feat: add the TagResources API

Google APIs · copybara-github · commit 7314e20f5e3b · 2024-08-05T15:54:56.000-07:00
PiperOrigin-RevId: 659709816
diff --git a/google/privacy/dlp/v2/dlp.proto b/google/privacy/dlp/v2/dlp.proto
@@ -4811,6 +4811,18 @@ message InspectJobConfig {
   repeated Action actions = 4;
 }
 
+// Whether a profile being created is the first generation or an update.
+enum ProfileGeneration {
+  // Unused.
+  PROFILE_GENERATION_UNSPECIFIED = 0;
+
+  // The profile is the first profile for the resource.
+  PROFILE_GENERATION_NEW = 1;
+
+  // The profile is an update to a previous profile.
+  PROFILE_GENERATION_UPDATE = 2;
+}
+
 // A task to execute when a data profile has been generated.
 message DataProfileAction {
   // If set, the detailed data profiles will be persisted to the location
@@ -4885,13 +4897,70 @@ message DataProfileAction {
     ERROR_CHANGED = 4;
   }
 
+  // If set, attaches the [tags]
+  // (https://cloud.google.com/resource-manager/docs/tags/tags-overview)
+  // provided to profiled resources. Tags support [access
+  // control](https://cloud.google.com/iam/docs/tags-access-control). You can
+  // conditionally grant or deny access to a resource based on whether the
+  // resource has a specific tag.
+  message TagResources {
+    // The tag to attach to profiles matching the condition. At most one
+    // `TagCondition` can be specified per sensitivity level.
+    message TagCondition {
+      // The tag value to attach to resources.
+      TagValue tag = 1;
+
+      // The type of condition on which attaching the tag will be predicated.
+      oneof type {
+        // Conditions attaching the tag to a resource on its profile having this
+        // sensitivity score.
+        SensitivityScore sensitivity_score = 2;
+      }
+    }
+
+    // A value of a tag.
+    message TagValue {
+      // The format of the tag value.
+      oneof format {
+        // The namespaced name for the tag value to attach to resources. Must be
+        // in the format `{parent_id}/{tag_key_short_name}/{short_name}`, for
+        // example, "123456/environment/prod".
+        string namespaced_value = 1;
+      }
+    }
+
+    // The tags to associate with different conditions.
+    repeated TagCondition tag_conditions = 1;
+
+    // The profile generations for which the tag should be attached to
+    // resources. If you attach a tag to only new profiles, then if the
+    // sensitivity score of a profile subsequently changes, its tag doesn't
+    // change. By default, this field includes only new profiles. To include
+    // both new and updated profiles for tagging, this field should explicitly
+    // include both `PROFILE_GENERATION_NEW` and `PROFILE_GENERATION_UPDATE`.
+    repeated ProfileGeneration profile_generations_to_tag = 2;
+
+    // Whether applying a tag to a resource should lower the risk of the profile
+    // for that resource. For example, in conjunction with an [IAM deny
+    // policy](https://cloud.google.com/iam/docs/deny-overview), you can deny
+    // all principals a permission if a tag value is present, mitigating the
+    // risk of the resource. This also lowers the data risk of resources at the
+    // lower levels of the resource hierarchy. For example, reducing the data
+    // risk of a table data profile also reduces the data risk of the
+    // constituent column data profiles.
+    bool lower_data_risk_to_low = 3;
+  }
+
   // Type of action to execute when a profile is generated.
   oneof action {
     // Export data profiles into a provided location.
     Export export_data = 1;
 
     // Publish a message into the Pub/Sub topic.
     PubSubNotification pub_sub_notification = 2;
+
+    // Tags the profiled resources with the specified tag values.
+    TagResources tag_resources = 8;
   }
 }
 
