is not used for data profiling.
   bool include_quote = 4;
 
   // When true, excludes type information of the findings.
+  // This is not used for data profiling.
   bool exclude_info_types = 5;
 
   // CustomInfoTypes provided by the user. See
   // https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
   repeated CustomInfoType custom_info_types = 6;
 
-  // List of options defining data content to scan.
-  // If empty, text, images, and other content will be included.
+  // Deprecated and unused.
   repeated ContentOption content_options = 8;
 
   // Set of rules to apply to the findings for this InspectConfig.
@@ -782,7 +796,9 @@ message InspectConfig {
 
 // Container for bytes to inspect or redact.
 message ByteContentItem {
-  // The type of data being sent for inspection.
+  // The type of data being sent for inspection. To learn more, see
+  // [Supported file
+  // types](https://cloud.google.com/dlp/docs/supported-file-types).
   enum BytesType {
     // Unused
     BYTES_TYPE_UNSPECIFIED = 0;
@@ -811,6 +827,12 @@ message ByteContentItem {
     // pdf
     PDF = 8;
 
+    // pptx, pptm, potx, potm, pot
+    POWERPOINT_DOCUMENT = 9;
+
+    // xlsx, xlsm, xltx, xltm
+    EXCEL_DOCUMENT = 10;
+
     // avro
     AVRO = 11;
 
@@ -845,9 +867,9 @@ message ContentItem {
   }
 }
 
-// Structured content to inspect. Up to 50,000 `Value`s per request allowed.
-// See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
-// learn more.
+// Structured content to inspect. Up to 50,000 `Value`s per request allowed. See
+// https://cloud.google.com/dlp/docs/inspecting-structured-text#inspecting_a_table
+// to learn more.
 message Table {
   // Values of the row.
   message Row {
@@ -945,6 +967,9 @@ message Finding {
   string job_name = 13 [(google.api.resource_reference) = {
                           type: "dlp.googleapis.com/DlpJob"
                         }];
+
+  // The unique finding id.
+  string finding_id = 15;
 }
 
 // Specifies the location of the finding.
@@ -1488,16 +1513,13 @@ message InspectDataSourceDetails {
     repeated InfoTypeStats info_type_stats = 3;
 
     // Statistics related to the processing of hybrid inspect.
-    // Early access feature is in a pre-release state and might change or have
-    // limited support. For more information, see
-    // https://cloud.google.com/products#product-launch-stages.
     HybridInspectStatistics hybrid_stats = 7;
   }
 
   // The configuration used for this job.
   RequestedOptions requested_options = 2;
 
-  // A summary of the outcome of this inspect job.
+  // A summary of the outcome of this inspection job.
   Result result = 3;
 }
 
@@ -2200,7 +2222,7 @@ message TransformationErrorHandling {
 // A rule for transforming a value.
 message PrimitiveTransformation {
   oneof transformation {
-    // Replace
+    // Replace with a specified value.
     ReplaceValueConfig replace_config = 1;
 
     // Redact
@@ -2232,6 +2254,9 @@ message PrimitiveTransformation {
 
     // Deterministic Crypto
     CryptoDeterministicConfig crypto_deterministic_config = 12;
+
+    // Replace with a value randomly drawn (with replacement) from a dictionary.
+    ReplaceDictionaryConfig replace_dictionary_config = 13;
   }
 }
 
@@ -2282,7 +2307,9 @@ message CryptoHashConfig {
 // input. Outputs a base64 encoded representation of the encrypted output.
 // Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
 message CryptoDeterministicConfig {
-  // The key used by the encryption function.
+  // The key used by the encryption function. For deterministic encryption
+  // using AES-SIV, the provided key is internally expanded to 64 bytes prior to
+  // use.
   CryptoKey crypto_key = 1;
 
   // The custom info type to annotate the surrogate with.
@@ -2346,6 +2373,16 @@ message ReplaceValueConfig {
   Value new_value = 1;
 }
 
+// Replace each input value with a value randomly selected from the dictionary.
+message ReplaceDictionaryConfig {
+  oneof type {
+    // A list of words to select from for random replacement. The
+    // [limits](https://cloud.google.com/dlp/limits) page contains details about
+    // the size limits of dictionaries.
+    CustomInfoType.Dictionary.WordList word_list = 1;
+  }
+}
+
 // Replace each matching finding with the name of the info_type.
 message ReplaceWithInfoTypeConfig {
 
@@ -2429,8 +2466,8 @@ message CharacterMaskConfig {
 // the user for simple bucketing strategies.
 //
 // The transformed value will be a hyphenated string of
-// {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20
-// all values that are within this bucket will be replaced with "10-20".
+// {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound
+// = 20, all values that are within this bucket will be replaced with "10-20".
 //
 // This can be used on data of type: double, long.
 //
@@ -2593,10 +2630,11 @@ message CryptoReplaceFfxFpeConfig {
 }
 
 // This is a data encryption key (DEK) (as opposed to
-// a key encryption key (KEK) stored by KMS).
-// When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
-// IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
-// unwrap the data crypto key.
+// a key encryption key (KEK) stored by Cloud Key Management Service
+// (Cloud KMS).
+// When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate
+// IAM policy on the KEK to ensure an attacker cannot
+// unwrap the DEK.
 message CryptoKey {
   // Sources of crypto keys.
   oneof source {
@@ -2606,7 +2644,7 @@ message CryptoKey {
     // Unwrapped crypto key
     UnwrappedCryptoKey unwrapped = 2;
 
-    // Kms wrapped key
+    // Key wrapped using Cloud KMS
     KmsWrappedCryptoKey kms_wrapped = 3;
   }
 }
@@ -2631,10 +2669,16 @@ message UnwrappedCryptoKey {
 }
 
 // Include to use an existing data crypto key wrapped by KMS.
-// The wrapped key must be a 128/192/256 bit key.
+// The wrapped key must be a 128-, 192-, or 256-bit key.
 // Authorization requires the following IAM permissions when sending a request
-// to perform a crypto transformation using a kms-wrapped crypto key:
+// to perform a crypto transformation using a KMS-wrapped crypto key:
 // dlp.kms.encrypt
+//
+// For more information, see [Creating a wrapped key]
+// (https://cloud.google.com/dlp/docs/create-wrapped-key).
+//
+// Note: When you use Cloud KMS for cryptographic operations,
+// [charges apply](https://cloud.google.com/kms/pricing).
 message KmsWrappedCryptoKey {
   // Required. The wrapped data crypto key.
   bytes wrapped_key = 1 [(google.api.field_behavior) = REQUIRED];
@@ -2697,6 +2741,9 @@ message InfoTypeTransformations {
 // The transformation to apply to the field.
 message FieldTransformation {
   // Required. Input field(s) to apply the transformation to.
+  // When you have columns that reference their position within a list,
+  // omit the index from the FieldId. FieldId name matching ignores the index.
+  // For example, instead of "contact.nums[0].type", use "contact.nums.type".
   repeated FieldId fields = 1 [(google.api.field_behavior) = REQUIRED];
 
   // Only apply the transformation if the condition evaluates to true for the
@@ -2818,6 +2865,18 @@ message TransformationOverview {
 // Only one of 'transformation', 'field_transformation', or 'record_suppress'
 // will be set.
 message TransformationSummary {
+  // Possible outcomes of transformations.
+  enum TransformationResultCode {
+    // Unused
+    TRANSFORMATION_RESULT_CODE_UNSPECIFIED = 0;
+
+    // Transformation completed without an error.
+    SUCCESS = 1;
+
+    // Transformation had an error.
+    ERROR = 2;
+  }
+
   // A collection that informs the user the number of times a particular
   // `TransformationResultCode` and error details occurred.
   message SummaryResult {
@@ -2832,18 +2891,6 @@ message TransformationSummary {
     string details = 3;
   }
 
-  // Possible outcomes of transformations.
-  enum TransformationResultCode {
-    // Unused
-    TRANSFORMATION_RESULT_CODE_UNSPECIFIED = 0;
-
-    // Transformation completed without an error.
-    SUCCESS = 1;
-
-    // Transformation had an error.
-    ERROR = 2;
-  }
-
   // Set if the transformation was limited to a specific InfoType.
   InfoType info_type = 1;
 
@@ -2868,7 +2915,7 @@ message TransformationSummary {
   int64 transformed_bytes = 7;
 }
 
-// Schedule for triggeredJobs.
+// Schedule for inspect job triggers.
 message Schedule {
   oneof option {
     // With this option a job is started a regular periodic basis. For
@@ -2955,7 +3002,7 @@ message DeidentifyTemplate {
   // Output only. The last update timestamp of an inspectTemplate.
   google.protobuf.Timestamp update_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // ///////////// // The core content of the template  // ///////////////
+  // The core content of the template.
   DeidentifyConfig deidentify_config = 6;
 }
 
@@ -2985,9 +3032,6 @@ message JobTrigger {
       Schedule schedule = 1;
 
       // For use with hybrid jobs. Jobs must be manually created and finished.
-      // Early access feature is in a pre-release state and might change or have
-      // limited support. For more information, see
-      // https://cloud.google.com/products#product-launch-stages.
       Manual manual = 2;
     }
   }
@@ -3090,11 +3134,11 @@ message Action {
 
   }
 
-  // Publish findings of a DlpJob to Cloud Data Catalog. Labels summarizing the
+  // Publish findings of a DlpJob to Data Catalog. Labels summarizing the
   // results of the DlpJob will be applied to the entry for the resource scanned
-  // in Cloud Data Catalog. Any labels previously written by another DlpJob will
+  // in Data Catalog. Any labels previously written by another DlpJob will
   // be deleted. InfoType naming patterns are strictly enforced when using this
-  // feature. Note that the findings will be persisted in Cloud Data Catalog
+  // feature. Note that the findings will be persisted in Data Catalog
   // storage and are governed by Data Catalog service-specific policy, see
   // https://cloud.google.com/terms/service-terms
   // Only a single instance of this action can be specified and only allowed if
@@ -3402,10 +3446,11 @@ message CreateDlpJobRequest {
 
   // The configuration details for the specific type of job to run.
   oneof job {
-    // Set to control what and how to inspect.
+    // An inspection job scans a storage repository for InfoTypes.
     InspectJobConfig inspect_job = 2;
 
-    // Set to choose what metric to calculate.
+    // A risk analysis job calculates re-identification risk metrics for a
+    // BigQuery table.
     RiskAnalysisJobConfig risk_job = 3;
   }
 
@@ -3477,7 +3522,7 @@ message ListJobTriggersRequest {
   // * Restrictions can be combined by `AND` or `OR` logical operators. A
   // sequence of restrictions implicitly uses `AND`.
   // * A restriction has the form of `{field} {operator} {value}`.
-  // * Supported fields/values for inspect jobs:
+  // * Supported fields/values for inspect triggers:
   //     - `status` - HEALTHY|PAUSED|CANCELLED
   //     - `inspected_storage` - DATASTORE|CLOUD_STORAGE|BIGQUERY
   //     - 'last_run_time` - RFC 3339 formatted timestamp, surrounded by
@@ -3495,6 +3540,9 @@ message ListJobTriggersRequest {
   // The length of this field should be no more than 500 characters.
   string filter = 5;
 
+  // The type of jobs. Will use `DlpJobType.INSPECT` if not set.
+  DlpJobType type = 6;
+
   // Deprecated. This field has no effect.
   string location_id = 7;
 }
@@ -3538,6 +3586,134 @@ message InspectJobConfig {
   repeated Action actions = 4;
 }
 
+// A task to execute when a data profile has been generated.
+message DataProfileAction {
+  // If set, the detailed data profiles will be persisted to the location
+  // of your choice whenever updated.
+  message Export {
+    // Store all table and column profiles in an existing table or a new table
+    // in an existing dataset. Each re-generation will result in a new row in
+    // BigQuery.
+    BigQueryTable profile_table = 1;
+  }
+
+  // Send a Pub/Sub message into the given Pub/Sub topic to connect other
+  // systems to data profile generation. The message payload data will
+  // be the byte serialization of `DataProfilePubSubMessage`.
+  message PubSubNotification {
+    // The levels of detail that can be included in the Pub/Sub message.
+    enum DetailLevel {
+      // Unused.
+      DETAIL_LEVEL_UNSPECIFIED = 0;
+
+      // The full table data profile.
+      TABLE_PROFILE = 1;
+
+      // The resource name of the table.
+      RESOURCE_NAME = 2;
+    }
+
+    // Cloud Pub/Sub topic to send notifications to.
+    // Format is projects/{project}/topics/{topic}.
+    string topic = 1;
+
+    // The type of event that triggers a Pub/Sub. At most one
+    // `PubSubNotification` per EventType is permitted.
+    EventType event = 2;
+
+    // Conditions (e.g., data risk or sensitivity level) for triggering a
+    // Pub/Sub.
+    DataProfilePubSubCondition pubsub_condition = 3;
+
+    // How much data to include in the Pub/Sub message. If the user wishes to
+    // limit the size of the message, they can use resource_name and fetch the
+    // profile fields they wish to. Per table profile (not per column).
+    DetailLevel detail_of_message = 4;
+  }
+
+  // Types of event that can trigger an action.
+  enum EventType {
+    // Unused.
+    EVENT_TYPE_UNSPECIFIED = 0;
+
+    // New profile (not a re-profile).
+    NEW_PROFILE = 1;
+
+    // Changed one of the following profile metrics:
+    // * Table data risk score
+    // * Table sensitivity score
+    // * Table resource visibility
+    // * Table encryption type
+    // * Table predicted infoTypes
+    // * Table other infoTypes
+    CHANGED_PROFILE = 2;
+
+    // Table data risk score or sensitivity score increased.
+    SCORE_INCREASED = 3;
+
+    // A user (non-internal) error occurred.
+    ERROR_CHANGED = 4;
+  }
+
+  oneof action {
+    // Export data profiles into a provided location.
+    Export export_data = 1;
+
+    // Publish a message into the Pub/Sub topic.
+    PubSubNotification pub_sub_notification = 2;
+  }
+}
+
+// Configuration for setting up a job to scan resources for profile generation.
+// Only one data profile configuration may exist per organization, folder,
+// or project.
+//
+// The generated data profiles are retained according to the
+// [data retention policy]
+// (https://cloud.google.com/dlp/docs/data-profiles#retention).
+message DataProfileJobConfig {
+  // The data to scan.
+  DataProfileLocation location = 1;
+
+  // The project that will run the scan. The DLP service
+  // account that exists within this project must have access to all resources
+  // that are profiled, and the Cloud DLP API must be enabled.
+  string project_id = 5;
+
+  // Detection logic for profile generation.
+  //
+  // Not all template features are used by profiles. FindingLimits,
+  // include_quote and exclude_info_types have no impact on
+  // data profiling.
+  //
+  // Multiple templates may be provided if there is data in multiple regions.
+  // At most one template must be specified per-region (including "global").
+  // Each region is scanned using the applicable template. If no region-specific
+  // template is specified, but a "global" template is specified, it will be
+  // copied to that region and used instead. If no global or region-specific
+  // template is provided for a region with data, that region's data will not be
+  // scanned.
+  //
+  // For more information, see
+  // https://cloud.google.com/dlp/docs/data-profiles#data_residency.
+  repeated string inspect_templates = 7;
+
+  // Actions to execute at the completion of the job.
+  repeated DataProfileAction data_profile_actions = 6;
+}
+
+// The data that will be profiled.
+message DataProfileLocation {
+  // The location to be scanned.
+  oneof location {
+    // The ID of an organization to scan.
+    int64 organization_id = 1;
+
+    // The ID of the Folder within an organization to scan.
+    int64 folder_id = 2;
+  }
+}
+
 // Combines all of the information about a DLP job.
 message DlpJob {
   option (google.api.resource) = {
@@ -4312,7 +4488,7 @@ enum MatchingType {
   MATCHING_TYPE_INVERSE_MATCH = 3;
 }
 
-// Options describing which parts of the provided content should be scanned.
+// Deprecated and unused.
 enum ContentOption {
   // Includes entire content of a file or a data stream.
   CONTENT_UNSPECIFIED = 0;
@@ -4347,7 +4523,7 @@ enum InfoTypeSupportedBy {
 
 // An enum to represent the various types of DLP jobs.
 enum DlpJobType {
-  // Unused
+  // Defaults to INSPECT_JOB.
   DLP_JOB_TYPE_UNSPECIFIED = 0;
 
   // The job inspected Google Cloud for sensitive data.
@@ -4377,3 +4553,274 @@ enum StoredInfoTypeState {
   // use the `UpdateStoredInfoType` method to create a new version.
   INVALID = 4;
 }
+
+// Score is a summary of all elements in the data profile.
+// A higher number means more sensitive.
+message SensitivityScore {
+  // Various score levels for resources.
+  enum SensitivityScoreLevel {
+    // Unused.
+    SENSITIVITY_SCORE_UNSPECIFIED = 0;
+
+    // No sensitive information detected. Limited access.
+    SENSITIVITY_LOW = 10;
+
+    // Medium risk - PII, potentially sensitive data, or fields with free-text
+    // data that are at higher risk of having intermittent sensitive data.
+    // Consider limiting access.
+    SENSITIVITY_MODERATE = 20;
+
+    // High risk – SPII may be present. Exfiltration of data may lead to user
+    // data loss. Re-identification of users may be possible. Consider limiting
+    // usage and or removing SPII.
+    SENSITIVITY_HIGH = 30;
+  }
+
+  // The score applied to the resource.
+  SensitivityScoreLevel score = 1;
+}
+
+// Score is a summary of all elements in the data profile.
+// A higher number means more risky.
+message DataRiskLevel {
+  // Various score levels for resources.
+  enum DataRiskLevelScore {
+    // Unused.
+    RISK_SCORE_UNSPECIFIED = 0;
+
+    // Low risk - Lower indication of sensitive data that appears to have
+    // additional access restrictions in place or no indication of sensitive
+    // data found.
+    RISK_LOW = 10;
+
+    // Medium risk - Sensitive data may be present but additional access or fine
+    // grain access restrictions appears to be present.  Consider limiting
+    // access even further or transforming data to mask.
+    RISK_MODERATE = 20;
+
+    // High risk – SPII may be present. Access controls may include public
+    // ACLs. Exfiltration of data may lead to user data loss. Re-identification
+    // of users may be possible. Consider limiting usage and or removing SPII.
+    RISK_HIGH = 30;
+  }
+
+  // The score applied to the resource.
+  DataRiskLevelScore score = 1;
+}
+
+// How broadly a resource has been shared. New items may be added over time.
+// A higher number means more restricted.
+enum ResourceVisibility {
+  // Unused.
+  RESOURCE_VISIBILITY_UNSPECIFIED = 0;
+
+  // Visible to any user.
+  RESOURCE_VISIBILITY_PUBLIC = 10;
+
+  // Visible only to specific users.
+  RESOURCE_VISIBILITY_RESTRICTED = 20;
+}
+
+// Snapshot of the configurations used to generate the profile.
+message DataProfileConfigSnapshot {
+  // A copy of the inspection config used to generate this profile. This
+  // is a copy of the inspect_template specified in `DataProfileJobConfig`.
+  InspectConfig inspect_config = 2;
+
+  // A copy of the configuration used to generate this profile.
+  DataProfileJobConfig data_profile_job = 3;
+}
+
+// The profile for a scanned table.
+message TableDataProfile {
+  // Possible states of a profile. New items may be added.
+  enum State {
+    // Unused.
+    STATE_UNSPECIFIED = 0;
+
+    // The profile is currently running. Once a profile has finished it will
+    // transition to DONE.
+    RUNNING = 1;
+
+    // The profile is no longer generating.
+    // If profile_status.status.code is 0, the profile succeeded, otherwise, it
+    // failed.
+    DONE = 2;
+  }
+
+  // The name of the profile.
+  string name = 1;
+
+  // The resource name to the project data profile for this table.
+  string project_data_profile = 2;
+
+  // The GCP project ID that owns the BigQuery dataset.
+  string dataset_project_id = 24;
+
+  // The BigQuery location where the dataset's data is stored.
+  // See https://cloud.google.com/bigquery/docs/locations for supported
+  // locations.
+  string dataset_location = 29;
+
+  // The BigQuery dataset ID.
+  string dataset_id = 25;
+
+  // The BigQuery table ID.
+  string table_id = 26;
+
+  // The resource name of the table.
+  // https://cloud.google.com/apis/design/resource_names#full_resource_name
+  string full_resource = 3;
+
+  // Success or error status from the most recent profile generation attempt.
+  // May be empty if the profile is still being generated.
+  ProfileStatus profile_status = 21;
+
+  // State of a profile.
+  State state = 22;
+
+  // The sensitivity score of this table.
+  SensitivityScore sensitivity_score = 5;
+
+  // The data risk level of this table.
+  DataRiskLevel data_risk_level = 6;
+
+  // The infoTypes predicted from this table's data.
+  repeated InfoTypeSummary predicted_info_types = 27;
+
+  // Other infoTypes found in this table's data.
+  repeated OtherInfoTypeSummary other_info_types = 28;
+
+  // The snapshot of the configurations used to generate the profile.
+  DataProfileConfigSnapshot config_snapshot = 7;
+
+  // The time when this table was last modified
+  google.protobuf.Timestamp last_modified_time = 8;
+
+  // Optional. The time when this table expires.
+  google.protobuf.Timestamp expiration_time = 9;
+
+  // The number of columns profiled in the table.
+  int64 scanned_column_count = 10;
+
+  // The number of columns skipped in the table because of an error.
+  int64 failed_column_count = 11;
+
+  // The size of the table when the profile was generated.
+  int64 table_size_bytes = 12;
+
+  // Number of rows in the table when the profile was generated.
+  int64 row_count = 13;
+
+  // How the table is encrypted.
+  EncryptionStatus encryption_status = 14;
+
+  // How broadly a resource has been shared.
+  ResourceVisibility resource_visibility = 15;
+
+  // The last time the profile was generated.
+  google.protobuf.Timestamp profile_last_generated = 16;
+
+  // The labels applied to the resource at the time the profile was generated.
+  map<string, string> resource_labels = 17;
+
+  // The time at which the table was created.
+  google.protobuf.Timestamp create_time = 23;
+}
+
+message ProfileStatus {
+  // Profiling status code and optional message
+  google.rpc.Status status = 1;
+
+  // Time when the profile generation status was updated
+  google.protobuf.Timestamp timestamp = 3;
+}
+
+// How a resource is encrypted.
+enum EncryptionStatus {
+  // Unused.
+  ENCRYPTION_STATUS_UNSPECIFIED = 0;
+
+  // Google manages server-side encryption keys on your behalf.
+  ENCRYPTION_GOOGLE_MANAGED = 1;
+
+  // Customer provides the key.
+  ENCRYPTION_CUSTOMER_MANAGED = 2;
+}
+
+// The infoType details for this column.
+message InfoTypeSummary {
+  // The infoType.
+  InfoType info_type = 1;
+}
+
+// Infotype details for other infoTypes found within a column.
+message OtherInfoTypeSummary {
+  // The other infoType.
+  InfoType info_type = 1;
+}
+
+// A condition for determining whether a PubSub should be triggered.
+message DataProfilePubSubCondition {
+  // Various score levels for resources.
+  enum ProfileScoreBucket {
+    // Unused.
+    PROFILE_SCORE_BUCKET_UNSPECIFIED = 0;
+
+    // High risk/sensitivity detected.
+    HIGH = 1;
+
+    // Medium or high risk/sensitivity detected.
+    MEDIUM_OR_HIGH = 2;
+  }
+
+  // A condition consisting of a value.
+  message PubSubCondition {
+    // The value for the condition to trigger.
+    oneof value {
+      // The minimum data risk score that triggers the condition.
+      ProfileScoreBucket minimum_risk_score = 1;
+
+      // The minimum sensitivity level that triggers the condition.
+      ProfileScoreBucket minimum_sensitivity_score = 2;
+    }
+  }
+
+  // An expression, consisting of an operator and conditions.
+  message PubSubExpressions {
+    // Logical operators for conditional checks.
+    enum PubSubLogicalOperator {
+      // Unused.
+      LOGICAL_OPERATOR_UNSPECIFIED = 0;
+
+      // Conditional OR.
+      OR = 1;
+
+      // Conditional AND.
+      AND = 2;
+    }
+
+    // The operator to apply to the collection of conditions.
+    PubSubLogicalOperator logical_operator = 1;
+
+    // Conditions to apply to the expression.
+    repeated PubSubCondition conditions = 2;
+  }
+
+  // An expression.
+  PubSubExpressions expressions = 1;
+}
+
+// The message that will be published to a Pub/Sub topic.
+// To receive a message of protocol buffer schema type, convert the message data
+// to an object of this proto class.
+// https://cloud.google.com/pubsub/docs/samples/pubsub-subscribe-proto-messages
+message DataProfilePubSubMessage {
+  // If `DetailLevel` is `TABLE_PROFILE` this will be fully populated.
+  // Otherwise, if `DetailLevel` is `RESOURCE_NAME`, then only `name` and
+  // `full_resource` will be populated.
+  TableDataProfile profile = 1;
+
+  // The event that caused the Pub/Sub message to be sent.
+  DataProfileAction.EventType event = 2;
+}