add recordTransformation to DLP with cryptoDeterministicConfig support

[erlanderlo]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

In relation to #9108, adding the cryptoDeterministicConfig for tabular and structured data would be helpful, as well. Learn more about tabular data transformation in the examples of de-identifying tabular docs.

De-identifying tabular data is handled by the recordTransoformation attributes, which will eventually have the same info_type_transformation block with primitive crypto types.

An example from the docs is in the references section.

New or Affected Resource(s)

• google_data_loss_prevention_deidentify_template

Potential Terraform Configuration

The below example shows performing deterministic crypto for 2 columns and applying the transform to the entirety of the columns. It also shows applying a deterministic crypto for 1 column while looking for 2 particular info types and leaving the rest of the column unchanged.

resource "google_data_loss_prevention_deidentify_template" "table" {
    parent = "projects/PROJECT"
    description = "DESCRIPTION"
    display_name = "DISPLAY_NAME"

    deidentify_config {
        record_transformations: [
            field_transformations: [
                {
                    fields: [
                        {
                            name: "Card_NUMBER"
                        },
                        {
                            name: "DATE_OF_BIRTH"
                        }
                    ],
                    primitive_transformation: {
                        crypto_hash_config: {
                            crypto_key: {
                                kms_wrapped: {
                                    wrapped_key: "B64_WRAPPED_TOKENIZATION_KEY",
                                    crypto_key_name: "projects/PROJECT/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME"
                                }
                            }
                        }
                    }
                },
                {
                    fields: [
                        {
                            name: "Notes"
                        }
                    ],
                    info_type_transformations: {
                        transformations: [
                            {
                                infoTypes: [
                                    {
                                        name: "EMAIL_ADDRESS"
                                    },
                                    {
                                        name: "PHONE_NUMBER"
                                    },
                                ],
                                primitive_transformation {
                                    crypto_deterministic_config {
                                        crypto_key {
                                            kms_wrapped {
                                                wrapped_key = "B64_WRAPPED_TOKENIZATION_KEY",
                                                crypto_key_name "projects/PROJECT/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME"
                                            }
                                        }
                                    }
                                }                     
                            }
                        ]
                    }
                }
            ]
        ]
    }
}

References

• DLP de-identification API Overview

  • then see the recordTransformation obj

• DLP record transformation guide

• example java example for DLP handling table data through record transformations

• #0000

[SarahFrench]

I just got a notification about this issue but I can't see what it was 😅

This issue is requesting two things:

1) adding record transformations

e.g. google_data_loss_prevention_deidentify_template.foo.deidentify_config.record_transformations

Completed in PRs:

• Add new fields within deidentify_config field of google_data_loss_prevention_deidentify_template resource GoogleCloudPlatform/magic-modules#6872
• Add remaining fields within deidentify_config.record_transformations.field_transformations field of google_data_loss_prevention_deidentify_template resource GoogleCloudPlatform/magic-modules#6886
• Add record_suppressions field to google_data_loss_prevention_deidentify_template resource GoogleCloudPlatform/magic-modules#6998

This is shown in the provider documentation here:

• record_transformations
  • field_transformations block
  • record_suppressions block

2) Adding cryptoDeterministicConfig support.

e.g. google_data_loss_prevention_deidentify_template.foo.deidentify_config.record_transformations[0].info_type_transformations[0].transformations[0].primitive_transformation.crypto_deterministic_config

This hasn't been completed yet; the field_transformations block doesn't contain info_type_transformations

[JayS-crest]

I just got a notification about this issue but I can't see what it was 😅

This issue is requesting two things:

1) adding record transformations

e.g. google_data_loss_prevention_deidentify_template.foo.deidentify_config.record_transformations

Completed in PRs:

• Add new fields within deidentify_config field of google_data_loss_prevention_deidentify_template resource GoogleCloudPlatform/magic-modules#6872
• Add remaining fields within deidentify_config.record_transformations.field_transformations field of google_data_loss_prevention_deidentify_template resource GoogleCloudPlatform/magic-modules#6886
• Add record_suppressions field to google_data_loss_prevention_deidentify_template resource GoogleCloudPlatform/magic-modules#6998

This is shown in the provider documentation here:

• record_transformations

  • field_transformations block
  • record_suppressions block

2) Adding cryptoDeterministicConfig support.

e.g. google_data_loss_prevention_deidentify_template.foo.deidentify_config.record_transformations[0].info_type_transformations[0].transformations[0].primitive_transformation.crypto_deterministic_config

This hasn't been completed yet; the field_transformations block doesn't contain info_type_transformations

I was working on another issue regarding DLP and mistakenly commented that here instead hence, I deleted that. Also, regarding the missing attributes of deIdentifyTemplate, I've already added several attributes in a PR and we are going to work on and add the remaining attributes recordTransformation as well.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.