@google-cloud/dlp 5.6.0 → 5.7.0

package/CHANGELOG.md

@@ -4,6 +4,13 @@
 
 [1]: https://www.npmjs.com/package/PACKAGE NAME?activeTab=versions
 
+## [5.7.0](https://github.com/googleapis/google-cloud-node/compare/dlp-v5.6.0...dlp-v5.7.0) (2024-06-03)
+
+
+### Features
+
+* [dlp] add secrets discovery support ([#5380](https://github.com/googleapis/google-cloud-node/issues/5380)) ([81e759d](https://github.com/googleapis/google-cloud-node/commit/81e759d8fc99473fc0109115e5fdd2b7ddd008f9))
+
 ## [5.6.0](https://github.com/googleapis/google-cloud-node/compare/dlp-v5.5.0...dlp-v5.6.0) (2024-05-21)
 
 

package/build/protos/google/privacy/dlp/v2/dlp.proto

@@ -1853,7 +1853,7 @@ message InspectDataSourceDetails {
     // inspect job.
     repeated InfoTypeStats info_type_stats = 3;
 
-    // Number of rows scanned post sampling and time filtering (Applicable for
+    // Number of rows scanned after sampling and time filtering (applicable for
     // row based stores such as BigQuery).
     int64 num_rows_processed = 5;
 
@@ -1989,6 +1989,9 @@ message InfoTypeCategory {
     // The infoType is typically used in Australia.
     AUSTRALIA = 3;
 
+    // The infoType is typically used in Azerbaijan.
+    AZERBAIJAN = 48;
+
     // The infoType is typically used in Belgium.
     BELGIUM = 4;
 
@@ -3938,7 +3941,7 @@ message Error {
   repeated google.protobuf.Timestamp timestamps = 2;
 }
 
-// Contains a configuration to make api calls on a repeating basis.
+// Contains a configuration to make API calls on a repeating basis.
 // See
 // https://cloud.google.com/sensitive-data-protection/docs/concepts-job-triggers
 // to learn more.
@@ -4773,13 +4776,9 @@ message DataProfileAction {
     // New profile (not a re-profile).
     NEW_PROFILE = 1;
 
-    // Changed one of the following profile metrics:
-    // * Data risk score
-    // * Sensitivity score
-    // * Resource visibility
-    // * Encryption type
-    // * Predicted infoTypes
-    // * Other infoTypes
+    // One of the following profile metrics changed: Data risk score,
+    // Sensitivity score, Resource visibility, Encryption type, Predicted
+    // infoTypes, Other infoTypes
     CHANGED_PROFILE = 2;
 
     // Table data risk score or sensitivity score increased.
@@ -5036,6 +5035,11 @@ message DiscoveryTarget {
     // Cloud SQL target for Discovery. The first target to match a table will be
     // the one applied.
     CloudSqlDiscoveryTarget cloud_sql_target = 2;
+
+    // Discovery target that looks for credentials and secrets stored in cloud
+    // resource metadata and reports them as vulnerabilities to Security Command
+    // Center. Only one target of this type is allowed.
+    SecretsDiscoveryTarget secrets_target = 3;
   }
 }
 
@@ -5088,6 +5092,11 @@ message DiscoveryBigQueryFilter {
     // configuration. If none is specified, a default one will be added
     // automatically.
     AllOtherBigQueryTables other_tables = 2;
+
+    // The table to scan. Discovery configurations including this can only
+    // include one DiscoveryTarget (the DiscoveryTarget with this
+    // TableReference).
+    TableReference table_reference = 3;
   }
 }
 
@@ -5272,7 +5281,7 @@ message DatabaseResourceRegexes {
 // under the google/re2 repository on GitHub.
 message DatabaseResourceRegex {
   // For organizations, if unset, will match all projects. Has no effect
-  // for Data Profile configurations created within a project.
+  // for configurations created within a project.
   string project_id_regex = 1;
 
   // Regex to test the instance name against. If empty, all instances match.
@@ -5294,12 +5303,19 @@ message AllOtherDatabaseResources {}
 // Identifies a single database resource, like a table within a database.
 message DatabaseResourceReference {
   // Required. If within a project-level config, then this must match the
-  // config's project id.
+  // config's project ID.
   string project_id = 1 [(google.api.field_behavior) = REQUIRED];
 
   // Required. The instance where this resource is located. For example: Cloud
-  // SQL's instance id.
+  // SQL instance ID.
   string instance = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. Name of a database within the instance.
+  string database = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. Name of a database resource, for example, a table within the
+  // database.
+  string database_resource = 4 [(google.api.field_behavior) = REQUIRED];
 }
 
 // Requirements that must be true before a table is profiled for the
@@ -5313,10 +5329,10 @@ message DiscoveryCloudSqlConditions {
     // Include all supported database engines.
     ALL_SUPPORTED_DATABASE_ENGINES = 1;
 
-    // MySql database.
+    // MySQL database.
     MYSQL = 2;
 
-    // PostGres database.
+    // PostgreSQL database.
     POSTGRES = 3;
   }
 
@@ -5347,14 +5363,14 @@ message DiscoveryCloudSqlConditions {
 // New tables are scanned as quickly as possible depending on system
 // capacity.
 message DiscoveryCloudSqlGenerationCadence {
-  // How frequency to modify the profile when the table's schema is modified.
+  // How frequently to modify the profile when the table's schema is modified.
   message SchemaModifiedCadence {
     // The type of modification that causes a profile update.
     enum CloudSqlSchemaModification {
       // Unused.
       SQL_SCHEMA_MODIFICATION_UNSPECIFIED = 0;
 
-      // New columns has appeared.
+      // New columns have appeared.
       NEW_COLUMNS = 1;
 
       // Columns have been removed from the table.
@@ -5375,11 +5391,25 @@ message DiscoveryCloudSqlGenerationCadence {
 
   // Data changes (non-schema changes) in Cloud SQL tables can't trigger
   // reprofiling. If you set this field, profiles are refreshed at this
-  // frequency regardless of whether the underlying tables have changes.
+  // frequency regardless of whether the underlying tables have changed.
   // Defaults to never.
   DataProfileUpdateFrequency refresh_frequency = 2;
 }
 
+// Discovery target for credentials and secrets in cloud resource metadata.
+//
+// This target does not include any filtering or frequency controls. Cloud
+// DLP will scan cloud resource metadata for secrets daily.
+//
+// No inspect template should be included in the discovery config for a
+// security benchmarks scan. Instead, the built-in list of secrets and
+// credentials infoTypes will be used (see
+// https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference#credentials_and_secrets).
+//
+// Credentials and secrets discovered will be reported as vulnerabilities to
+// Security Command Center.
+message SecretsDiscoveryTarget {}
+
 // The location to begin a discovery scan. Denotes an organization ID or folder
 // ID within an organization.
 message DiscoveryStartingLocation {
@@ -6523,8 +6553,8 @@ enum ResourceVisibility {
   RESOURCE_VISIBILITY_PUBLIC = 10;
 
   // May contain public items.
-  // For example, if a GCS bucket has uniform bucket level access disabled, some
-  // objects inside it may be public.
+  // For example, if a Cloud Storage bucket has uniform bucket level access
+  // disabled, some objects inside it may be public.
   RESOURCE_VISIBILITY_INCONCLUSIVE = 15;
 
   // Visible only to specific users.
@@ -7049,8 +7079,7 @@ message ListConnectionsRequest {
   // results. If set, all other request fields must match the original request.
   string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. * Supported fields/values
-  //     - `state` - MISSING|AVAILABLE|ERROR
+  // Optional. Supported field/value: `state` - MISSING|AVAILABLE|ERROR
   string filter = 4 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -7072,8 +7101,7 @@ message SearchConnectionsRequest {
   // results. If set, all other request fields must match the original request.
   string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. * Supported fields/values
-  //     - `state` - MISSING|AVAILABLE|ERROR
+  // Optional. Supported field/value: - `state` - MISSING|AVAILABLE|ERROR
   string filter = 4 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -7168,10 +7196,10 @@ enum ConnectionState {
   // A configured connection that encountered errors during its last use. It
   // will not be used again until it is set to AVAILABLE.
   //
-  // If the resolution requires external action, then a request to set the
-  // status to AVAILABLE will mark this connection for use. Otherwise, any
-  // changes to the connection properties will automatically mark it as
-  // AVAILABLE.
+  // If the resolution requires external action, then the client must send a
+  // request to set the status to AVAILABLE when the connection is ready for
+  // use. If the resolution doesn't require external action, then any changes to
+  // the connection properties will automatically mark it as AVAILABLE.
   ERROR = 3;
 }
 
@@ -7189,8 +7217,8 @@ message SecretManagerCredential {
       [(google.api.field_behavior) = REQUIRED];
 }
 
-// Use IAM auth to connect. This requires the Cloud SQL IAM feature to be
-// enabled on the instance, which is not the default for Cloud SQL.
+// Use IAM authentication to connect. This requires the Cloud SQL IAM feature
+// to be enabled on the instance, which is not the default for Cloud SQL.
 // See https://cloud.google.com/sql/docs/postgres/authentication and
 // https://cloud.google.com/sql/docs/mysql/authentication.
 message CloudSqlIamCredential {}
@@ -7200,13 +7228,13 @@ message CloudSqlProperties {
   // Database engine of a Cloud SQL instance.
   // New values may be added over time.
   enum DatabaseEngine {
-    // An engine that is not currently supported by SDP.
+    // An engine that is not currently supported by Sensitive Data Protection.
     DATABASE_ENGINE_UNKNOWN = 0;
 
     // Cloud SQL for MySQL instance.
     DATABASE_ENGINE_MYSQL = 1;
 
-    // Cloud SQL for Postgres instance.
+    // Cloud SQL for PostgreSQL instance.
     DATABASE_ENGINE_POSTGRES = 2;
   }
 

package/build/protos/google/privacy/dlp/v2/storage.proto

@@ -859,6 +859,16 @@ message BigQueryTable {
   string table_id = 3;
 }
 
+// Message defining the location of a BigQuery table with the projectId inferred
+// from the parent project.
+message TableReference {
+  // Dataset ID of the table.
+  string dataset_id = 1;
+
+  // Name of the table.
+  string table_id = 2;
+}
+
 // Message defining a field of a BigQuery table.
 message BigQueryField {
   // Source table of the field.

package/build/protos/protos.d.ts

@@ -6651,6 +6651,7 @@ export namespace google {
                         GLOBAL = 1,
                         ARGENTINA = 2,
                         AUSTRALIA = 3,
+                        AZERBAIJAN = 48,
                         BELGIUM = 4,
                         BRAZIL = 5,
                         CANADA = 6,
@@ -21259,6 +21260,9 @@ export namespace google {
 
                     /** DiscoveryTarget cloudSqlTarget */
                     cloudSqlTarget?: (google.privacy.dlp.v2.ICloudSqlDiscoveryTarget|null);
+
+                    /** DiscoveryTarget secretsTarget */
+                    secretsTarget?: (google.privacy.dlp.v2.ISecretsDiscoveryTarget|null);
                 }
 
                 /** Represents a DiscoveryTarget. */
@@ -21276,8 +21280,11 @@ export namespace google {
                     /** DiscoveryTarget cloudSqlTarget. */
                     public cloudSqlTarget?: (google.privacy.dlp.v2.ICloudSqlDiscoveryTarget|null);
 
+                    /** DiscoveryTarget secretsTarget. */
+                    public secretsTarget?: (google.privacy.dlp.v2.ISecretsDiscoveryTarget|null);
+
                     /** DiscoveryTarget target. */
-                    public target?: ("bigQueryTarget"|"cloudSqlTarget");
+                    public target?: ("bigQueryTarget"|"cloudSqlTarget"|"secretsTarget");
 
                     /**
                      * Creates a new DiscoveryTarget instance using the specified properties.
@@ -21483,6 +21490,9 @@ export namespace google {
 
                     /** DiscoveryBigQueryFilter otherTables */
                     otherTables?: (google.privacy.dlp.v2.DiscoveryBigQueryFilter.IAllOtherBigQueryTables|null);
+
+                    /** DiscoveryBigQueryFilter tableReference */
+                    tableReference?: (google.privacy.dlp.v2.ITableReference|null);
                 }
 
                 /** Represents a DiscoveryBigQueryFilter. */
@@ -21500,8 +21510,11 @@ export namespace google {
                     /** DiscoveryBigQueryFilter otherTables. */
                     public otherTables?: (google.privacy.dlp.v2.DiscoveryBigQueryFilter.IAllOtherBigQueryTables|null);
 
+                    /** DiscoveryBigQueryFilter tableReference. */
+                    public tableReference?: (google.privacy.dlp.v2.ITableReference|null);
+
                     /** DiscoveryBigQueryFilter filter. */
-                    public filter?: ("tables"|"otherTables");
+                    public filter?: ("tables"|"otherTables"|"tableReference");
 
                     /**
                      * Creates a new DiscoveryBigQueryFilter instance using the specified properties.
@@ -22962,6 +22975,12 @@ export namespace google {
 
                     /** DatabaseResourceReference instance */
                     instance?: (string|null);
+
+                    /** DatabaseResourceReference database */
+                    database?: (string|null);
+
+                    /** DatabaseResourceReference databaseResource */
+                    databaseResource?: (string|null);
                 }
 
                 /** Represents a DatabaseResourceReference. */
@@ -22979,6 +22998,12 @@ export namespace google {
                     /** DatabaseResourceReference instance. */
                     public instance: string;
 
+                    /** DatabaseResourceReference database. */
+                    public database: string;
+
+                    /** DatabaseResourceReference databaseResource. */
+                    public databaseResource: string;
+
                     /**
                      * Creates a new DatabaseResourceReference instance using the specified properties.
                      * @param [properties] Properties to set
@@ -23397,6 +23422,97 @@ export namespace google {
                     }
                 }
 
+                /** Properties of a SecretsDiscoveryTarget. */
+                interface ISecretsDiscoveryTarget {
+                }
+
+                /** Represents a SecretsDiscoveryTarget. */
+                class SecretsDiscoveryTarget implements ISecretsDiscoveryTarget {
+
+                    /**
+                     * Constructs a new SecretsDiscoveryTarget.
+                     * @param [properties] Properties to set
+                     */
+                    constructor(properties?: google.privacy.dlp.v2.ISecretsDiscoveryTarget);
+
+                    /**
+                     * Creates a new SecretsDiscoveryTarget instance using the specified properties.
+                     * @param [properties] Properties to set
+                     * @returns SecretsDiscoveryTarget instance
+                     */
+                    public static create(properties?: google.privacy.dlp.v2.ISecretsDiscoveryTarget): google.privacy.dlp.v2.SecretsDiscoveryTarget;
+
+                    /**
+                     * Encodes the specified SecretsDiscoveryTarget message. Does not implicitly {@link google.privacy.dlp.v2.SecretsDiscoveryTarget.verify|verify} messages.
+                     * @param message SecretsDiscoveryTarget message or plain object to encode
+                     * @param [writer] Writer to encode to
+                     * @returns Writer
+                     */
+                    public static encode(message: google.privacy.dlp.v2.ISecretsDiscoveryTarget, writer?: $protobuf.Writer): $protobuf.Writer;
+
+                    /**
+                     * Encodes the specified SecretsDiscoveryTarget message, length delimited. Does not implicitly {@link google.privacy.dlp.v2.SecretsDiscoveryTarget.verify|verify} messages.
+                     * @param message SecretsDiscoveryTarget message or plain object to encode
+                     * @param [writer] Writer to encode to
+                     * @returns Writer
+                     */
+                    public static encodeDelimited(message: google.privacy.dlp.v2.ISecretsDiscoveryTarget, writer?: $protobuf.Writer): $protobuf.Writer;
+
+                    /**
+                     * Decodes a SecretsDiscoveryTarget message from the specified reader or buffer.
+                     * @param reader Reader or buffer to decode from
+                     * @param [length] Message length if known beforehand
+                     * @returns SecretsDiscoveryTarget
+                     * @throws {Error} If the payload is not a reader or valid buffer
+                     * @throws {$protobuf.util.ProtocolError} If required fields are missing
+                     */
+                    public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): google.privacy.dlp.v2.SecretsDiscoveryTarget;
+
+                    /**
+                     * Decodes a SecretsDiscoveryTarget message from the specified reader or buffer, length delimited.
+                     * @param reader Reader or buffer to decode from
+                     * @returns SecretsDiscoveryTarget
+                     * @throws {Error} If the payload is not a reader or valid buffer
+                     * @throws {$protobuf.util.ProtocolError} If required fields are missing
+                     */
+                    public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): google.privacy.dlp.v2.SecretsDiscoveryTarget;
+
+                    /**
+                     * Verifies a SecretsDiscoveryTarget message.
+                     * @param message Plain object to verify
+                     * @returns `null` if valid, otherwise the reason why it is not
+                     */
+                    public static verify(message: { [k: string]: any }): (string|null);
+
+                    /**
+                     * Creates a SecretsDiscoveryTarget message from a plain object. Also converts values to their respective internal types.
+                     * @param object Plain object
+                     * @returns SecretsDiscoveryTarget
+                     */
+                    public static fromObject(object: { [k: string]: any }): google.privacy.dlp.v2.SecretsDiscoveryTarget;
+
+                    /**
+                     * Creates a plain object from a SecretsDiscoveryTarget message. Also converts values to other types if specified.
+                     * @param message SecretsDiscoveryTarget
+                     * @param [options] Conversion options
+                     * @returns Plain object
+                     */
+                    public static toObject(message: google.privacy.dlp.v2.SecretsDiscoveryTarget, options?: $protobuf.IConversionOptions): { [k: string]: any };
+
+                    /**
+                     * Converts this SecretsDiscoveryTarget to JSON.
+                     * @returns JSON object
+                     */
+                    public toJSON(): { [k: string]: any };
+
+                    /**
+                     * Gets the default type url for SecretsDiscoveryTarget
+                     * @param [typeUrlPrefix] your custom typeUrlPrefix(default "type.googleapis.com")
+                     * @returns The default type url
+                     */
+                    public static getTypeUrl(typeUrlPrefix?: string): string;
+                }
+
                 /** Properties of a DiscoveryStartingLocation. */
                 interface IDiscoveryStartingLocation {
 
@@ -34328,6 +34444,109 @@ export namespace google {
                     public static getTypeUrl(typeUrlPrefix?: string): string;
                 }
 
+                /** Properties of a TableReference. */
+                interface ITableReference {
+
+                    /** TableReference datasetId */
+                    datasetId?: (string|null);
+
+                    /** TableReference tableId */
+                    tableId?: (string|null);
+                }
+
+                /** Represents a TableReference. */
+                class TableReference implements ITableReference {
+
+                    /**
+                     * Constructs a new TableReference.
+                     * @param [properties] Properties to set
+                     */
+                    constructor(properties?: google.privacy.dlp.v2.ITableReference);
+
+                    /** TableReference datasetId. */
+                    public datasetId: string;
+
+                    /** TableReference tableId. */
+                    public tableId: string;
+
+                    /**
+                     * Creates a new TableReference instance using the specified properties.
+                     * @param [properties] Properties to set
+                     * @returns TableReference instance
+                     */
+                    public static create(properties?: google.privacy.dlp.v2.ITableReference): google.privacy.dlp.v2.TableReference;
+
+                    /**
+                     * Encodes the specified TableReference message. Does not implicitly {@link google.privacy.dlp.v2.TableReference.verify|verify} messages.
+                     * @param message TableReference message or plain object to encode
+                     * @param [writer] Writer to encode to
+                     * @returns Writer
+                     */
+                    public static encode(message: google.privacy.dlp.v2.ITableReference, writer?: $protobuf.Writer): $protobuf.Writer;
+
+                    /**
+                     * Encodes the specified TableReference message, length delimited. Does not implicitly {@link google.privacy.dlp.v2.TableReference.verify|verify} messages.
+                     * @param message TableReference message or plain object to encode
+                     * @param [writer] Writer to encode to
+                     * @returns Writer
+                     */
+                    public static encodeDelimited(message: google.privacy.dlp.v2.ITableReference, writer?: $protobuf.Writer): $protobuf.Writer;
+
+                    /**
+                     * Decodes a TableReference message from the specified reader or buffer.
+                     * @param reader Reader or buffer to decode from
+                     * @param [length] Message length if known beforehand
+                     * @returns TableReference
+                     * @throws {Error} If the payload is not a reader or valid buffer
+                     * @throws {$protobuf.util.ProtocolError} If required fields are missing
+                     */
+                    public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): google.privacy.dlp.v2.TableReference;
+
+                    /**
+                     * Decodes a TableReference message from the specified reader or buffer, length delimited.
+                     * @param reader Reader or buffer to decode from
+                     * @returns TableReference
+                     * @throws {Error} If the payload is not a reader or valid buffer
+                     * @throws {$protobuf.util.ProtocolError} If required fields are missing
+                     */
+                    public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): google.privacy.dlp.v2.TableReference;
+
+                    /**
+                     * Verifies a TableReference message.
+                     * @param message Plain object to verify
+                     * @returns `null` if valid, otherwise the reason why it is not
+                     */
+                    public static verify(message: { [k: string]: any }): (string|null);
+
+                    /**
+                     * Creates a TableReference message from a plain object. Also converts values to their respective internal types.
+                     * @param object Plain object
+                     * @returns TableReference
+                     */
+                    public static fromObject(object: { [k: string]: any }): google.privacy.dlp.v2.TableReference;
+
+                    /**
+                     * Creates a plain object from a TableReference message. Also converts values to other types if specified.
+                     * @param message TableReference
+                     * @param [options] Conversion options
+                     * @returns Plain object
+                     */
+                    public static toObject(message: google.privacy.dlp.v2.TableReference, options?: $protobuf.IConversionOptions): { [k: string]: any };
+
+                    /**
+                     * Converts this TableReference to JSON.
+                     * @returns JSON object
+                     */
+                    public toJSON(): { [k: string]: any };
+
+                    /**
+                     * Gets the default type url for TableReference
+                     * @param [typeUrlPrefix] your custom typeUrlPrefix(default "type.googleapis.com")
+                     * @returns The default type url
+                     */
+                    public static getTypeUrl(typeUrlPrefix?: string): string;
+                }
+
                 /** Properties of a BigQueryField. */
                 interface IBigQueryField {