@pulumi/gcp
Version:
A Pulumi package for creating and managing Google Cloud Platform resources.
340 lines • 14.3 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* BigQuery Data Policy
*
* To get more information about DataPolicy, see:
*
* * [API documentation](https://cloud.google.com/bigquery/docs/reference/bigquerydatapolicy/rest/v2/projects.locations.dataPolicies)
* * How-to Guides
* * [Official Documentation](https://cloud.google.com/bigquery/docs/column-data-masking-intro)
*
* ## Example Usage
*
* ### Bigquery Datapolicyv2 Datapolicy Basic
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const basicDataPolicy = new gcp.bigquery.Datapolicyv2DataPolicy("basic_data_policy", {
* location: "us-central1",
* dataPolicyType: "RAW_DATA_ACCESS_POLICY",
* dataPolicyId: "basic_data_policy",
* });
* ```
* ### Bigquery Datapolicyv2 Datapolicy Predefined Masking
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const predefinedMaskingDataPolicy = new gcp.bigquery.Datapolicyv2DataPolicy("predefined_masking_data_policy", {
* location: "us-central1",
* dataPolicyType: "DATA_MASKING_POLICY",
* dataMaskingPolicy: {
* predefinedExpression: "SHA256",
* },
* dataPolicyId: "predefined_masking_data_policy",
* });
* ```
* ### Bigquery Datapolicyv2 Datapolicy Routine
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const test = new gcp.bigquery.Dataset("test", {
* datasetId: "dataset_id",
* location: "us-central1",
* });
* const customMaskingRoutine = new gcp.bigquery.Routine("custom_masking_routine", {
* datasetId: test.datasetId,
* routineId: "custom_masking_routine",
* routineType: "SCALAR_FUNCTION",
* language: "SQL",
* dataGovernanceType: "DATA_MASKING",
* definitionBody: "SAFE.REGEXP_REPLACE(ssn, '[0-9]', 'X')",
* returnType: "{\"typeKind\" : \"STRING\"}",
* arguments: [{
* name: "ssn",
* dataType: "{\"typeKind\" : \"STRING\"}",
* }],
* });
* const routineDataPolicy = new gcp.bigquery.Datapolicyv2DataPolicy("routine_data_policy", {
* location: "us-central1",
* dataPolicyId: "routine_data_policy",
* dataPolicyType: "DATA_MASKING_POLICY",
* dataMaskingPolicy: {
* routine: customMaskingRoutine.id,
* },
* });
* ```
* ### Bigquery Datapolicyv2 Datapolicy Withgrantees
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const dataPolicyWithGrantees = new gcp.bigquery.Datapolicyv2DataPolicy("data_policy_with_grantees", {
* location: "us-central1",
* dataPolicyType: "RAW_DATA_ACCESS_POLICY",
* grantees: ["principal://goog/subject/jane@example.com"],
* dataPolicyId: "data_policy_with_grantees",
* });
* ```
*
* ## Import
*
* DataPolicy can be imported using any of these accepted formats:
*
* * `projects/{{project}}/locations/{{location}}/dataPolicies/{{data_policy_id}}`
* * `{{project}}/{{location}}/{{data_policy_id}}`
* * `{{location}}/{{data_policy_id}}`
*
* When using the `pulumi import` command, DataPolicy can be imported using one of the formats above. For example:
*
* ```sh
* $ pulumi import gcp:bigquery/datapolicyv2DataPolicy:Datapolicyv2DataPolicy default projects/{{project}}/locations/{{location}}/dataPolicies/{{data_policy_id}}
* $ pulumi import gcp:bigquery/datapolicyv2DataPolicy:Datapolicyv2DataPolicy default {{project}}/{{location}}/{{data_policy_id}}
* $ pulumi import gcp:bigquery/datapolicyv2DataPolicy:Datapolicyv2DataPolicy default {{location}}/{{data_policy_id}}
* ```
*/
export declare class Datapolicyv2DataPolicy extends pulumi.CustomResource {
/**
* Get an existing Datapolicyv2DataPolicy resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: Datapolicyv2DataPolicyState, opts?: pulumi.CustomResourceOptions): Datapolicyv2DataPolicy;
/**
* Returns true if the given object is an instance of Datapolicyv2DataPolicy. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is Datapolicyv2DataPolicy;
/**
* The policy used to specify data masking rule.
* Structure is documented below.
*/
readonly dataMaskingPolicy: pulumi.Output<outputs.bigquery.Datapolicyv2DataPolicyDataMaskingPolicy | undefined>;
/**
* User-assigned (human readable) ID of the data policy that needs to be
* unique within a project. Used as {data_policy_id} in part of the resource
* name.
*/
readonly dataPolicyId: pulumi.Output<string>;
/**
* Type of data policy.
* Possible values:
* DATA_MASKING_POLICY
* RAW_DATA_ACCESS_POLICY
* COLUMN_LEVEL_SECURITY_POLICY
*/
readonly dataPolicyType: pulumi.Output<string>;
/**
* Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
* When a 'terraform destroy' or 'pulumi up' would delete the resource,
* the command will fail if this field is set to "PREVENT" in Terraform state.
* When set to "ABANDON", the command will remove the resource from Terraform
* management without updating or deleting the resource in the API.
* When set to "DELETE", deleting the resource is allowed.
*/
readonly deletionPolicy: pulumi.Output<string>;
/**
* The etag for this Data Policy.
* This field is used for UpdateDataPolicy calls. If Data Policy exists, this
* field is required and must match the server's etag. It will also be
* populated in the response of GetDataPolicy, CreateDataPolicy, and
* UpdateDataPolicy calls.
*/
readonly etag: pulumi.Output<string>;
/**
* The list of IAM principals that have Fine Grained Access to the underlying
* data goverened by this data policy.
* Uses the [IAM V2 principal
* syntax](https://cloud.google.com/iam/docs/principal-identifiers#v2) Only
* supports principal types users, groups, serviceaccounts, cloudidentity.
* This field is supported in V2 Data Policy only. In case of V1 data policies
* (i.e. verion = 1 and policyTag is set), this field is not populated.
*/
readonly grantees: pulumi.Output<string[]>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
readonly location: pulumi.Output<string>;
/**
* Identifier. Resource name of this data policy, in the format of
* `projects/{project_number}/locations/{location_id}/dataPolicies/{data_policy_id}`.
*/
readonly name: pulumi.Output<string>;
/**
* Policy tag resource name, in the format of
* `projects/{project_number}/locations/{location_id}/taxonomies/{taxonomy_id}/policyTags/{policyTag_id}`.
* policyTag is supported only for V1 data policies.
*/
readonly policyTag: pulumi.Output<string>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
readonly project: pulumi.Output<string>;
/**
* The version of the Data Policy resource.
* Possible values:
* V1
* V2
*/
readonly version: pulumi.Output<string>;
/**
* Create a Datapolicyv2DataPolicy resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: Datapolicyv2DataPolicyArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering Datapolicyv2DataPolicy resources.
*/
export interface Datapolicyv2DataPolicyState {
/**
* The policy used to specify data masking rule.
* Structure is documented below.
*/
dataMaskingPolicy?: pulumi.Input<inputs.bigquery.Datapolicyv2DataPolicyDataMaskingPolicy | undefined>;
/**
* User-assigned (human readable) ID of the data policy that needs to be
* unique within a project. Used as {data_policy_id} in part of the resource
* name.
*/
dataPolicyId?: pulumi.Input<string | undefined>;
/**
* Type of data policy.
* Possible values:
* DATA_MASKING_POLICY
* RAW_DATA_ACCESS_POLICY
* COLUMN_LEVEL_SECURITY_POLICY
*/
dataPolicyType?: pulumi.Input<string | undefined>;
/**
* Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
* When a 'terraform destroy' or 'pulumi up' would delete the resource,
* the command will fail if this field is set to "PREVENT" in Terraform state.
* When set to "ABANDON", the command will remove the resource from Terraform
* management without updating or deleting the resource in the API.
* When set to "DELETE", deleting the resource is allowed.
*/
deletionPolicy?: pulumi.Input<string | undefined>;
/**
* The etag for this Data Policy.
* This field is used for UpdateDataPolicy calls. If Data Policy exists, this
* field is required and must match the server's etag. It will also be
* populated in the response of GetDataPolicy, CreateDataPolicy, and
* UpdateDataPolicy calls.
*/
etag?: pulumi.Input<string | undefined>;
/**
* The list of IAM principals that have Fine Grained Access to the underlying
* data goverened by this data policy.
* Uses the [IAM V2 principal
* syntax](https://cloud.google.com/iam/docs/principal-identifiers#v2) Only
* supports principal types users, groups, serviceaccounts, cloudidentity.
* This field is supported in V2 Data Policy only. In case of V1 data policies
* (i.e. verion = 1 and policyTag is set), this field is not populated.
*/
grantees?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
location?: pulumi.Input<string | undefined>;
/**
* Identifier. Resource name of this data policy, in the format of
* `projects/{project_number}/locations/{location_id}/dataPolicies/{data_policy_id}`.
*/
name?: pulumi.Input<string | undefined>;
/**
* Policy tag resource name, in the format of
* `projects/{project_number}/locations/{location_id}/taxonomies/{taxonomy_id}/policyTags/{policyTag_id}`.
* policyTag is supported only for V1 data policies.
*/
policyTag?: pulumi.Input<string | undefined>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string | undefined>;
/**
* The version of the Data Policy resource.
* Possible values:
* V1
* V2
*/
version?: pulumi.Input<string | undefined>;
}
/**
* The set of arguments for constructing a Datapolicyv2DataPolicy resource.
*/
export interface Datapolicyv2DataPolicyArgs {
/**
* The policy used to specify data masking rule.
* Structure is documented below.
*/
dataMaskingPolicy?: pulumi.Input<inputs.bigquery.Datapolicyv2DataPolicyDataMaskingPolicy | undefined>;
/**
* User-assigned (human readable) ID of the data policy that needs to be
* unique within a project. Used as {data_policy_id} in part of the resource
* name.
*/
dataPolicyId: pulumi.Input<string>;
/**
* Type of data policy.
* Possible values:
* DATA_MASKING_POLICY
* RAW_DATA_ACCESS_POLICY
* COLUMN_LEVEL_SECURITY_POLICY
*/
dataPolicyType: pulumi.Input<string>;
/**
* Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
* When a 'terraform destroy' or 'pulumi up' would delete the resource,
* the command will fail if this field is set to "PREVENT" in Terraform state.
* When set to "ABANDON", the command will remove the resource from Terraform
* management without updating or deleting the resource in the API.
* When set to "DELETE", deleting the resource is allowed.
*/
deletionPolicy?: pulumi.Input<string | undefined>;
/**
* The etag for this Data Policy.
* This field is used for UpdateDataPolicy calls. If Data Policy exists, this
* field is required and must match the server's etag. It will also be
* populated in the response of GetDataPolicy, CreateDataPolicy, and
* UpdateDataPolicy calls.
*/
etag?: pulumi.Input<string | undefined>;
/**
* The list of IAM principals that have Fine Grained Access to the underlying
* data goverened by this data policy.
* Uses the [IAM V2 principal
* syntax](https://cloud.google.com/iam/docs/principal-identifiers#v2) Only
* supports principal types users, groups, serviceaccounts, cloudidentity.
* This field is supported in V2 Data Policy only. In case of V1 data policies
* (i.e. verion = 1 and policyTag is set), this field is not populated.
*/
grantees?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
location: pulumi.Input<string>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=datapolicyv2DataPolicy.d.ts.map