@volcengine/pulumi-volcenginecc 0.0.43 → 0.0.44

package/types/input.d.ts

@@ -4768,6 +4768,20 @@ export declare namespace cr {
          */
         value?: pulumi.Input<string>;
     }
+    interface VpcEndpointVpc {
+        /**
+         * Primary account ID for the VPC
+         */
+        accountId?: pulumi.Input<number>;
+        /**
+         * Subnet ID
+         */
+        subnetId?: pulumi.Input<string>;
+        /**
+         * VPC ID。
+         */
+        vpcId?: pulumi.Input<string>;
+    }
 }
 export declare namespace directconnect {
     interface DirectConnectGatewayAssociateCen {
@@ -6875,6 +6889,22 @@ export declare namespace fwcenter {
     }
 }
 export declare namespace gtm {
+    interface PolicyStatistics {
+        /**
+         * Number of available addresses
+         */
+        activeAddr?: pulumi.Input<number>;
+        /**
+         * Number of unavailable addresses
+         */
+        inactiveAddr?: pulumi.Input<number>;
+    }
+    interface PolicyTarget {
+        /**
+         * Address pool ID.
+         */
+        poolId?: pulumi.Input<string>;
+    }
     interface PoolAddress {
         /**
          * Address capacity
@@ -7505,6 +7535,16 @@ export declare namespace kafka {
          */
         instanceId?: pulumi.Input<string>;
     }
+    interface GroupTag {
+        /**
+         * Tag key
+         */
+        key?: pulumi.Input<string>;
+        /**
+         * Tag value
+         */
+        value?: pulumi.Input<string>;
+    }
     interface InstanceChargeInfo {
         /**
          * Whether to automatically renew the subscription instance after expiration. true   - auto renewal; false (default)   - no auto renewal, instance will be stopped upon expiration.
@@ -8763,32 +8803,12 @@ export declare namespace rdsmysql {
          * Instance ID bound to the current allowlist.
          */
         instanceId?: pulumi.Input<string>;
-        /**
-         * Instance name bound to the current allowlist.
-         */
-        instanceName?: pulumi.Input<string>;
-        /**
-         * Instance status.
-         */
-        instanceStatus?: pulumi.Input<string>;
-        /**
-         * Has the latest allowlist been synchronized? Values: true: Yes. false: No. Note: When modifying the allowlist, if the instance is not running, changes to the allowlist will not be immediately synchronized to the instance.
-         */
-        isLatest?: pulumi.Input<boolean>;
-        /**
-         * Private network ID of the instance.
-         */
-        vpc?: pulumi.Input<string>;
     }
     interface AllowListSecurityGroupBindInfo {
         /**
          * Mode for associating security groups. Values: IngressDirectionIp: Inbound IP. AssociateEcsIp: Associate ECS IP. Note: In the CreateAllowList API, the BindMode and SecurityGroupId fields of SecurityGroupBindInfoObject are required.
          */
         bindMode?: pulumi.Input<string>;
-        /**
-         * Security group IP address list.
-         */
-        ipLists?: pulumi.Input<pulumi.Input<string>[]>;
         /**
          * Security group ID.
          */
@@ -9878,6 +9898,16 @@ export declare namespace redis {
     }
 }
 export declare namespace rocketmq {
+    interface AccessKeyTopicPermission {
+        /**
+         * Permission type. AccessKey has permissions for this Topic. ALL: Publish and subscribe permissions. PUB: Publish permission. SUB: Subscribe permission. DENY: No publish or subscribe permissions
+         */
+        permission?: pulumi.Input<string>;
+        /**
+         * Topic name
+         */
+        topicName?: pulumi.Input<string>;
+    }
     interface AllowListAssociatedInstance {
         /**
          * Instance ID
@@ -10492,248 +10522,692 @@ export declare namespace tls {
          */
         severity?: pulumi.Input<string>;
     }
-    interface ImportTaskImportSourceInfo {
+    interface EtlTargetResource {
         /**
-         * Kafka data source information. When sourceType is kafka, the KafkaSourceInfo field is required
+         * Name of the custom output target. You must use this name to refer to the output target in the data processing rules
          */
-        kafkaSourceInfo?: pulumi.Input<inputs.tls.ImportTaskImportSourceInfoKafkaSourceInfo>;
+        alias: pulumi.Input<string>;
         /**
-         * TOS data source information. When sourceType is tos, the TosSourceInfo field is required.
+         * Region of the log topic for storing processed logs
          */
-        tosSourceInfo?: pulumi.Input<inputs.tls.ImportTaskImportSourceInfoTosSourceInfo>;
-    }
-    interface ImportTaskImportSourceInfoKafkaSourceInfo {
+        region: pulumi.Input<string>;
         /**
-         * Data encoding format. Available options: UTF-8, GBK.
+         * Cross-account authorization role name
          */
-        encode?: pulumi.Input<string>;
+        roleTrn?: pulumi.Input<string>;
         /**
-         * Kafka consumer group. If not specified, the system will automatically create a Kafka consumer group.
+         * Log topic ID for storing processed logs
          */
-        group?: pulumi.Input<string>;
+        topicId: pulumi.Input<string>;
+    }
+    interface HostGroupRule {
         /**
-         * The service addresses for different types of Kafka clusters vary. Details are as follows: Message Queue Kafka Edition: Use the access point of the Kafka instance. For more information, see Access Point. If the Kafka instance and the Log Service Project are in the same region, you can use private network access; otherwise, use public network access. Self-hosted Kafka clusters: Use the IP address and port number or the domain name and port number of the Kafka Broker. Only public network access is supported. Separate multiple service addresses with a comma (,).
+         * Container collection rules
          */
-        host?: pulumi.Input<string>;
+        containerRule?: pulumi.Input<inputs.tls.HostGroupRuleContainerRule>;
         /**
-         * Starting position for data import. Options: 0: Earliest time, start importing from the first record in the specified Kafka Topic. 1: Latest time, start importing from the most recently generated record in the specified Kafka Topic.
+         * Time when the collection configuration was created.
          */
-        initialOffset?: pulumi.Input<number>;
+        createTime?: pulumi.Input<string>;
+        excludePaths?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleExcludePath>[]>;
         /**
-         * If you are using Message Queue Kafka Edition, set this to the Kafka instance ID.
+         * Extraction rules
          */
-        instanceId?: pulumi.Input<string>;
+        extractRule?: pulumi.Input<inputs.tls.HostGroupRuleExtractRule>;
         /**
-         * Whether to enable authentication. If you use a public service address, it is recommended to enable authentication.
+         * Collection type. 0: Host log file. 1: K8s container standard output. 2: Log file inside K8s container.
          */
-        isNeedAuth?: pulumi.Input<boolean>;
+        inputType?: pulumi.Input<number>;
         /**
-         * Password authentication mechanism. Available options: PLAIN, SCRAM-SHA-256, and SCRAM-SHA-512.
+         * Log sample.
          */
-        mechanism?: pulumi.Input<string>;
+        logSample?: pulumi.Input<string>;
         /**
-         * Kafka SASL user password for authentication.
+         * Collection modes. minimalist*log: single-line full mode. json*log: JSON mode. delimiter*log: delimiter mode. multiline*log: multi-line full mode. fullregex_log: full regex mode.
          */
-        password?: pulumi.Input<string>;
+        logType?: pulumi.Input<string>;
         /**
-         * Secure transmission protocol. Options include plaintext, sasl*ssl, ssl, and sasl*plaintext
+         * Time when the collection configuration was modified.
          */
-        protocol?: pulumi.Input<string>;
+        modifyTime?: pulumi.Input<string>;
         /**
-         * Specify log time. Options: 0: Use Kafka message timestamp. 1: Use current system time.
+         * Data collection path list
          */
-        timeSourceDefault?: pulumi.Input<number>;
+        paths?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Kafka Topic name. Separate multiple Kafka Topics with commas (,).
+         * Running status of the collection configuration. 0: Running. 1: Paused.
          */
-        topic?: pulumi.Input<string>;
+        pause?: pulumi.Input<number>;
         /**
-         * Kafka SASL username for authentication.
+         * Collection configuration ID.
          */
-        username?: pulumi.Input<string>;
-    }
-    interface ImportTaskImportSourceInfoTosSourceInfo {
+        ruleId?: pulumi.Input<string>;
         /**
-         * TOS bucket name
+         * Name of the collection configuration.
          */
-        bucket?: pulumi.Input<string>;
+        ruleName?: pulumi.Input<string>;
         /**
-         * Compression mode for data in the TOS bucket. none: No compression. snappy: Compress using snappy. gzip: Compress using gzip. lz4: Compress using lz4.
+         * ID of the log topic to which the collection configuration belongs.
          */
-        compressType?: pulumi.Input<string>;
+        topicId?: pulumi.Input<string>;
         /**
-         * Path of the file to be imported in the TOS bucket.
+         * Name of the log topic associated with the collection configuration
          */
-        prefix?: pulumi.Input<string>;
+        topicName?: pulumi.Input<string>;
         /**
-         * Region where the TOS bucket is located. Cross-region data import is supported
+         * User-defined collection rules.
          */
-        region?: pulumi.Input<string>;
+        userDefineRule?: pulumi.Input<inputs.tls.HostGroupRuleUserDefineRule>;
     }
-    interface ImportTaskTargetInfo {
-        /**
-         * Log extraction rule.
-         */
-        extractRule?: pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRule>;
+    interface HostGroupRuleContainerRule {
         /**
-         * Log sample. When LogType is set to multiline_log, you must configure log samples. It is recommended to provide more than two log entries as examples to ensure the regular expression matches the first line of each log. Use real samples from the production environment.
+         * Container name to collect. If no container name is specified, all containers in the machine group are collected. Supports regular expressions. For example, setting the container name to ^(container-test)$ collects all containers named container-test.
          */
-        logSample?: pulumi.Input<string>;
+        containerNameRegex?: pulumi.Input<string>;
+        envTags?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleEnvTag>[]>;
+        excludeContainerEnvRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleExcludeContainerEnvRegex>[]>;
+        excludeContainerLabelRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleExcludeContainerLabelRegex>[]>;
+        includeContainerEnvRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleIncludeContainerEnvRegex>[]>;
+        includeContainerLabelRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleIncludeContainerLabelRegex>[]>;
         /**
-         * Specify log parsing type during import. delimiter*log: CSV type. multiline*log: multiline full text type. minimalist*log: single line full text type. json*log: JSON type.
+         * Kubernetes container collection rules.
          */
-        logType: pulumi.Input<string>;
+        kubernetesRule?: pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRule>;
         /**
-         * Region.
+         * Collection information. stdout: Container standard output (stdout). stderr: Container standard error (stderr). all: Both container standard output (stdout) and standard error (stderr).
          */
-        region: pulumi.Input<string>;
+        stream?: pulumi.Input<string>;
     }
-    interface ImportTaskTargetInfoExtractRule {
+    interface HostGroupRuleContainerRuleEnvTag {
         /**
-         * Basic content of log extraction rules.
+         * Key.
          */
-        extractRule?: pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRuleExtractRule>;
+        key?: pulumi.Input<string>;
         /**
-         * Number of skipped rows. Only valid when the log type is delimiterLog and the import type is tos.
+         * Value.
          */
-        skipLineCount?: pulumi.Input<number>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleExcludeContainerEnvRegex {
         /**
-         * Time extraction regular expression, used to extract the time value from the TimeKey field and parse it as the collection time
+         * Key.
          */
-        timeExtractRegex?: pulumi.Input<string>;
+        key?: pulumi.Input<string>;
         /**
-         * Time zone. Supports machine time zone (default) and custom time zone. Custom time zone supports GMT and UTC. GMT format: GMT+08:00. UTC format: Asia/Shanghai.
+         * Value.
          */
-        timeZone?: pulumi.Input<string>;
+        val?: pulumi.Input<string>;
     }
-    interface ImportTaskTargetInfoExtractRuleExtractRule {
+    interface HostGroupRuleContainerRuleExcludeContainerLabelRegex {
         /**
-         * Regular expression for identifying the first line of each log. The matched part is treated as the start of the log. When LogType is set to multiline_log, you must configure a log sample
+         * Key.
          */
-        beginRegex?: pulumi.Input<string>;
+        key?: pulumi.Input<string>;
         /**
-         * Delimiter. Only valid when LogType is delimiter_log.
+         * Value.
          */
-        delimiter?: pulumi.Input<string>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleIncludeContainerEnvRegex {
         /**
-         * Enable nanoseconds.
+         * Key.
          */
-        enableNanosecond?: pulumi.Input<boolean>;
-        filterKeyRegexes?: pulumi.Input<pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRuleExtractRuleFilterKeyRegex>[]>;
+        key?: pulumi.Input<string>;
         /**
-         * List of log field names (Key). Valid only when LogType is delimiter_log. Supports up to 100 field names. Duplicate field names are not allowed, and all field names cannot be left blank
+         * Value.
          */
-        keys?: pulumi.Input<pulumi.Input<string>[]>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleIncludeContainerLabelRegex {
         /**
-         * Log regular expression
+         * Key.
          */
-        logRegex?: pulumi.Input<string>;
+        key?: pulumi.Input<string>;
         /**
-         * Log template.
+         * Value.
          */
-        logTemplate?: pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRuleExtractRuleLogTemplate>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleKubernetesRule {
+        annotationTags?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRuleAnnotationTag>[]>;
         /**
-         * Quotation mark. Content enclosed by the quotation mark will not be separated and will be parsed as a complete field. Only valid when LogType is delimiter_log.
+         * Whether to add all Kubernetes Labels as log tags to the raw log data. When enabled, the log service adds fields for all Labels in the Kubernetes Pod to the log. For example, if the Pod has Label source=DC and destination=CS, the log will include fields **tag**source__: DC and **tag**destination__: CS.
          */
-        quote?: pulumi.Input<string>;
+        enableAllLabelTag?: pulumi.Input<boolean>;
+        excludePodAnnotationRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRuleExcludePodAnnotationRegex>[]>;
+        excludePodLabelRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRuleExcludePodLabelRegex>[]>;
+        includePodAnnotationRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRuleIncludePodAnnotationRegex>[]>;
+        includePodLabelRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRuleIncludePodLabelRegex>[]>;
+        labelTags?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleContainerRuleKubernetesRuleLabelTag>[]>;
         /**
-         * Parsing format for the time field. If you use a specified time field in the log as the log timestamp, you must fill in TimeKey and TimeFormat. TimeKey and TimeFormat must be paired. For configuration details, see time format.
+         * Name of the Kubernetes Namespace to be collected. If not specified, all containers are collected. Namespace names support regular expression matching. For example, setting the Namespace name to ^(tcp|udp)$ collects all containers under the tcp and udp namespaces.
          */
-        timeFormat?: pulumi.Input<string>;
+        namespaceNameRegex?: pulumi.Input<string>;
         /**
-         * Name of the log time field. If you use a specific time field in the log as the log timestamp, you must provide both TimeKey and TimeFormat. TimeKey and TimeFormat must appear in pairs
+         * Pod name is used to specify the Pod(s) to be collected. If the Pod name is not specified, all containers are collected. Pod name supports regex matching. For example, setting the Pod name to ^(http.*)$ collects all containers under Pods whose names start with http.
          */
-        timeKey?: pulumi.Input<string>;
+        podNameRegex?: pulumi.Input<string>;
         /**
-         * Time sample. Used to verify whether the entered time parsing format is correct
+         * Specify the container to collect by workload name. If no workload name is specified, all containers are collected. Workload names support regular expressions. For example, setting the workload name to ^(http.*)$ collects all containers under workloads starting with http.
          */
-        timeSample?: pulumi.Input<string>;
+        workloadNameRegex?: pulumi.Input<string>;
         /**
-         * When uploading logs that failed to parse, specify the key name for the failed logs. UnMatchUpLoadSwitch=true and UnMatchLogKey must be used together.
+         * Specify containers to collect by workload type. Only one type can be selected. If no type is specified, containers of all types will be collected. Supported workload types are: Deployment: stateless workload StatefulSet: stateful workload DaemonSet: daemon process Job: job CronJob: scheduled job
          */
-        unMatchLogKey?: pulumi.Input<string>;
+        workloadType?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleKubernetesRuleAnnotationTag {
         /**
-         * Whether to upload logs that failed to parse. UnMatchUpLoadSwitch=true and UnMatchLogKey must be paired. true: Upload logs that failed to parse. false: Do not upload logs that failed to parse.
+         * Key.
          */
-        unMatchUpLoadSwitch?: pulumi.Input<boolean>;
+        key?: pulumi.Input<string>;
+        /**
+         * Value.
+         */
+        val?: pulumi.Input<string>;
     }
-    interface ImportTaskTargetInfoExtractRuleExtractRuleFilterKeyRegex {
+    interface HostGroupRuleContainerRuleKubernetesRuleExcludePodAnnotationRegex {
         /**
          * Key.
          */
         key?: pulumi.Input<string>;
         /**
-         * Regular expression.
+         * Value.
          */
-        regex?: pulumi.Input<string>;
+        val?: pulumi.Input<string>;
     }
-    interface ImportTaskTargetInfoExtractRuleExtractRuleLogTemplate {
+    interface HostGroupRuleContainerRuleKubernetesRuleExcludePodLabelRegex {
         /**
-         * Format.
+         * Key.
          */
-        format?: pulumi.Input<string>;
+        key?: pulumi.Input<string>;
         /**
-         * Type
+         * Value.
          */
-        type?: pulumi.Input<string>;
+        val?: pulumi.Input<string>;
     }
-    interface ImportTaskTaskStatistics {
+    interface HostGroupRuleContainerRuleKubernetesRuleIncludePodAnnotationRegex {
         /**
-         * Total resource bytes enumerated
+         * Key.
          */
-        bytesTotal?: pulumi.Input<number>;
+        key?: pulumi.Input<string>;
         /**
-         * Bytes transferred.
+         * Value.
          */
-        bytesTransferred?: pulumi.Input<number>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleKubernetesRuleIncludePodLabelRegex {
         /**
-         * Number of resources failed to import.
+         * Key.
          */
-        failed?: pulumi.Input<number>;
+        key?: pulumi.Input<string>;
         /**
-         * Number of resources not found.
+         * Value.
          */
-        notExist?: pulumi.Input<number>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleContainerRuleKubernetesRuleLabelTag {
         /**
-         * Number of resources skipped during import
+         * Key.
          */
-        skipped?: pulumi.Input<number>;
+        key?: pulumi.Input<string>;
         /**
-         * Task status. Status of the import task. Preparing: Preparing for import. Importing: Importing data. Success: Import completed successfully. Failed: Import failed. Stopped: Import paused.
+         * Value.
          */
-        taskStatus?: pulumi.Input<string>;
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleExcludePath {
         /**
-         * Total number of resources enumerated.
+         * Collection path type. File: file name. Path: directory.
          */
-        total?: pulumi.Input<number>;
+        type?: pulumi.Input<string>;
         /**
-         * Number of records transferred.
+         * Collection path. Must be specified as an absolute path. When Type is Path, Value indicates a directory. When Type is File, Value indicates a file name.
          */
-        transferred?: pulumi.Input<number>;
+        value?: pulumi.Input<string>;
     }
-    interface IndexFullText {
+    interface HostGroupRuleExtractRule {
         /**
-         * Case sensitivity. true: Case sensitive. false: Not case sensitive.
+         * The regex pattern required to match the first line of the log. This is valid only when LogType is multiline*log or fullregex*log. The pattern must be a valid regular expression.
          */
-        caseSensitive?: pulumi.Input<boolean>;
+        beginRegex?: pulumi.Input<string>;
         /**
-         * Token separators for the full-text index. Each character in the string represents a token separator. Length: 1–256 bytes. Only one or more of the following characters are supported: letters, numbers, and !@#%^&*()-_=\\"', <>/?|;:\	\r[]{}. . Supports configuring both Chinese characters and token separators simultaneously.
+         * Log delimiter. Valid only when LogType is delimiter_log.
          */
         delimiter?: pulumi.Input<string>;
         /**
-         * When searching, specify whether to segment Chinese content in logs according to Chinese grammar. The default is false. true: For Chinese characters in logs, segment the log according to common Chinese grammar rules. Custom segmentation symbols for Chinese content are not supported. For non-Chinese characters in logs, segment the log using the segmentation symbols specified in the parameter. false: Segment the log using the segmentation symbols specified in the parameter.
+         * Enable nanosecond precision time. When enabled, log time parsing will report time with nanosecond precision. true: Enable nanosecond precision time. false: Disable nanosecond precision time.
          */
-        includeChinese?: pulumi.Input<boolean>;
-    }
-    interface IndexKeyValue {
+        enableNanosecond?: pulumi.Input<boolean>;
+        filterKeyRegexes?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleExtractRuleFilterKeyRegex>[]>;
         /**
-         * Specify the field names for key-value indexing. Up to 100 fields can be added. Only letters, numbers, spaces, underscores (_), hyphens (-), and slashes (/) are supported, and field names cannot start or end with a space. Each key name must be unique within the same index. Length: 1–128 characters. For subfields in JSON-type key-value indexes, use a dot (.) to indicate the hierarchy between JSON fields. For example, if the JSON field 'namelist' contains a text-type subfield 'totalcount' and a JSON-type subfield 'info', and 'info' contains the field 'name', the field names should be configured as 'totalcount' and 'info.name' respectively.
+         * List of log field names (Keys).
          */
-        key?: pulumi.Input<string>;
+        keys?: pulumi.Input<pulumi.Input<string>[]>;
         /**
-         * Field description information required for configuring key-value indexes.
+         * The entire log entry must match the regular expression. This is only valid when the log type is fullregex_log. The regular expression must be valid.
          */
-        value?: pulumi.Input<inputs.tls.IndexKeyValueValue>;
+        logRegex?: pulumi.Input<string>;
+        /**
+         * Automatically extract log fields based on the specified log template.
+         */
+        logTemplate?: pulumi.Input<inputs.tls.HostGroupRuleExtractRuleLogTemplate>;
+        /**
+         * Quotation mark. Content enclosed by quotation marks is parsed as a complete field and not separated. Only valid when LogType is delimiter_log.
+         */
+        quote?: pulumi.Input<string>;
+        /**
+         * Regular expression for extracting time, used to extract the time value from the TimeKey field and parse it as the collection time.
+         */
+        timeExtractRegex?: pulumi.Input<string>;
+        /**
+         * Parsing format for the time field. If a specified time field in the log is used as the log timestamp, you must provide TimeKey and TimeFormat.
+         */
+        timeFormat?: pulumi.Input<string>;
+        /**
+         * Field name for the log time field. If a specified time field in the log is used as the log timestamp, you must provide TimeKey and TimeFormat.
+         */
+        timeKey?: pulumi.Input<string>;
+        /**
+         * Sample time. Used to verify whether the specified time parsing format is correct.
+         */
+        timeSample?: pulumi.Input<string>;
+        /**
+         * Time zone. Supports machine time zone (default) and custom time zone. Custom time zone supports GMT and UTC.
+         */
+        timeZone?: pulumi.Input<string>;
+        /**
+         * Key name for logs that failed to parse when uploading
+         */
+        unMatchLogKey?: pulumi.Input<string>;
+        /**
+         * Upload logs that failed to parse. UnMatchUpLoadSwitch=true and UnMatchLogKey must be used together. true: Upload logs that failed to parse. false: Do not upload logs that failed to parse.
+         */
+        unMatchUpLoadSwitch?: pulumi.Input<boolean>;
+    }
+    interface HostGroupRuleExtractRuleFilterKeyRegex {
+        /**
+         * Name of the filter field.
+         */
+        key?: pulumi.Input<string>;
+        /**
+         * The log content of the filter field must match the specified regular expression.
+         */
+        regex?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleExtractRuleLogTemplate {
+        /**
+         * Log template format
+         */
+        format?: pulumi.Input<string>;
+        /**
+         * Log template type. Supported types: Nginx (Nginx log template type).
+         */
+        type?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleUserDefineRule {
+        /**
+         * Advanced parameters are used for extended configuration. After enabling extended configuration, you can customize advanced behaviors of LogCollector, such as when to release file handles. Note: If multiple conditions for releasing handles are specified, the handle will be released and log file monitoring will end as soon as any condition is met.
+         */
+        advanced?: pulumi.Input<inputs.tls.HostGroupRuleUserDefineRuleAdvanced>;
+        /**
+         * Whether to upload the Label information of the host group to the log service. Disabled by default. true: LogCollector uploads the Label information of the host group to the specified field. You can specify the field name in the HostGroupLabelKey parameter. false (default): LogCollector does not upload the Label information of the host group.
+         */
+        enableHostGroupLabel?: pulumi.Input<boolean>;
+        /**
+         * Whether to upload the hostname field. Default is disabled. true: Adds a field to the original log to record the log source's hostname. Specify the hostname field name using HostnameKey. false (default): Does not add the hostname field.
+         */
+        enableHostname?: pulumi.Input<boolean>;
+        /**
+         * Whether to upload raw logs. true: Upload raw logs. false (default): Do not upload raw logs.
+         */
+        enableRawLog?: pulumi.Input<boolean>;
+        fields?: pulumi.Input<pulumi.Input<inputs.tls.HostGroupRuleUserDefineRuleField>[]>;
+        /**
+         * Field name used to store machine group label information.
+         */
+        hostGroupLabelKey?: pulumi.Input<string>;
+        /**
+         * hostname field name. Only required when EnableHostname is set to true.
+         */
+        hostnameKey?: pulumi.Input<string>;
+        /**
+         * Ignore log files that have not been updated for a specified duration, in hours.
+         */
+        ignoreOlder?: pulumi.Input<number>;
+        /**
+         * Allows multiple log file collections. Empty: Uses the log file ID (including file inode, device, and checksum of the first N bytes) to uniquely identify the log file. RuleID: Uses the collection rule ID and log file ID to uniquely identify the log file. TopicIDRuleName: Uses the log topic ID, collection rule Name, and log file ID to uniquely identify the log file.
+         */
+        multiCollectsType?: pulumi.Input<string>;
+        /**
+         * Rules for parsing the collection path. After setting the rule, fields in the collection path are extracted using the specified regex and added as metadata to the log data. Note: This parameter is not supported when collecting container standard output.
+         */
+        parsePathRule?: pulumi.Input<inputs.tls.HostGroupRuleUserDefineRuleParsePathRule>;
+        /**
+         * LogCollector plugin configuration. After enabling plugin configuration, you can add one or more LogCollector processor plugins to parse logs with complex or variable structures.
+         */
+        plugin?: pulumi.Input<inputs.tls.HostGroupRuleUserDefineRulePlugin>;
+        /**
+         * Original log field name. Only effective when EnableRawLog is set to true. RawLogKey defaults to **raw**, meaning the original log data will be encapsulated in the **raw** field and uploaded to the log service together with the parsed log data
+         */
+        rawLogKey?: pulumi.Input<string>;
+        /**
+         * Rules for routing log partitions. If this parameter is not set, logs are written using the default load balancing mode, and packets are written to any available Shard. If set, logs are collected using the HashKey routing Shard mode, and the log service writes data to the Shard containing the specified Key value.
+         */
+        shardHashKey?: pulumi.Input<inputs.tls.HostGroupRuleUserDefineRuleShardHashKey>;
+        /**
+         * LogCollector collection strategy, specifying whether LogCollector collects incremental logs or full logs. The default is false, which means full log collection. true: incremental collection. When LogCollector collects logs, it only collects newly added content in the file. When a monitored log file receives new log entries, LogCollector is triggered to collect logs. For log files being collected for the first time, LogCollector automatically determines the collection position based on the incremental threshold TailSizeKb you specify. If the new file size does not exceed the incremental threshold, collection starts from the beginning of the new file. If the new file size exceeds the incremental threshold, collection starts from the position at the end of the file minus the incremental threshold, meaning only incremental logs are collected. For log files that are not being collected for the first time, LogCollector determines the collection position based on the Checkpoint and continues collecting. false: (default) full collection. LogCollector collects logs from the beginning of each file, including historical log data.
+         */
+        tailFiles?: pulumi.Input<boolean>;
+        /**
+         * Incremental collection backtracking threshold, in KiB. When LogCollector uses incremental collection, for the first collection of a log file: if the new log file size does not exceed the TailSizeKb value, collection starts from the beginning of the file. If the new log file size exceeds the TailSizeKb value, collection starts from the position TailSizeKb from the end of the file.
+         */
+        tailSizeKb?: pulumi.Input<number>;
+    }
+    interface HostGroupRuleUserDefineRuleAdvanced {
+        /**
+         * After reading to the end of the log file, whether to release the file handle. Default is false.
+         */
+        closeEof?: pulumi.Input<boolean>;
+        /**
+         * Wait time before releasing log file handles. If no new logs are written to a log file for the specified duration, the handle for that log file is released. Unit: seconds. Range: 1–300 seconds. Default: 60 seconds.
+         */
+        closeInactive?: pulumi.Input<number>;
+        /**
+         * Whether to release the handle of the log file after it is removed. Default is false.
+         */
+        closeRemoved?: pulumi.Input<boolean>;
+        /**
+         * Whether to release the handle of the log file after it is renamed. Default is false.
+         */
+        closeRenamed?: pulumi.Input<boolean>;
+        /**
+         * Maximum duration for LogCollector to monitor log files, in seconds. The default is 0 seconds, meaning LogCollector does not limit the monitoring duration. Timing starts when LogCollector begins monitoring the log file. After the specified duration is exceeded, regardless of whether the log file has been fully read, LogCollector immediately releases the file handle and stops monitoring.
+         */
+        closeTimeout?: pulumi.Input<number>;
+        /**
+         * Maximum wait time when LogCollector does not read a line break. Unit: seconds. Default: 5s. LogCollector starts timing when it begins reading log file content. If no line break is read within the specified time, it will send the buffered logs. If the file write interval is large, a complete log entry may be split into two parts and written separately. Adjust this parameter based on your log write interval.
+         */
+        noLineTerminatorEofMaxTime?: pulumi.Input<number>;
+    }
+    interface HostGroupRuleUserDefineRuleField {
+        /**
+         * Key.
+         */
+        key?: pulumi.Input<string>;
+        /**
+         * Value.
+         */
+        val?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleUserDefineRuleParsePathRule {
+        /**
+         * List of field names. Log Service parses PathSample into multiple fields using regular expressions (Regex). Keys specify the name of each field. You can configure up to 100 field names. Field names cannot be empty or duplicated.
+         */
+        keys?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Sample collection path for actual scenarios. The sample path must be an absolute path. Wildcards *, ?, ** are not allowed in the sample path.
+         */
+        pathSample?: pulumi.Input<string>;
+        /**
+         * Regular expression used to extract the path field. It must match the example collection path; otherwise, extraction will fail.
+         */
+        regex?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleUserDefineRulePlugin {
+        /**
+         * LogCollector plugins. For supported plugin lists and parameter descriptions, see LogCollector plugin overview.
+         */
+        processors?: pulumi.Input<string>;
+    }
+    interface HostGroupRuleUserDefineRuleShardHashKey {
+        /**
+         * The HashKey of the log group specifies the shard where the current log group will be written. The valid range for this parameter is [00000000000000000000000000000000-ffffffffffffffffffffffffffffffff).
+         */
+        hashKey?: pulumi.Input<string>;
+    }
+    interface ImportTaskImportSourceInfo {
+        /**
+         * Kafka data source information. When sourceType is kafka, the KafkaSourceInfo field is required
+         */
+        kafkaSourceInfo?: pulumi.Input<inputs.tls.ImportTaskImportSourceInfoKafkaSourceInfo>;
+        /**
+         * TOS data source information. When sourceType is tos, the TosSourceInfo field is required.
+         */
+        tosSourceInfo?: pulumi.Input<inputs.tls.ImportTaskImportSourceInfoTosSourceInfo>;
+    }
+    interface ImportTaskImportSourceInfoKafkaSourceInfo {
+        /**
+         * Data encoding format. Available options: UTF-8, GBK.
+         */
+        encode?: pulumi.Input<string>;
+        /**
+         * Kafka consumer group. If not specified, the system will automatically create a Kafka consumer group.
+         */
+        group?: pulumi.Input<string>;
+        /**
+         * The service addresses for different types of Kafka clusters vary. Details are as follows: Message Queue Kafka Edition: Use the access point of the Kafka instance. For more information, see Access Point. If the Kafka instance and the Log Service Project are in the same region, you can use private network access; otherwise, use public network access. Self-hosted Kafka clusters: Use the IP address and port number or the domain name and port number of the Kafka Broker. Only public network access is supported. Separate multiple service addresses with a comma (,).
+         */
+        host?: pulumi.Input<string>;
+        /**
+         * Starting position for data import. Options: 0: Earliest time, start importing from the first record in the specified Kafka Topic. 1: Latest time, start importing from the most recently generated record in the specified Kafka Topic.
+         */
+        initialOffset?: pulumi.Input<number>;
+        /**
+         * If you are using Message Queue Kafka Edition, set this to the Kafka instance ID.
+         */
+        instanceId?: pulumi.Input<string>;
+        /**
+         * Whether to enable authentication. If you use a public service address, it is recommended to enable authentication.
+         */
+        isNeedAuth?: pulumi.Input<boolean>;
+        /**
+         * Password authentication mechanism. Available options: PLAIN, SCRAM-SHA-256, and SCRAM-SHA-512.
+         */
+        mechanism?: pulumi.Input<string>;
+        /**
+         * Kafka SASL user password for authentication.
+         */
+        password?: pulumi.Input<string>;
+        /**
+         * Secure transmission protocol. Options include plaintext, sasl*ssl, ssl, and sasl*plaintext
+         */
+        protocol?: pulumi.Input<string>;
+        /**
+         * Specify log time. Options: 0: Use Kafka message timestamp. 1: Use current system time.
+         */
+        timeSourceDefault?: pulumi.Input<number>;
+        /**
+         * Kafka Topic name. Separate multiple Kafka Topics with commas (,).
+         */
+        topic?: pulumi.Input<string>;
+        /**
+         * Kafka SASL username for authentication.
+         */
+        username?: pulumi.Input<string>;
+    }
+    interface ImportTaskImportSourceInfoTosSourceInfo {
+        /**
+         * TOS bucket name
+         */
+        bucket?: pulumi.Input<string>;
+        /**
+         * Compression mode for data in the TOS bucket. none: No compression. snappy: Compress using snappy. gzip: Compress using gzip. lz4: Compress using lz4.
+         */
+        compressType?: pulumi.Input<string>;
+        /**
+         * Path of the file to be imported in the TOS bucket.
+         */
+        prefix?: pulumi.Input<string>;
+        /**
+         * Region where the TOS bucket is located. Cross-region data import is supported
+         */
+        region?: pulumi.Input<string>;
+    }
+    interface ImportTaskTargetInfo {
+        /**
+         * Log extraction rule.
+         */
+        extractRule?: pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRule>;
+        /**
+         * Log sample. When LogType is set to multiline_log, you must configure log samples. It is recommended to provide more than two log entries as examples to ensure the regular expression matches the first line of each log. Use real samples from the production environment.
+         */
+        logSample?: pulumi.Input<string>;
+        /**
+         * Specify log parsing type during import. delimiter*log: CSV type. multiline*log: multiline full text type. minimalist*log: single line full text type. json*log: JSON type.
+         */
+        logType: pulumi.Input<string>;
+        /**
+         * Region.
+         */
+        region: pulumi.Input<string>;
+    }
+    interface ImportTaskTargetInfoExtractRule {
+        /**
+         * Basic content of log extraction rules.
+         */
+        extractRule?: pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRuleExtractRule>;
+        /**
+         * Number of skipped rows. Only valid when the log type is delimiterLog and the import type is tos.
+         */
+        skipLineCount?: pulumi.Input<number>;
+        /**
+         * Time extraction regular expression, used to extract the time value from the TimeKey field and parse it as the collection time
+         */
+        timeExtractRegex?: pulumi.Input<string>;
+        /**
+         * Time zone. Supports machine time zone (default) and custom time zone. Custom time zone supports GMT and UTC. GMT format: GMT+08:00. UTC format: Asia/Shanghai.
+         */
+        timeZone?: pulumi.Input<string>;
+    }
+    interface ImportTaskTargetInfoExtractRuleExtractRule {
+        /**
+         * Regular expression for identifying the first line of each log. The matched part is treated as the start of the log. When LogType is set to multiline_log, you must configure a log sample
+         */
+        beginRegex?: pulumi.Input<string>;
+        /**
+         * Delimiter. Only valid when LogType is delimiter_log.
+         */
+        delimiter?: pulumi.Input<string>;
+        /**
+         * Enable nanoseconds.
+         */
+        enableNanosecond?: pulumi.Input<boolean>;
+        filterKeyRegexes?: pulumi.Input<pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRuleExtractRuleFilterKeyRegex>[]>;
+        /**
+         * List of log field names (Key). Valid only when LogType is delimiter_log. Supports up to 100 field names. Duplicate field names are not allowed, and all field names cannot be left blank
+         */
+        keys?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Log regular expression
+         */
+        logRegex?: pulumi.Input<string>;
+        /**
+         * Log template.
+         */
+        logTemplate?: pulumi.Input<inputs.tls.ImportTaskTargetInfoExtractRuleExtractRuleLogTemplate>;
+        /**
+         * Quotation mark. Content enclosed by the quotation mark will not be separated and will be parsed as a complete field. Only valid when LogType is delimiter_log.
+         */
+        quote?: pulumi.Input<string>;
+        /**
+         * Parsing format for the time field. If you use a specified time field in the log as the log timestamp, you must fill in TimeKey and TimeFormat. TimeKey and TimeFormat must be paired. For configuration details, see time format.
+         */
+        timeFormat?: pulumi.Input<string>;
+        /**
+         * Name of the log time field. If you use a specific time field in the log as the log timestamp, you must provide both TimeKey and TimeFormat. TimeKey and TimeFormat must appear in pairs
+         */
+        timeKey?: pulumi.Input<string>;
+        /**
+         * Time sample. Used to verify whether the entered time parsing format is correct
+         */
+        timeSample?: pulumi.Input<string>;
+        /**
+         * When uploading logs that failed to parse, specify the key name for the failed logs. UnMatchUpLoadSwitch=true and UnMatchLogKey must be used together.
+         */
+        unMatchLogKey?: pulumi.Input<string>;
+        /**
+         * Whether to upload logs that failed to parse. UnMatchUpLoadSwitch=true and UnMatchLogKey must be paired. true: Upload logs that failed to parse. false: Do not upload logs that failed to parse.
+         */
+        unMatchUpLoadSwitch?: pulumi.Input<boolean>;
+    }
+    interface ImportTaskTargetInfoExtractRuleExtractRuleFilterKeyRegex {
+        /**
+         * Key.
+         */
+        key?: pulumi.Input<string>;
+        /**
+         * Regular expression.
+         */
+        regex?: pulumi.Input<string>;
+    }
+    interface ImportTaskTargetInfoExtractRuleExtractRuleLogTemplate {
+        /**
+         * Format.
+         */
+        format?: pulumi.Input<string>;
+        /**
+         * Type
+         */
+        type?: pulumi.Input<string>;
+    }
+    interface ImportTaskTaskStatistics {
+        /**
+         * Total resource bytes enumerated
+         */
+        bytesTotal?: pulumi.Input<number>;
+        /**
+         * Bytes transferred.
+         */
+        bytesTransferred?: pulumi.Input<number>;
+        /**
+         * Number of resources failed to import.
+         */
+        failed?: pulumi.Input<number>;
+        /**
+         * Number of resources not found.
+         */
+        notExist?: pulumi.Input<number>;
+        /**
+         * Number of resources skipped during import
+         */
+        skipped?: pulumi.Input<number>;
+        /**
+         * Task status. Status of the import task. Preparing: Preparing for import. Importing: Importing data. Success: Import completed successfully. Failed: Import failed. Stopped: Import paused.
+         */
+        taskStatus?: pulumi.Input<string>;
+        /**
+         * Total number of resources enumerated.
+         */
+        total?: pulumi.Input<number>;
+        /**
+         * Number of records transferred.
+         */
+        transferred?: pulumi.Input<number>;
+    }
+    interface IndexFullText {
+        /**
+         * Case sensitivity. true: Case sensitive. false: Not case sensitive.
+         */
+        caseSensitive?: pulumi.Input<boolean>;
+        /**
+         * Token separators for the full-text index. Each character in the string represents a token separator. Length: 1–256 bytes. Only one or more of the following characters are supported: letters, numbers, and !@#%^&*()-_=\\"', <>/?|;:\	\r[]{}. . Supports configuring both Chinese characters and token separators simultaneously.
+         */
+        delimiter?: pulumi.Input<string>;
+        /**
+         * When searching, specify whether to segment Chinese content in logs according to Chinese grammar. The default is false. true: For Chinese characters in logs, segment the log according to common Chinese grammar rules. Custom segmentation symbols for Chinese content are not supported. For non-Chinese characters in logs, segment the log using the segmentation symbols specified in the parameter. false: Segment the log using the segmentation symbols specified in the parameter.
+         */
+        includeChinese?: pulumi.Input<boolean>;
+    }
+    interface IndexKeyValue {
+        /**
+         * Specify the field names for key-value indexing. Up to 100 fields can be added. Only letters, numbers, spaces, underscores (_), hyphens (-), and slashes (/) are supported, and field names cannot start or end with a space. Each key name must be unique within the same index. Length: 1–128 characters. For subfields in JSON-type key-value indexes, use a dot (.) to indicate the hierarchy between JSON fields. For example, if the JSON field 'namelist' contains a text-type subfield 'totalcount' and a JSON-type subfield 'info', and 'info' contains the field 'name', the field names should be configured as 'totalcount' and 'info.name' respectively.
+         */
+        key?: pulumi.Input<string>;
+        /**
+         * Field description information required for configuring key-value indexes.
+         */
+        value?: pulumi.Input<inputs.tls.IndexKeyValueValue>;
     }
     interface IndexKeyValueValue {
         /**
@@ -11645,6 +12119,283 @@ export declare namespace tos {
          */
         storageClass?: pulumi.Input<string>;
     }
+    interface BucketMirrorBackRule {
+        /**
+         * Conditions that trigger the back-to-origin function.
+         */
+        condition?: pulumi.Input<inputs.tos.BucketMirrorBackRuleCondition>;
+        /**
+         * Rule ID. The unique identifier for the back-to-origin rule configured on the current bucket. You can set this yourself to distinguish between multiple rules. Restrictions:
+         * Characters supported: letters, numbers,   - and _.
+         * Maximum length: 32 characters.
+         */
+        id?: pulumi.Input<string>;
+        /**
+         * Back-to-origin redirect configuration.
+         */
+        redirect?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirect>;
+    }
+    interface BucketMirrorBackRuleCondition {
+        /**
+         * Supports triggering origin fetch only for specified domains. The domain must be able to access the bucket; it is recommended to use a custom domain bound to the bucket. Limit: supports up to 30 domains.
+         */
+        allowHosts?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Error code that triggers origin fetch. When a download request returns this error code, origin fetch is triggered. Limit: currently only supports 404.
+         */
+        httpCode?: pulumi.Input<number>;
+        /**
+         * Request types that trigger back-to-origin. Value description:
+         * ["GET","HEAD"]: Both GetObject and HeadObject requests can trigger back-to-origin.
+         * ["GET"]: Only GetObject requests can trigger back-to-origin.
+         * Default is ["GET"].
+         */
+        httpMethods?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Object name prefix for matching origin fetch objects. Limit: supports up to 512 characters.
+         */
+        keyPrefix?: pulumi.Input<string>;
+        /**
+         * Object name suffix for matching origin fetch objects. Limit: supports up to 512 characters.
+         */
+        keySuffix?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirect {
+        fetchHeaderToMetaDataRules?: pulumi.Input<pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectFetchHeaderToMetaDataRule>[]>;
+        /**
+         * Whether to fetch data from the configured origin after redirection. Value description: true: Fetch data from the configured origin after redirection. false: Do not fetch data from the configured origin after redirection.
+         */
+        fetchSourceOnRedirect?: pulumi.Input<boolean>;
+        /**
+         * Whether to include request parameters when fetching data after redirection. If not configured, inherits PassQuery settings: true: includes request parameters. false: does not include request parameters.
+         */
+        fetchSourceOnRedirectWithQuery?: pulumi.Input<boolean>;
+        /**
+         * If the result of mirror origin fetch is 3xx, whether to continue redirecting to the specified Location to fetch data. Value description: true: TOS will continue to request the address corresponding to Location. false: TOS will return 302.
+         */
+        followRedirect?: pulumi.Input<boolean>;
+        /**
+         * Specify the headers to include when mirroring back to origin.
+         */
+        mirrorHeader?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectMirrorHeader>;
+        /**
+         * List of origin response headers allowed to be passed through directly.
+         */
+        passHeaderFromSources?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Whether to include request parameters when performing redirect or mirror back-to-origin rules. Value description:
+         * true: Include request parameters.
+         * false: Do not include request parameters.
+         */
+        passQuery?: pulumi.Input<boolean>;
+        /**
+         * List of origin response status codes allowed to be passed through directly.
+         */
+        passStatusCodeFromSources?: pulumi.Input<pulumi.Input<number>[]>;
+        /**
+         * Back-to-origin address configuration when the origin server is a private bucket.
+         */
+        privateSource?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSource>;
+        /**
+         * Back-to-origin address configuration when the origin server is a public bucket.
+         */
+        publicSource?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPublicSource>;
+        /**
+         * Specify redirect type. Value range: Mirror: Mirror origin fetch. Async: Redirect origin fetch.
+         */
+        redirectType?: pulumi.Input<string>;
+        /**
+         * Define transformations for the object name when requesting the origin server.
+         */
+        transform?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectTransform>;
+    }
+    interface BucketMirrorBackRuleRedirectFetchHeaderToMetaDataRule {
+        /**
+         * Suffix appended when writing object metadata.
+         */
+        metaDataSuffix?: pulumi.Input<string>;
+        /**
+         * Origin response header name.
+         */
+        sourceHeader?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectMirrorHeader {
+        /**
+         * Whether to forward all HTTP headers to the origin. Values: true: forwards all HTTP headers to the origin. false: does not forward all HTTP headers to the origin. The following HTTP header types are not supported for forwarding: Host, Content-Length, Date, Authorization.
+         */
+        passAll?: pulumi.Input<boolean>;
+        /**
+         * Pass the specified headers to the origin server. Limit: up to 64.
+         */
+        passes?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Prohibit forwarding specified headers to the origin. Limit: maximum 64.
+         */
+        removes?: pulumi.Input<pulumi.Input<string>[]>;
+        sets?: pulumi.Input<pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectMirrorHeaderSet>[]>;
+    }
+    interface BucketMirrorBackRuleRedirectMirrorHeaderSet {
+        /**
+         * Request header name.
+         */
+        key?: pulumi.Input<string>;
+        /**
+         * Request header value.
+         */
+        value?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSource {
+        /**
+         * Back-to-origin address configuration when the origin server is a private bucket.
+         */
+        sourceEndpoint?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpoint>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpoint {
+        followers?: pulumi.Input<pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointFollower>[]>;
+        primaries?: pulumi.Input<pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointPrimary>[]>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointFollower {
+        /**
+         * Name of the origin fetch bucket. Required when the origin is a private bucket.
+         */
+        bucketName?: pulumi.Input<string>;
+        /**
+         * Private back-to-origin authentication method. Required when the origin server is a private bucket.
+         */
+        credentialProvider?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointFollowerCredentialProvider>;
+        /**
+         * Access domain name of the origin service provider, excluding bucket name, maximum length 255. Required for private buckets.
+         */
+        endpoint?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointFollowerCredentialProvider {
+        /**
+         * Region where the origin fetch bucket is located. Required when using AK/SK authentication.
+         */
+        region?: pulumi.Input<string>;
+        /**
+         * Name of AssumeRole. Only when fetching from a private TOS bucket can AssumeRole be used for authentication. Role authentication and AK/SK authentication are mutually exclusive and cannot be set simultaneously.
+         */
+        role?: pulumi.Input<string>;
+        /**
+         * Authenticate using AK/SK.
+         */
+        staticCredential?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointFollowerCredentialProviderStaticCredential>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointFollowerCredentialProviderStaticCredential {
+        /**
+         * AccessKey ID of the origin bucket. Required when using AK/SK authentication.
+         */
+        ak?: pulumi.Input<string>;
+        /**
+         * SecretKey for the back-to-origin bucket. Required when using AK/SK authentication.
+         */
+        sk?: pulumi.Input<string>;
+        /**
+         * Encryption method used for SecretKey. Values:
+         * Empty: SecretKey is in plaintext. After receiving the SecretKey, the server will encrypt and store it.
+         * AES256: SecretKey has been encrypted using the AES256 algorithm on the server side. After receiving the SecretKey, the server will parse and encrypt it for storage.
+         * Note: When a back-to-origin rule is created for the first time, the SecretKey is encrypted with AES256. If you modify the back-to-origin rule without changing the SecretKey parameter, you must first decrypt the SecretKey and then re-encrypt it for storage. Therefore, when calling the PutBucketMirrorBack API to modify the back-to-origin rule and only changing other parameters (not the SecretKey), you can set SKEncryptType to AES256.
+         */
+        skEncryptType?: pulumi.Input<string>;
+        /**
+         * Origin service provider. Values: BOS: Baidu Cloud. S3: Other cloud providers using the S3 storage protocol.
+         */
+        storageVendor?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointPrimary {
+        /**
+         * Name of the origin fetch bucket. Required when the origin is a private bucket.
+         */
+        bucketName?: pulumi.Input<string>;
+        /**
+         * Private back-to-origin authentication method. Required when the origin server is a private bucket.
+         */
+        credentialProvider?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointPrimaryCredentialProvider>;
+        /**
+         * Access domain name of the origin service provider, excluding bucket name, maximum length 255. Required for private buckets.
+         */
+        endpoint?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointPrimaryCredentialProvider {
+        /**
+         * Region where the origin fetch bucket is located. Required when using AK/SK authentication.
+         */
+        region?: pulumi.Input<string>;
+        /**
+         * Name of AssumeRole. Only when fetching from a private TOS bucket can AssumeRole be used for authentication. Role authentication and AK/SK authentication are mutually exclusive and cannot be set simultaneously.
+         */
+        role?: pulumi.Input<string>;
+        /**
+         * Authenticate using AK/SK.
+         */
+        staticCredential?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointPrimaryCredentialProviderStaticCredential>;
+    }
+    interface BucketMirrorBackRuleRedirectPrivateSourceSourceEndpointPrimaryCredentialProviderStaticCredential {
+        /**
+         * AccessKey ID of the origin bucket. Required when using AK/SK authentication.
+         */
+        ak?: pulumi.Input<string>;
+        /**
+         * SecretKey for the back-to-origin bucket. Required when using AK/SK authentication.
+         */
+        sk?: pulumi.Input<string>;
+        /**
+         * Encryption method used for SecretKey. Values:
+         * Empty: SecretKey is in plaintext. After receiving the SecretKey, the server will encrypt and store it.
+         * AES256: SecretKey has been encrypted using the AES256 algorithm on the server side. After receiving the SecretKey, the server will parse and encrypt it for storage.
+         * Note: When a back-to-origin rule is created for the first time, the SecretKey is encrypted with AES256. If you modify the back-to-origin rule without changing the SecretKey parameter, you must first decrypt the SecretKey and then re-encrypt it for storage. Therefore, when calling the PutBucketMirrorBack API to modify the back-to-origin rule and only changing other parameters (not the SecretKey), you can set SKEncryptType to AES256.
+         */
+        skEncryptType?: pulumi.Input<string>;
+        /**
+         * Origin service provider. Values: BOS: Baidu Cloud. S3: Other cloud providers using the S3 storage protocol.
+         */
+        storageVendor?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectPublicSource {
+        /**
+         * Whether to always use the configured origin address.
+         */
+        fixedEndpoint?: pulumi.Input<boolean>;
+        /**
+         * Publicly accessible origin address.
+         */
+        sourceEndpoint?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectPublicSourceSourceEndpoint>;
+    }
+    interface BucketMirrorBackRuleRedirectPublicSourceSourceEndpoint {
+        /**
+         * Origin address. Limit: Maximum length 255, supports up to 5 origin fetch addresses. When all origin fetches fail in Primary, an origin is selected from this configuration.
+         */
+        followers?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Origin address. Limit: Maximum length 255, supports up to 5 origin fetch addresses.
+         */
+        primaries?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface BucketMirrorBackRuleRedirectTransform {
+        /**
+         * Object name prefix to be replaced when requesting the origin.
+         */
+        replaceKeyPrefix?: pulumi.Input<inputs.tos.BucketMirrorBackRuleRedirectTransformReplaceKeyPrefix>;
+        /**
+         * Prefix added before the object name when requesting the origin server. Limit: up to 512 characters.
+         */
+        withKeyPrefix?: pulumi.Input<string>;
+        /**
+         * Prefix added before the object name when requesting the origin server. Limit: up to 512 characters.
+         */
+        withKeySuffix?: pulumi.Input<string>;
+    }
+    interface BucketMirrorBackRuleRedirectTransformReplaceKeyPrefix {
+        /**
+         * Object name prefix to be replaced when requesting the origin. Limit: Supports up to 512 characters.
+         */
+        keyPrefix?: pulumi.Input<string>;
+        /**
+         * Value of the object name prefix after replacement when requesting the origin. Limit: Supports up to 512 characters.
+         */
+        replaceWith?: pulumi.Input<string>;
+    }
     interface BucketNotificationNotificationRule {
         /**
          * Event notification delivery targets. Must include at least one target and supports up to five different targets.
@@ -11733,6 +12484,36 @@ export declare namespace tos {
          */
         value?: pulumi.Input<string>;
     }
+    interface BucketObjectLockConfiguration {
+        /**
+         * Enable retention policy Only Enabled is supported, which means the retention policy is enabled
+         */
+        objectLockEnabled?: pulumi.Input<string>;
+        /**
+         * Bucket retention policy rules
+         */
+        rule?: pulumi.Input<inputs.tos.BucketObjectLockConfigurationRule>;
+    }
+    interface BucketObjectLockConfigurationRule {
+        /**
+         * Default bucket retention policy
+         */
+        defaultRetention?: pulumi.Input<inputs.tos.BucketObjectLockConfigurationRuleDefaultRetention>;
+    }
+    interface BucketObjectLockConfigurationRuleDefaultRetention {
+        /**
+         * Object lock days Objects cannot be deleted or overwritten during the specified number of days. Measured in days
+         */
+        days?: pulumi.Input<number>;
+        /**
+         * Retention policy mode Only COMPLIANCE is supported, which means compliance mode. In this mode, no user can delete or overwrite locked objects during the retention period
+         */
+        mode?: pulumi.Input<string>;
+        /**
+         * Object lock years Objects cannot be deleted or overwritten during the specified number of years. Measured in years, with one year equal to 365 days
+         */
+        years?: pulumi.Input<number>;
+    }
     interface BucketRealtimeLogRealTimeLog {
         /**
          * Role name. Used to grant TOS Object Storage permission to create resources such as projects and topics in Log Service TLS and to write logs