» google_data_loss_prevention_job_trigger

A job trigger configuration.

To get more information about JobTrigger, see:

» Example Usage - Dlp Job Trigger Basic

resource "google_data_loss_prevention_job_trigger" "basic" {
    parent = "projects/my-project-name"
    description = "Description"
    display_name = "Displayname"

    triggers {
        schedule {
            recurrence_period_duration = "86400s"
        }
    }

    inspect_job {
        inspect_template_name = "fake"
        actions {
            save_findings {
                output_config {
                    table {
                        project_id = "asdf"
                        dataset_id = "asdf"
                    }
                }
            }
        }
        storage_config {
            cloud_storage_options {
                file_set {
                    url = "gs://mybucket/directory/"
                }
            }
        }
    }
}

» Argument Reference

The following arguments are supported:

  • triggers - (Required) What event needs to occur for a new job to be started. Structure is documented below.

  • parent - (Required) The parent of the trigger, either in the format projects/{{project}} or projects/{{project}}/locations/{{location}}

The triggers block supports:

  • schedule - (Optional) Schedule for triggered jobs Structure is documented below.

The schedule block supports:

  • recurrence_period_duration - (Optional) With this option a job is started a regular periodic basis. For example: every day (86400 seconds). A scheduled start time will be skipped if the previous execution has not ended when its scheduled time occurs. This value must be set to a time duration greater than or equal to 1 day and can be no longer than 60 days. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".

  • description - (Optional) A description of the job trigger.

  • display_name - (Optional) User set display name of the job trigger.

  • status - (Optional) Whether the trigger is currently active. Default value is HEALTHY. Possible values are PAUSED, HEALTHY, and CANCELLED.

  • inspect_job - (Optional) Controls what and how to inspect for findings. Structure is documented below.

The inspect_job block supports:

  • inspect_template_name - (Required) The name of the template to run when this job is triggered.

  • storage_config - (Required) Information on where to inspect Structure is documented below.

  • actions - (Required) A task to execute on the completion of a job. Structure is documented below.

The storage_config block supports:

  • timespan_config - (Optional) Information on where to inspect Structure is documented below.

  • datastore_options - (Optional) Options defining a data set within Google Cloud Datastore. Structure is documented below.

  • cloud_storage_options - (Optional) Options defining a file or a set of files within a Google Cloud Storage bucket. Structure is documented below.

  • big_query_options - (Optional) Options defining BigQuery table and row identifiers. Structure is documented below.

The timespan_config block supports:

  • start_time - (Optional) Exclude files or rows older than this value.

  • end_time - (Optional) Exclude files or rows newer than this value. If set to zero, no upper time limit is applied.

  • enable_auto_population_of_timespan_config - (Optional) When the job is started by a JobTrigger we will automatically figure out a valid startTime to avoid scanning files that have not been modified since the last time the JobTrigger executed. This will be based on the time of the execution of the last run of the JobTrigger.

  • timestamp_field - (Required) Information on where to inspect Structure is documented below.

The timestamp_field block supports:

  • name - (Required) Specification of the field containing the timestamp of scanned items. Used for data sources like Datastore and BigQuery. For BigQuery: Required to filter out rows based on the given start and end times. If not specified and the table was modified between the given start and end times, the entire table will be scanned. The valid data types of the timestamp field are: INTEGER, DATE, TIMESTAMP, or DATETIME BigQuery column. For Datastore. Valid data types of the timestamp field are: TIMESTAMP. Datastore entity will be scanned if the timestamp property does not exist or its value is empty or invalid.

The datastore_options block supports:

  • partition_id - (Required) Datastore partition ID. A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. Structure is documented below.

  • kind - (Required) A representation of a Datastore kind. Structure is documented below.

The partition_id block supports:

  • project_id - (Required) The ID of the project to which the entities belong.

  • namespace_id - (Optional) If not empty, the ID of the namespace to which the entities belong.

The kind block supports:

  • name - (Required) The name of the Datastore kind.

The cloud_storage_options block supports:

  • file_set - (Required) Set of files to scan. Structure is documented below.

  • bytes_limit_per_file - (Optional) Max number of bytes to scan from a file. If a scanned file's size is bigger than this value then the rest of the bytes are omitted.

  • bytes_limit_per_file_percent - (Optional) Max percentage of bytes to scan from a file. The rest are omitted. The number of bytes scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit.

  • files_limit_percent - (Optional) Limits the number of files to scan to this percentage of the input FileSet. Number of files scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit.

  • file_types - (Optional) List of file type groups to include in the scan. If empty, all files are scanned and available data format processors are applied. In addition, the binary content of the selected files is always scanned as well. Images are scanned only as binary if the specified region does not support image inspection and no fileTypes were specified. Each value may be one of BINARY_FILE, TEXT_FILE, IMAGE, WORD, PDF, AVRO, CSV, and TSV.

  • sample_method - (Optional) How to sample bytes if not all bytes are scanned. Meaningful only when used in conjunction with bytesLimitPerFile. If not specified, scanning would start from the top. Possible values are TOP and RANDOM_START.

The file_set block supports:

  • url - (Optional) The Cloud Storage url of the file(s) to scan, in the format gs://<bucket>/<path>. Trailing wildcard in the path is allowed. If the url ends in a trailing slash, the bucket or directory represented by the url will be scanned non-recursively (content in sub-directories will not be scanned). This means that gs://mybucket/ is equivalent to gs://mybucket/*, and gs://mybucket/directory/ is equivalent to gs://mybucket/directory/*.

  • regex_file_set - (Optional) The regex-filtered set of files to scan. Structure is documented below.

The regex_file_set block supports:

  • bucket_name - (Required) The name of a Cloud Storage bucket.

  • include_regex - (Optional) A list of regular expressions matching file paths to include. All files in the bucket that match at least one of these regular expressions will be included in the set of files, except for those that also match an item in excludeRegex. Leaving this field empty will match all files by default (this is equivalent to including .* in the list)

  • exclude_regex - (Optional) A list of regular expressions matching file paths to exclude. All files in the bucket that match at least one of these regular expressions will be excluded from the scan.

The big_query_options block supports:

  • table_reference - (Required) Set of files to scan. Structure is documented below.

The table_reference block supports:

  • project_id - (Required) The Google Cloud Platform project ID of the project containing the table.

  • dataset_id - (Required) The dataset ID of the table.

  • table_id - (Required) The name of the table.

The actions block supports:

  • save_findings - (Required) Schedule for triggered jobs Structure is documented below.

The save_findings block supports:

  • output_config - (Required) Information on where to store output Structure is documented below.

The output_config block supports:

  • table - (Required) Information on the location of the target BigQuery Table. Structure is documented below.

  • output_schema - (Optional) Schema used for writing the findings for Inspect jobs. This field is only used for Inspect and must be unspecified for Risk jobs. Columns are derived from the Finding object. If appending to an existing table, any columns from the predefined schema that are missing will be added. No columns in the existing table will be deleted. If unspecified, then all available columns will be used for a new table or an (existing) table with no schema, and no changes will be made to an existing table that has a schema. Only for use with external storage. Possible values are BASIC_COLUMNS, GCS_COLUMNS, DATASTORE_COLUMNS, BIG_QUERY_COLUMNS, and ALL_COLUMNS.

The table block supports:

  • project_id - (Required) The Google Cloud Platform project ID of the project containing the table.

  • dataset_id - (Required) Dataset ID of the table.

  • table_id - (Optional) Name of the table. If is not set a new one will be generated for you with the following format: dlp_googleapis_yyyy_mm_dd_[dlp_job_id]. Pacific timezone will be used for generating the date details.

» Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • id - an identifier for the resource with format {{parent}}/jobTriggers/{{name}}

  • name - The resource name of the job trigger. Set by the server.

  • last_run_time - The timestamp of the last time this trigger executed.

» Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 4 minutes.
  • update - Default is 4 minutes.
  • delete - Default is 4 minutes.

» Import

JobTrigger can be imported using any of these accepted formats:

$ terraform import google_data_loss_prevention_job_trigger.default {{parent}}/jobTriggers/{{name}}
$ terraform import google_data_loss_prevention_job_trigger.default {{parent}}/{{name}}