Add support for DLP Hybrid inspect

[akshay-dhote-db]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

If we want to perform inspect of CloudSQL database, data loss prevention ( DLP ) inspect job needs to be configured in "hybrid" storage type through Console. Terraform module is not available for the Hybrid inspect (cloud SQL) but it is available for other storage types such as Cloud Storage , Datastore, BigQuery.

https://cloud.google.com/dlp/docs/how-to-hybrid-jobs#create-job-or-trigger

New or Affected Resource(s)

• google_data_loss_prevention_stored_info_type

Potential Terraform Configuration

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/data_loss_prevention_stored_info_type

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

References

• b/196389910

[sankit2020]

This issue tracks adding an attribute to an existing resource "data_loss_prevention_job_trigger"
This will enable users to be able to select hybrid storage class to run DLP jobs.

https://b.corp.google.com/issues/196389910

[rileykarson]

We seem to be missing storage_options.hybrid_options in google_data_loss_prevention_job_trigger , as well as potentially other stuff covered in the user guide I've edited into the main comment.

[roaks3]

I've reviewed the API spec and the guide linked here, and will plan to fix this by adding the following fields:

• hybridOptions.description
• hybridOptions.requiredFindingLabelKeys
• hybridOptions.labels
• hybridOptions.tableOptions

With these fields added, users will be able to inspect from a Cloud SQL (or other) database, and use all of the other DLP job trigger options we offer today in Terraform.

Note that the guide mentions some fields we don't currently support, like jobNotificationEmails and inspectConfig, but since they are not necessary to use Cloud SQL with DLP job triggers, I won't be adding them here. Instead, they can be added as separate feature requests.

[roaks3]

Correction: it looks like we also need to add triggers.manual, which is the only option allowed for hybrid job triggers

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.