# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'DeidentifyTemplate'
description: |
  Allows creation of templates to de-identify content.
references:
  guides:
    'Official Documentation': 'https://cloud.google.com/dlp/docs/concepts-templates'
  api: 'https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates'
docs:
id_format: '{{parent}}/deidentifyTemplates/{{name}}'
base_url: '{{parent}}/deidentifyTemplates'
self_link: '{{parent}}/deidentifyTemplates/{{name}}'
create_url: '{{parent}}/deidentifyTemplates'
update_verb: 'PATCH'
update_mask: true
timeouts:
  insert_minutes: 20
  update_minutes: 20
  delete_minutes: 20
custom_code:
  encoder: 'templates/terraform/encoders/wrap_object_with_template_id.go.tmpl'
  update_encoder: 'templates/terraform/encoders/wrap_object.go.tmpl'
  decoder: 'templates/terraform/decoders/dlp_template_id.go.tmpl'
  custom_import: 'templates/terraform/custom_import/dlp_import.go.tmpl'
# Skip sweeper due to non-standard URL
exclude_sweeper: true
examples:
  - name: 'dlp_deidentify_template_basic'
    primary_resource_id: 'basic'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_deidentify_template_skip_characters'
    primary_resource_id: 'basic'
    test_env_vars:
      project: 'PROJECT_NAME'
    exclude_docs: true
  - name: 'dlp_deidentify_template_image_transformations'
    primary_resource_id: 'basic'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_deidentify_template_with_template_id'
    primary_resource_id: 'with_template_id'
    vars:
      name: 'my-template'
    test_env_vars:
      project: 'PROJECT_NAME'
    exclude_docs: true
parameters:
  - name: 'parent'
    type: String
    description: |
      The parent of the template in any of the following formats:

      * `projects/{{project}}`
      * `projects/{{project}}/locations/{{location}}`
      * `organizations/{{organization_id}}`
      * `organizations/{{organization_id}}/locations/{{location}}`
    url_param_only: true
    required: true
    immutable: true
properties:
  - name: 'name'
    type: String
    description: |
      The resource name of the template. Set by the server.
    output: true
    custom_flatten: 'templates/terraform/custom_flatten/name_from_self_link.tmpl'
  - name: 'description'
    type: String
    description: |
      A description of the template.
  - name: 'displayName'
    type: String
    description: |
      User set display name of the template.
  - name: 'createTime'
    type: String
    description: |
      The creation timestamp of an deidentifyTemplate. Set by the server.
    output: true
  - name: 'updateTime'
    type: String
    description: |
      The last update timestamp of an deidentifyTemplate. Set by the server.
    output: true
  - name: 'templateId'
    type: String
    description: |
      The template id can contain uppercase and lowercase letters, numbers, and hyphens;
      that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is
      100 characters. Can be empty to allow the system to generate one.
    url_param_only: true
    immutable: true
    default_from_api: true
  - name: 'deidentifyConfig'
    type: NestedObject
    description: Configuration of the deidentify template
    required: true
    properties:
      - name: 'imageTransformations'
        type: NestedObject
        description: Treat the dataset as an image and redact.
        exactly_one_of:
          - 'deidentify_config.0.info_type_transformations'
          - 'deidentify_config.0.record_transformations'
          - 'deidentify_config.0.image_transformations'
        properties:
          - name: 'transforms'
            type: Array
            description: |
              For determination of how redaction of images should occur.
            required: true
            item_type:
              type: NestedObject
              properties:
                - name: 'redactionColor'
                  type: NestedObject
                  description: |
                    The color to use when redacting content from an image. If not specified, the default is black.
                  properties:
                    - name: 'red'
                      type: Double
                      description: |
                        The amount of red in the color as a value in the interval [0, 1].
                      default_value: 0.0
                    - name: 'blue'
                      type: Double
                      description: |
                        The amount of blue in the color as a value in the interval [0, 1].
                      default_value: 0.0
                    - name: 'green'
                      type: Double
                      description: |
                        The amount of green in the color as a value in the interval [0, 1].
                      default_value: 0.0
                - name: 'selectedInfoTypes'
                  type: NestedObject
                  description: Apply transformation to the selected infoTypes.
                  properties:
                    - name: 'infoTypes'
                      type: Array
                      description: |
                        InfoTypes to apply the transformation to. Leaving this empty will apply the transformation to apply to
                        all findings that correspond to infoTypes that were requested in InspectConfig.
                      required: true
                      item_type:
                        type: NestedObject
                        properties:
                          - name: 'name'
                            type: String
                            description: |
                              Name of the information type.
                            required: true
                          - name: 'version'
                            type: String
                            description: |
                              Version name for this InfoType.
                          - name: 'sensitivityScore'
                            type: NestedObject
                            description: |
                              Optional custom sensitivity for this InfoType. This only applies to data profiling.
                            properties:
                              - name: 'score'
                                type: Enum
                                description: |
                                  The sensitivity score applied to the resource.
                                required: true
                                enum_values:
                                  - 'SENSITIVITY_LOW'
                                  - 'SENSITIVITY_MODERATE'
                                  - 'SENSITIVITY_HIGH'
                - name: 'allInfoTypes'
                  type: NestedObject
                  description:
                    Apply transformation to all findings not specified in other
                    ImageTransformation's selectedInfoTypes.
                    # The fields below are necessary to include the "allInfoTypes" transformation in the payload
                  send_empty_value: true
                  allow_empty_object: true
                  properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#allinfotypes
                    []
                - name: 'allText'
                  type: NestedObject
                  description:
                    Apply transformation to all text that doesn't match an
                    infoType.
                    # The fields below are necessary to include the "allText" transformation in the payload
                  send_empty_value: true
                  allow_empty_object: true
                  properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#alltext
                    []
      - name: 'infoTypeTransformations'
        type: NestedObject
        description:
          Treat the dataset as free-form text and apply the same free text
          transformation everywhere
        exactly_one_of:
          - 'deidentify_config.0.info_type_transformations'
          - 'deidentify_config.0.record_transformations'
          - 'deidentify_config.0.image_transformations'
        properties:
          - name: 'transformations'
            type: Array
            description: |
              Transformation for each infoType. Cannot specify more than one for a given infoType.
            required: true
            item_type:
              type: NestedObject
              properties:
                - name: 'infoTypes'
                  type: Array
                  description: |
                    InfoTypes to apply the transformation to. Leaving this empty will apply the transformation to apply to
                    all findings that correspond to infoTypes that were requested in InspectConfig.
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'name'
                        type: String
                        description: |
                          Name of the information type.
                        required: true
                      - name: 'version'
                        type: String
                        description: |
                          Version name for this InfoType.
                      - name: 'sensitivityScore'
                        type: NestedObject
                        description: |
                          Optional custom sensitivity for this InfoType. This only applies to data profiling.
                        properties:
                          - name: 'score'
                            type: Enum
                            description: |
                              The sensitivity score applied to the resource.
                            required: true
                            enum_values:
                              - 'SENSITIVITY_LOW'
                              - 'SENSITIVITY_MODERATE'
                              - 'SENSITIVITY_HIGH'
                - name: 'primitiveTransformation'
                  type: NestedObject
                  description: |
                    Primitive transformation to apply to the infoType.
                    The `primitive_transformation` block must only contain one argument, corresponding to the type of transformation.
                  required: true
                  properties:
                    - name: 'replaceConfig'
                      type: NestedObject
                      description: |
                        Replace each input value with a given value.
                      properties:
                        - name: 'newValue'
                          type: NestedObject
                          description: |
                            Replace each input value with a given value.
                            The `new_value` block must only contain one argument. For example when replacing the contents of a string-type field, only `string_value` should be set.
                          required: true
                          properties:
                            - name: 'integerValue'
                              type: Integer
                              description: |
                                An integer value.
                            - name: 'floatValue'
                              type: Double
                              description: |
                                A float value.
                            - name: 'stringValue'
                              type: String
                              description: |
                                A string value.
                            - name: 'booleanValue'
                              type: Boolean
                              description: |
                                A boolean value.
                            - name: 'timestampValue'
                              type: String
                              description: |
                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
                                Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                            - name: 'timeValue'
                              type: NestedObject
                              description: |
                                Represents a time of day.
                              properties:
                                - name: 'hours'
                                  type: Integer
                                  description: |
                                    Hours of day in 24 hour format. Should be from 0 to 23.
                                - name: 'minutes'
                                  type: Integer
                                  description: |
                                    Minutes of hour of day. Must be from 0 to 59.
                                - name: 'seconds'
                                  type: Integer
                                  description: |
                                    Seconds of minutes of the time. Must normally be from 0 to 59.
                                - name: 'nanos'
                                  type: Integer
                                  description: |
                                    Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
                            - name: 'dateValue'
                              type: NestedObject
                              description: |
                                Represents a whole or partial calendar date.
                              properties:
                                - name: 'year'
                                  type: Integer
                                  description: |
                                    Year of date. Must be from 1 to 9999, or 0 if specifying a date without a year.
                                - name: 'month'
                                  type: Integer
                                  description: |
                                    Month of year. Must be from 1 to 12, or 0 if specifying a year without a month and day.
                                - name: 'day'
                                  type: Integer
                                  description: |
                                    Day of month. Must be from 1 to 31 and valid for the year and month, or 0 if specifying a
                                    year by itself or a year and month where the day is not significant.
                            - name: 'dayOfWeekValue'
                              type: Enum
                              description: |
                                Represents a day of the week.
                              enum_values:
                                - 'MONDAY'
                                - 'TUESDAY'
                                - 'WEDNESDAY'
                                - 'THURSDAY'
                                - 'FRIDAY'
                                - 'SATURDAY'
                                - 'SUNDAY'
                    - name: 'replaceWithInfoTypeConfig'
                      type: Boolean
                      description: |
                        Replace each matching finding with the name of the info type.
                      custom_flatten: 'templates/terraform/custom_flatten/object_to_bool.go.tmpl'
                      custom_expand: 'templates/terraform/custom_expand/bool_to_object.go.tmpl'
                    - name: 'characterMaskConfig'
                      type: NestedObject
                      description: |
                        Partially mask a string by replacing a given number of characters with a fixed character.
                        Masking can start from the beginning or end of the string.
                      properties:
                        - name: 'maskingCharacter'
                          type: String
                          description: |
                            Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string
                            such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for
                            strings, and 0 for digits.
                        - name: 'numberToMask'
                          type: Integer
                          description: |
                            Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.
                        - name: 'reverseOrder'
                          type: Boolean
                          description: |
                            Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is `false`, then the
                            input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
                        - name: 'charactersToIgnore'
                          type: Array
                          description: |
                            Characters to skip when doing de-identification of a value. These will be left alone and skipped.
                          item_type:
                            type: NestedObject
                            properties:
                              - name: 'charactersToSkip'
                                type: String
                                description: |
                                  Characters to not transform when masking.
                              - name: 'commonCharactersToIgnore'
                                type: Enum
                                description: |
                                  Common characters to not transform when masking. Useful to avoid removing punctuation.
                                enum_values:
                                  - 'NUMERIC'
                                  - 'ALPHA_UPPER_CASE'
                                  - 'ALPHA_LOWER_CASE'
                                  - 'PUNCTUATION'
                                  - 'WHITESPACE'
                    - name: 'cryptoDeterministicConfig'
                      type: NestedObject
                      description: |
                        Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297).
                      properties:
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption function.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                        - name: 'surrogateInfoType'
                          type: NestedObject
                          description: |
                            The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}

                            For example, if the name of custom info type is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'

                            This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.

                            Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.

                            In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either

                            *   reverse a surrogate that does not correspond to an actual identifier
                            *   be unable to parse the surrogate and result in an error

                            Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE.
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
                            - name: 'version'
                              type: String
                              description: |
                                Optional version name for this InfoType.
                            - name: 'sensitivityScore'
                              type: NestedObject
                              description: |
                                Optional custom sensitivity for this InfoType. This only applies to data profiling.
                              properties:
                                - name: 'score'
                                  type: Enum
                                  description: |
                                    The sensitivity score applied to the resource.
                                  required: true
                                  enum_values:
                                    - 'SENSITIVITY_LOW'
                                    - 'SENSITIVITY_MODERATE'
                                    - 'SENSITIVITY_HIGH'
                        - name: 'context'
                          type: NestedObject
                          description: |
                            A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.

                            If the context is not set, plaintext would be used as is for encryption. If the context is set but:

                            1.  there is no record present when transforming a given value or
                            2.  the field is not present when transforming a given value,

                            plaintext would be used as is for encryption.

                            Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name describing the field.
                    - name: 'cryptoReplaceFfxFpeConfig'
                      type: NestedObject
                      description: |
                        Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `content.reidentify` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.

                        Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity.
                      properties:
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption algorithm.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                        - name: 'context'
                          type: NestedObject
                          description: |
                            The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.

                            If the context is set but:

                            1.  there is no record present when transforming a given value or
                            2.  the field is not present when transforming a given value,

                            a default tweak will be used.

                            Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string.

                            The tweak is constructed as a sequence of bytes in big endian byte order such that:

                            *   a 64 bit integer is encoded followed by a single byte of value 1
                            *   a string is encoded in UTF-8 format followed by a single byte of value 2
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name describing the field.
                        - name: 'surrogateInfoType'
                          type: NestedObject
                          description: |
                            The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\_type\_name(surrogate\_character\_count):surrogate

                            For example, if the name of custom infoType is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'

                            This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.

                            In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
                            - name: 'version'
                              type: String
                              description: |
                                Optional version name for this InfoType.
                            - name: 'sensitivityScore'
                              type: NestedObject
                              description: |
                                Optional custom sensitivity for this InfoType. This only applies to data profiling.
                              properties:
                                - name: 'score'
                                  type: Enum
                                  description: |
                                    The sensitivity score applied to the resource.
                                  required: true
                                  enum_values:
                                    - 'SENSITIVITY_LOW'
                                    - 'SENSITIVITY_MODERATE'
                                    - 'SENSITIVITY_HIGH'
                        - name: 'commonAlphabet'
                          type: Enum
                          description: |
                            Common alphabets.
                          enum_values:
 # Unused.
                            - 'FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED'
 # [0-9] (radix of 10)
                            - 'NUMERIC'
 # [0-9A-F] (radix of 16)
                            - 'HEXADECIMAL'
 # [0-9A-Z] (radix of 36)
                            - 'UPPER_CASE_ALPHA_NUMERIC'
 # [0-9A-Za-z] (radix of 62)
                            - 'ALPHA_NUMERIC'
                        - name: 'customAlphabet'
                          type: String
                          description: |
                            This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:

                            ``0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|:;"'<,>.?/``
                        - name: 'radix'
                          type: Integer
                          description: |
                            The native way to select the alphabet. Must be in the range \[2, 95\].
                    - name: 'replaceDictionaryConfig'
                      type: NestedObject
                      description:
                        Replace with a value randomly drawn (with replacement)
                        from a dictionary.
                      properties:
                        - name: 'wordList'
                          type: NestedObject
                          description: |
                            A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries.
                          required: true
                          properties:
                            - name: 'words'
                              type: Array
                              description: |
                                Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.
                              required: true
                              item_type:
                                type: String
                    - name: 'dateShiftConfig'
                      type: NestedObject
                      description: |
                        Shifts dates by random number of days, with option to be consistent for the same context.
                      properties:
                        - name: 'context'
                          type: NestedObject
                          description: |
                            Points to the field that contains the context, for example, an entity id.
                            If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                          properties:
                            - name: 'name'
                              type: String
                              description: Name describing the field.
                              required: true
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption function.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.
                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.
                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                        - name: 'upperBoundDays'
                          type: Integer
                          description: |
                            Range of shift in days. Actual shift will be selected at random within this range (inclusive ends).
                            Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.
                          required: true
                        - name: 'lowerBoundDays'
                          type: Integer
                          description: |
                            Range of shift in days. Negative means shift to earlier in time.
                          required: true
                    - name: 'fixedSizeBucketingConfig'
                      type: NestedObject
                      description: |
                        Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.

                        The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".

                        This can be used on data of type: double, long.

                        If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.

                        See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
                      properties:
                        - name: 'lowerBound'
                          type: NestedObject
                          description: |
                            Lower bound value of buckets.
                            All values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".
                            The `lower_bound` block must only contain one argument. See the `fixed_size_bucketing_config` block description for more information about choosing a data type.
                          required: true
                          properties:
                            - name: 'integerValue'
                              type: String
                              description: An integer value (int64 format)
                            - name: 'floatValue'
                              type: Double
                              description: A float value.
                        - name: 'upperBound'
                          type: NestedObject
                          description: |
                            Upper bound value of buckets.
                            All values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".
                            The `upper_bound` block must only contain one argument. See the `fixed_size_bucketing_config` block description for more information about choosing a data type.
                          required: true
                          properties:
                            - name: 'integerValue'
                              type: String
                              description: An integer value (int64 format)
                            - name: 'floatValue'
                              type: Double
                              description: A float value.
                        - name: 'bucketSize'
                          type: Double
                          description: |
                            Size of each bucket (except for minimum and maximum buckets).
                            So if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.
                            Precision up to 2 decimals works.
                          required: true
                    - name: 'bucketingConfig'
                      type: NestedObject
                      description: |
                        Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
                        This can be used on data of type: number, long, string, timestamp.
                        If the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
                        See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
                      properties:
                        - name: 'buckets'
                          type: Array
                          description: |
                            Set of buckets. Ranges must be non-overlapping.
                            Bucket is represented as a range, along with replacement values.
                          item_type:
                            type: NestedObject
                            properties:
                              - name: 'min'
                                type: NestedObject
                                description: |
                                  Lower bound of the range, inclusive. Type should be the same as max if used.
                                  The `min` block must only contain one argument. See the `bucketing_config` block description for more information about choosing a data type.
                                properties:
                                  - name: 'integerValue'
                                    type: String
                                    description: An integer value (int64 format)
                                  - name: 'floatValue'
                                    type: Double
                                    description: A float value.
                                  - name: 'stringValue'
                                    type: String
                                    description: A string value.
                                  - name: 'timestampValue'
                                    type: String
                                    description: |
                                      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                  - name: 'timeValue'
                                    type: NestedObject
                                    description: Represents a time of day.
                                    properties:
                                      - name: 'hours'
                                        type: Integer
                                        description: |
                                          Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                      - name: 'minutes'
                                        type: Integer
                                        description:
                                          Minutes of hour of day. Must be from 0
                                          to 59.
                                      - name: 'seconds'
                                        type: Integer
                                        description:
                                          Seconds of minutes of the time. Must
                                          normally be from 0 to 59. An API may
                                          allow the value 60 if it allows
                                          leap-seconds.
                                      - name: 'nanos'
                                        type: Integer
                                        description:
                                          Fractions of seconds in nanoseconds.
                                          Must be from 0 to 999,999,999.
                                  - name: 'dateValue'
                                    type: NestedObject
                                    description:
                                      Represents a whole or partial calendar
                                      date.
                                    properties:
                                      - name: 'year'
                                        type: Integer
                                        description:
                                          Year of the date. Must be from 1 to
                                          9999, or 0 to specify a date without a
                                          year.
                                      - name: 'month'
                                        type: Integer
                                        description:
                                          Month of a year. Must be from 1 to 12,
                                          or 0 to specify a year without a month
                                          and day.
                                      - name: 'day'
                                        type: Integer
                                        description:
                                          Day of a month. Must be from 1 to 31
                                          and valid for the year and month, or 0
                                          to specify a year by itself or a year
                                          and month where the day isn't
                                          significant.
                                  - name: 'dayOfWeekValue'
                                    type: Enum
                                    description: Represents a day of the week.
                                    enum_values:
                                      - 'MONDAY'
                                      - 'TUESDAY'
                                      - 'WEDNESDAY'
                                      - 'THURSDAY'
                                      - 'FRIDAY'
                                      - 'SATURDAY'
                                      - 'SUNDAY'
                              - name: 'max'
                                type: NestedObject
                                description: |
                                  Upper bound of the range, exclusive; type must match min.
                                  The `max` block must only contain one argument. See the `bucketing_config` block description for more information about choosing a data type.
                                properties:
                                  - name: 'integerValue'
                                    type: String
                                    description: An integer value (int64 format)
                                  - name: 'floatValue'
                                    type: Double
                                    description: A float value.
                                  - name: 'stringValue'
                                    type: String
                                    description: A string value.
                                  - name: 'timestampValue'
                                    type: String
                                    description: |
                                      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                  - name: 'timeValue'
                                    type: NestedObject
                                    description: Represents a time of day.
                                    properties:
                                      - name: 'hours'
                                        type: Integer
                                        description: |
                                          Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                      - name: 'minutes'
                                        type: Integer
                                        description:
                                          Minutes of hour of day. Must be from 0
                                          to 59.
                                      - name: 'seconds'
                                        type: Integer
                                        description:
                                          Seconds of minutes of the time. Must
                                          normally be from 0 to 59. An API may
                                          allow the value 60 if it allows
                                          leap-seconds.
                                      - name: 'nanos'
                                        type: Integer
                                        description:
                                          Fractions of seconds in nanoseconds.
                                          Must be from 0 to 999,999,999.
                                  - name: 'dateValue'
                                    type: NestedObject
                                    description:
                                      Represents a whole or partial calendar
                                      date.
                                    properties:
                                      - name: 'year'
                                        type: Integer
                                        description:
                                          Year of the date. Must be from 1 to
                                          9999, or 0 to specify a date without a
                                          year.
                                      - name: 'month'
                                        type: Integer
                                        description:
                                          Month of a year. Must be from 1 to 12,
                                          or 0 to specify a year without a month
                                          and day.
                                      - name: 'day'
                                        type: Integer
                                        description:
                                          Day of a month. Must be from 1 to 31
                                          and valid for the year and month, or 0
                                          to specify a year by itself or a year
                                          and month where the day isn't
                                          significant.
                                  - name: 'dayOfWeekValue'
                                    type: Enum
                                    description: Represents a day of the week.
                                    enum_values:
                                      - 'MONDAY'
                                      - 'TUESDAY'
                                      - 'WEDNESDAY'
                                      - 'THURSDAY'
                                      - 'FRIDAY'
                                      - 'SATURDAY'
                                      - 'SUNDAY'
                              - name: 'replacementValue'
                                type: NestedObject
                                description: |
                                  Replacement value for this bucket.
                                  The `replacement_value` block must only contain one argument.
                                required: true
                                properties:
                                  - name: 'integerValue'
                                    type: String
                                    description: An integer value (int64 format)
                                  - name: 'floatValue'
                                    type: Double
                                    description: A float value.
                                  - name: 'stringValue'
                                    type: String
                                    description: A string value.
                                  - name: 'timestampValue'
                                    type: String
                                    description: |
                                      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                  - name: 'timeValue'
                                    type: NestedObject
                                    description: Represents a time of day.
                                    properties:
                                      - name: 'hours'
                                        type: Integer
                                        description: |
                                          Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                      - name: 'minutes'
                                        type: Integer
                                        description:
                                          Minutes of hour of day. Must be from 0
                                          to 59.
                                      - name: 'seconds'
                                        type: Integer
                                        description:
                                          Seconds of minutes of the time. Must
                                          normally be from 0 to 59. An API may
                                          allow the value 60 if it allows
                                          leap-seconds.
                                      - name: 'nanos'
                                        type: Integer
                                        description:
                                          Fractions of seconds in nanoseconds.
                                          Must be from 0 to 999,999,999.
                                  - name: 'dateValue'
                                    type: NestedObject
                                    description:
                                      Represents a whole or partial calendar
                                      date.
                                    properties:
                                      - name: 'year'
                                        type: Integer
                                        description:
                                          Year of the date. Must be from 1 to
                                          9999, or 0 to specify a date without a
                                          year.
                                      - name: 'month'
                                        type: Integer
                                        description:
                                          Month of a year. Must be from 1 to 12,
                                          or 0 to specify a year without a month
                                          and day.
                                      - name: 'day'
                                        type: Integer
                                        description:
                                          Day of a month. Must be from 1 to 31
                                          and valid for the year and month, or 0
                                          to specify a year by itself or a year
                                          and month where the day isn't
                                          significant.
                                  - name: 'dayOfWeekValue'
                                    type: Enum
                                    description: Represents a day of the week.
                                    enum_values:
                                      - 'MONDAY'
                                      - 'TUESDAY'
                                      - 'WEDNESDAY'
                                      - 'THURSDAY'
                                      - 'FRIDAY'
                                      - 'SATURDAY'
                                      - 'SUNDAY'
                    - name: 'timePartConfig'
                      type: NestedObject
                      description:
                        For use with Date, Timestamp, and TimeOfDay, extract or
                        preserve a portion of the value.
                      properties:
                        - name: 'partToExtract'
                          type: Enum
                          description: The part of the time to keep.
                          enum_values:
 # [0-9999]
                            - 'YEAR'
 # [1-12]
                            - 'MONTH'
 # [1-31]
                            - 'DAY_OF_MONTH'
 # [1-7]
                            - 'DAY_OF_WEEK'
 # [1-53]
                            - 'WEEK_OF_YEAR'
 # [0-23]
                            - 'HOUR_OF_DAY'
                    - name: 'redactConfig'
                      type: NestedObject
                      description: |
                        Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
                      # The fields below are necessary to include the "redactConfig" transformation in the payload
                      # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                      send_empty_value: true
                      allow_empty_object: true
                      properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#redactconfig
                        []
                    - name: 'cryptoHashConfig'
                      type: NestedObject
                      description: |
                        Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes.
                        Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
                        Currently, only string and integer values can be hashed.
                        See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
                      properties:
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption function.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
      - name: 'recordTransformations'
        type: NestedObject
        description:
          Treat the dataset as structured. Transformations can be applied to
          specific locations within structured datasets, such as transforming a
          column within a table.
        exactly_one_of:
          - 'deidentify_config.0.info_type_transformations'
          - 'deidentify_config.0.record_transformations'
          - 'deidentify_config.0.image_transformations'
        properties:
          - name: 'fieldTransformations'
            type: Array
            description:
              Transform the record by applying various field transformations.
            at_least_one_of:
              - 'deidentify_config.0.record_transformations.0.field_transformations'
              - 'deidentify_config.0.record_transformations.0.record_suppressions'
            item_type:
              type: NestedObject
              properties:
                - name: 'fields'
                  type: Array
                  description: |
                    Input field(s) to apply the transformation to. When you have columns that reference their position within a list, omit the index from the FieldId.
                    FieldId name matching ignores the index. For example, instead of "contact.nums[0].type", use "contact.nums.type".
                  required: true
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'name'
                        type: String
                        description: Name describing the field.
                - name: 'condition'
                  type: NestedObject
                  description: |
                    Only apply the transformation if the condition evaluates to true for the given RecordCondition. The conditions are allowed to reference fields that are not used in the actual transformation.
                    Example Use Cases:
                    - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range.
                    - Redact a field if the date of birth field is greater than 85.
                  properties:
                    - name: 'expressions'
                      type: NestedObject
                      description: An expression.
                      properties:
                        - name: 'logicalOperator'
                          type: Enum
                          description:
                            The operator to apply to the result of conditions.
                            Default and currently only supported value is AND
                          default_value: "AND"
                          enum_values:
                            - 'AND'
                        - name: 'conditions'
                          type: NestedObject
                          description: Conditions to apply to the expression.
                          properties:
                            - name: 'conditions'
                              type: Array
                              description: A collection of conditions.
                              item_type:
                                type: NestedObject
                                properties:
                                  - name: 'field'
                                    type: NestedObject
                                    description:
                                      Field within the record this condition is
                                      evaluated against.
                                    required: true
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: Name describing the field.
                                  - name: 'operator'
                                    type: Enum
                                    description:
                                      Operator used to compare the field or
                                      infoType to the value.
                                    required: true
                                    enum_values:
                                      - 'EQUAL_TO'
                                      - 'NOT_EQUAL_TO'
                                      - 'GREATER_THAN'
                                      - 'LESS_THAN'
                                      - 'GREATER_THAN_OR_EQUALS'
                                      - 'LESS_THAN_OR_EQUALS'
                                      - 'EXISTS'
                                  - name: 'value'
                                    type: NestedObject
                                    description: |
                                      Value to compare against.
                                      The `value` block must only contain one argument. For example when a condition is evaluated against a string-type field, only `string_value` should be set.
                                      This argument is mandatory, except for conditions using the `EXISTS` operator.
                                    properties:
                                      - name: 'integerValue'
                                        type: String
                                        description:
                                          An integer value (int64 format)
                                      - name: 'floatValue'
                                        type: Double
                                        description: A float value.
                                      - name: 'stringValue'
                                        type: String
                                        description: A string value.
                                      - name: 'booleanValue'
                                        type: Boolean
                                        description: A boolean value.
                                      - name: 'timestampValue'
                                        type: String
                                        description: |
                                          A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                        validation:
                                          function: 'verify.ValidateRFC3339Date'
                                      - name: 'timeValue'
                                        type: NestedObject
                                        description: Represents a time of day.
                                        properties:
                                          - name: 'hours'
                                            type: Integer
                                            description: |
                                              Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                            validation:
 # "An API may choose to allow the value "24:00:00" for scenarios like business closing time."
                                              function: 'validation.IntBetween(0, 24)'
                                          - name: 'minutes'
                                            type: Integer
                                            description:
                                              Minutes of hour of day. Must be
                                              from 0 to 59.
                                            validation:
                                              function: 'validation.IntBetween(0, 59)'
                                          - name: 'seconds'
                                            type: Integer
                                            description:
                                              Seconds of minutes of the time.
                                              Must normally be from 0 to 59. An
                                              API may allow the value 60 if it
                                              allows leap-seconds.
                                            validation:
 # "An API may allow the value 60 if it allows leap-seconds."
                                              function: 'validation.IntBetween(0, 60)'
                                          - name: 'nanos'
                                            type: Integer
                                            description:
                                              Fractions of seconds in
                                              nanoseconds. Must be from 0 to
                                              999,999,999.
                                            validation:
                                              function: 'validation.IntBetween(0, 999999999)'
                                      - name: 'dateValue'
                                        type: NestedObject
                                        description:
                                          Represents a whole or partial calendar
                                          date.
                                        properties:
                                          - name: 'year'
                                            type: Integer
                                            description:
                                              Year of the date. Must be from 1
                                              to 9999, or 0 to specify a date
                                              without a year.
                                            validation:
                                              function: 'validation.IntBetween(1, 9999)'
                                          - name: 'month'
                                            type: Integer
                                            description:
                                              Month of a year. Must be from 1 to
                                              12, or 0 to specify a year without
                                              a month and day.
                                            validation:
                                              function: 'validation.IntBetween(0, 12)'
                                          - name: 'day'
                                            type: Integer
                                            description:
                                              Day of a month. Must be from 1 to
                                              31 and valid for the year and
                                              month, or 0 to specify a year by
                                              itself or a year and month where
                                              the day isn't significant.
                                            validation:
                                              function: 'validation.IntBetween(0, 31)'
                                      - name: 'dayOfWeekValue'
                                        type: Enum
                                        description:
                                          Represents a day of the week.
                                        enum_values:
                                          - 'MONDAY'
                                          - 'TUESDAY'
                                          - 'WEDNESDAY'
                                          - 'THURSDAY'
                                          - 'FRIDAY'
                                          - 'SATURDAY'
                                          - 'SUNDAY'
                - name: 'primitiveTransformation'
                  type: NestedObject
                  description: |
                    Apply the transformation to the entire field.
                    The `primitive_transformation` block must only contain one argument, corresponding to the type of transformation.
                    Only one of `primitive_transformation` or `info_type_transformations` must be specified.
                  properties:
                    - name: 'replaceConfig'
                      type: NestedObject
                      description: Replace with a specified value.
                      properties:
                        - name: 'newValue'
                          type: NestedObject
                          description: |
                            Replace each input value with a given value.
                            The `new_value` block must only contain one argument. For example when replacing the contents of a string-type field, only `string_value` should be set.
                          required: true
                          properties:
                            - name: 'integerValue'
                              type: String
                              description: An integer value (int64 format)
                            - name: 'floatValue'
                              type: Double
                              description: A float value.
                            - name: 'stringValue'
                              type: String
                              description: A string value.
                            - name: 'booleanValue'
                              type: Boolean
                              description: A boolean value.
                            - name: 'timestampValue'
                              type: String
                              description: |
                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                              validation:
                                function: 'verify.ValidateRFC3339Date'
                            - name: 'timeValue'
                              type: NestedObject
                              description: Represents a time of day.
                              properties:
                                - name: 'hours'
                                  type: Integer
                                  description: |
                                    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                  validation:
 # "An API may choose to allow the value "24:00:00" for scenarios like business closing time."
                                    function: 'validation.IntBetween(0, 24)'
                                - name: 'minutes'
                                  type: Integer
                                  description:
                                    Minutes of hour of day. Must be from 0 to
                                    59.
                                  validation:
                                    function: 'validation.IntBetween(0, 59)'
                                - name: 'seconds'
                                  type: Integer
                                  description:
                                    Seconds of minutes of the time. Must
                                    normally be from 0 to 59. An API may allow
                                    the value 60 if it allows leap-seconds.
                                  validation:
 # "An API may allow the value 60 if it allows leap-seconds."
                                    function: 'validation.IntBetween(0, 60)'
                                - name: 'nanos'
                                  type: Integer
                                  description:
                                    Fractions of seconds in nanoseconds. Must be
                                    from 0 to 999,999,999.
                                  validation:
                                    function: 'validation.IntBetween(0, 999999999)'
                            - name: 'dateValue'
                              type: NestedObject
                              description:
                                Represents a whole or partial calendar date.
                              properties:
                                - name: 'year'
                                  type: Integer
                                  description:
                                    Year of the date. Must be from 1 to 9999, or
                                    0 to specify a date without a year.
                                  validation:
                                    function: 'validation.IntBetween(1, 9999)'
                                - name: 'month'
                                  type: Integer
                                  description:
                                    Month of a year. Must be from 1 to 12, or 0
                                    to specify a year without a month and day.
                                  validation:
                                    function: 'validation.IntBetween(0, 12)'
                                - name: 'day'
                                  type: Integer
                                  description:
                                    Day of a month. Must be from 1 to 31 and
                                    valid for the year and month, or 0 to
                                    specify a year by itself or a year and month
                                    where the day isn't significant.
                                  validation:
                                    function: 'validation.IntBetween(0, 31)'
                            - name: 'dayOfWeekValue'
                              type: Enum
                              description: Represents a day of the week.
                              enum_values:
                                - 'MONDAY'
                                - 'TUESDAY'
                                - 'WEDNESDAY'
                                - 'THURSDAY'
                                - 'FRIDAY'
                                - 'SATURDAY'
                                - 'SUNDAY'
                    - name: 'redactConfig'
                      type: NestedObject
                      description: |
                        Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
                      # The fields below are necessary to include the "redactConfig" transformation in the payload
                      # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                      send_empty_value: true
                      allow_empty_object: true
                      properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#redactconfig
                        []
                    - name: 'characterMaskConfig'
                      type: NestedObject
                      description: |
                        Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3).
                      properties:
                        - name: 'maskingCharacter'
                          type: String
                          description: |
                            Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string
                            such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for
                            strings, and 0 for digits.
                        - name: 'numberToMask'
                          type: Integer
                          description: |
                            Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.
                            If number_to_mask is negative, this denotes inverse masking. Cloud DLP masks all but a number of characters. For example, suppose you have the following values:
                            - `masking_character` is *
                            - `number_to_mask` is -4
                            - `reverse_order` is false
                            - `characters_to_ignore` includes -
                            - Input string is 1234-5678-9012-3456

                            The resulting de-identified string is ****-****-****-3456. Cloud DLP masks all but the last four characters. If reverseOrder is true, all but the first four characters are masked as 1234-****-****-****.
                        - name: 'reverseOrder'
                          type: Boolean
                          description: |
                            Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is `false`, then the
                            input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
                        - name: 'charactersToIgnore'
                          type: Array
                          description: |
                            Characters to skip when doing de-identification of a value. These will be left alone and skipped.
                          item_type:
                            type: NestedObject
                            properties:
                              - name: 'charactersToSkip'
                                type: String
                                description: |
                                  Characters to not transform when masking.
                              - name: 'commonCharactersToIgnore'
                                type: Enum
                                description: |
                                  Common characters to not transform when masking. Useful to avoid removing punctuation.
                                enum_values:
                                  - 'NUMERIC'
                                  - 'ALPHA_UPPER_CASE'
                                  - 'ALPHA_LOWER_CASE'
                                  - 'PUNCTUATION'
                                  - 'WHITESPACE'
                    - name: 'cryptoReplaceFfxFpeConfig'
                      type: NestedObject
                      description: |
                        Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `content.reidentify` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.

                        Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity.
                      properties:
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption algorithm.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                        - name: 'context'
                          type: NestedObject
                          description: |
                            The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.

                            If the context is set but:

                            1.  there is no record present when transforming a given value or
                            2.  the field is not present when transforming a given value,

                            a default tweak will be used.

                            Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string.

                            The tweak is constructed as a sequence of bytes in big endian byte order such that:

                            *   a 64 bit integer is encoded followed by a single byte of value 1
                            *   a string is encoded in UTF-8 format followed by a single byte of value 2
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name describing the field.
                        - name: 'surrogateInfoType'
                          type: NestedObject
                          description: |
                            The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\_type\_name(surrogate\_character\_count):surrogate

                            For example, if the name of custom infoType is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'

                            This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.

                            In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
                            - name: 'version'
                              type: String
                              description: |
                                Optional version name for this InfoType.
                            - name: 'sensitivityScore'
                              type: NestedObject
                              description: |
                                Optional custom sensitivity for this InfoType. This only applies to data profiling.
                              properties:
                                - name: 'score'
                                  type: Enum
                                  description: |
                                    The sensitivity score applied to the resource.
                                  required: true
                                  enum_values:
                                    - 'SENSITIVITY_LOW'
                                    - 'SENSITIVITY_MODERATE'
                                    - 'SENSITIVITY_HIGH'
                        - name: 'commonAlphabet'
                          type: Enum
                          description: |
                            Common alphabets.
                          enum_values:
                            - 'FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED'
                            - 'NUMERIC'
                            - 'HEXADECIMAL'
                            - 'UPPER_CASE_ALPHA_NUMERIC'
                            - 'ALPHA_NUMERIC'
                        - name: 'customAlphabet'
                          type: String
                          description: |
                            This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:

                            ``0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|:;"'<,>.?/``
                        - name: 'radix'
                          type: Integer
                          description: |
                            The native way to select the alphabet. Must be in the range \[2, 95\].
                    - name: 'fixedSizeBucketingConfig'
                      type: NestedObject
                      description: |
                        Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.

                        The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".

                        This can be used on data of type: double, long.

                        If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.

                        See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
                      properties:
                        - name: 'lowerBound'
                          type: NestedObject
                          description: |
                            Lower bound value of buckets.
                            All values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".
                            The `lower_bound` block must only contain one argument. See the `fixed_size_bucketing_config` block description for more information about choosing a data type.
                          required: true
                          properties:
                            - name: 'integerValue'
                              type: String
                              description: An integer value (int64 format)
                            - name: 'floatValue'
                              type: Double
                              description: A float value.
                            - name: 'stringValue'
                              type: String
                              description: A string value.
                            - name: 'booleanValue'
                              type: Boolean
                              description: A boolean value.
                            - name: 'timestampValue'
                              type: String
                              description: |
                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                            - name: 'timeValue'
                              type: NestedObject
                              description: Represents a time of day.
                              properties:
                                - name: 'hours'
                                  type: Integer
                                  description: |
                                    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                - name: 'minutes'
                                  type: Integer
                                  description:
                                    Minutes of hour of day. Must be from 0 to
                                    59.
                                - name: 'seconds'
                                  type: Integer
                                  description:
                                    Seconds of minutes of the time. Must
                                    normally be from 0 to 59. An API may allow
                                    the value 60 if it allows leap-seconds.
                                - name: 'nanos'
                                  type: Integer
                                  description:
                                    Fractions of seconds in nanoseconds. Must be
                                    from 0 to 999,999,999.
                            - name: 'dateValue'
                              type: NestedObject
                              description:
                                Represents a whole or partial calendar date.
                              properties:
                                - name: 'year'
                                  type: Integer
                                  description:
                                    Year of the date. Must be from 1 to 9999, or
                                    0 to specify a date without a year.
                                - name: 'month'
                                  type: Integer
                                  description:
                                    Month of a year. Must be from 1 to 12, or 0
                                    to specify a year without a month and day.
                                - name: 'day'
                                  type: Integer
                                  description:
                                    Day of a month. Must be from 1 to 31 and
                                    valid for the year and month, or 0 to
                                    specify a year by itself or a year and month
                                    where the day isn't significant.
                            - name: 'dayOfWeekValue'
                              type: Enum
                              description: Represents a day of the week.
                              enum_values:
                                - 'MONDAY'
                                - 'TUESDAY'
                                - 'WEDNESDAY'
                                - 'THURSDAY'
                                - 'FRIDAY'
                                - 'SATURDAY'
                                - 'SUNDAY'
                        - name: 'upperBound'
                          type: NestedObject
                          description: |
                            Upper bound value of buckets.
                            All values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".
                            The `upper_bound` block must only contain one argument. See the `fixed_size_bucketing_config` block description for more information about choosing a data type.
                          required: true
                          properties:
                            - name: 'integerValue'
                              type: String
                              description: An integer value (int64 format)
                            - name: 'floatValue'
                              type: Double
                              description: A float value.
                            - name: 'stringValue'
                              type: String
                              description: A string value.
                            - name: 'booleanValue'
                              type: Boolean
                              description: A boolean value.
                            - name: 'timestampValue'
                              type: String
                              description: |
                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                            - name: 'timeValue'
                              type: NestedObject
                              description: Represents a time of day.
                              properties:
                                - name: 'hours'
                                  type: Integer
                                  description: |
                                    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                - name: 'minutes'
                                  type: Integer
                                  description:
                                    Minutes of hour of day. Must be from 0 to
                                    59.
                                - name: 'seconds'
                                  type: Integer
                                  description:
                                    Seconds of minutes of the time. Must
                                    normally be from 0 to 59. An API may allow
                                    the value 60 if it allows leap-seconds.
                                - name: 'nanos'
                                  type: Integer
                                  description:
                                    Fractions of seconds in nanoseconds. Must be
                                    from 0 to 999,999,999.
                            - name: 'dateValue'
                              type: NestedObject
                              description:
                                Represents a whole or partial calendar date.
                              properties:
                                - name: 'year'
                                  type: Integer
                                  description:
                                    Year of the date. Must be from 1 to 9999, or
                                    0 to specify a date without a year.
                                - name: 'month'
                                  type: Integer
                                  description:
                                    Month of a year. Must be from 1 to 12, or 0
                                    to specify a year without a month and day.
                                - name: 'day'
                                  type: Integer
                                  description:
                                    Day of a month. Must be from 1 to 31 and
                                    valid for the year and month, or 0 to
                                    specify a year by itself or a year and month
                                    where the day isn't significant.
                            - name: 'dayOfWeekValue'
                              type: Enum
                              description: Represents a day of the week.
                              enum_values:
                                - 'MONDAY'
                                - 'TUESDAY'
                                - 'WEDNESDAY'
                                - 'THURSDAY'
                                - 'FRIDAY'
                                - 'SATURDAY'
                                - 'SUNDAY'
                        - name: 'bucketSize'
                          type: Double
                          description: |
                            Size of each bucket (except for minimum and maximum buckets).
                            So if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.
                            Precision up to 2 decimals works.
                          required: true
                    - name: 'bucketingConfig'
                      type: NestedObject
                      description: |
                        Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
                        This can be used on data of type: number, long, string, timestamp.
                        If the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
                        See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
                      properties:
                        - name: 'buckets'
                          type: Array
                          description: |
                            Set of buckets. Ranges must be non-overlapping.
                            Bucket is represented as a range, along with replacement values.
                          item_type:
                            type: NestedObject
                            properties:
                              - name: 'min'
                                type: NestedObject
                                description: |
                                  Lower bound of the range, inclusive. Type should be the same as max if used.
                                  The `min` block must only contain one argument. See the `bucketing_config` block description for more information about choosing a data type.
                                properties:
                                  - name: 'integerValue'
                                    type: String
                                    description: An integer value (int64 format)
                                  - name: 'floatValue'
                                    type: Double
                                    description: A float value.
                                  - name: 'stringValue'
                                    type: String
                                    description: A string value.
                                  - name: 'booleanValue'
                                    type: Boolean
                                    description: A boolean value.
                                  - name: 'timestampValue'
                                    type: String
                                    description: |
                                      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                  - name: 'timeValue'
                                    type: NestedObject
                                    description: Represents a time of day.
                                    properties:
                                      - name: 'hours'
                                        type: Integer
                                        description: |
                                          Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                      - name: 'minutes'
                                        type: Integer
                                        description:
                                          Minutes of hour of day. Must be from 0
                                          to 59.
                                      - name: 'seconds'
                                        type: Integer
                                        description:
                                          Seconds of minutes of the time. Must
                                          normally be from 0 to 59. An API may
                                          allow the value 60 if it allows
                                          leap-seconds.
                                      - name: 'nanos'
                                        type: Integer
                                        description:
                                          Fractions of seconds in nanoseconds.
                                          Must be from 0 to 999,999,999.
                                  - name: 'dateValue'
                                    type: NestedObject
                                    description:
                                      Represents a whole or partial calendar
                                      date.
                                    properties:
                                      - name: 'year'
                                        type: Integer
                                        description:
                                          Year of the date. Must be from 1 to
                                          9999, or 0 to specify a date without a
                                          year.
                                      - name: 'month'
                                        type: Integer
                                        description:
                                          Month of a year. Must be from 1 to 12,
                                          or 0 to specify a year without a month
                                          and day.
                                      - name: 'day'
                                        type: Integer
                                        description:
                                          Day of a month. Must be from 1 to 31
                                          and valid for the year and month, or 0
                                          to specify a year by itself or a year
                                          and month where the day isn't
                                          significant.
                                  - name: 'dayOfWeekValue'
                                    type: Enum
                                    description: Represents a day of the week.
                                    enum_values:
                                      - 'MONDAY'
                                      - 'TUESDAY'
                                      - 'WEDNESDAY'
                                      - 'THURSDAY'
                                      - 'FRIDAY'
                                      - 'SATURDAY'
                                      - 'SUNDAY'
                              - name: 'max'
                                type: NestedObject
                                description: |
                                  Upper bound of the range, exclusive; type must match min.
                                  The `max` block must only contain one argument. See the `bucketing_config` block description for more information about choosing a data type.
                                properties:
                                  - name: 'integerValue'
                                    type: String
                                    description: An integer value (int64 format)
                                  - name: 'floatValue'
                                    type: Double
                                    description: A float value.
                                  - name: 'stringValue'
                                    type: String
                                    description: A string value.
                                  - name: 'booleanValue'
                                    type: Boolean
                                    description: A boolean value.
                                  - name: 'timestampValue'
                                    type: String
                                    description: |
                                      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                  - name: 'timeValue'
                                    type: NestedObject
                                    description: Represents a time of day.
                                    properties:
                                      - name: 'hours'
                                        type: Integer
                                        description: |
                                          Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                      - name: 'minutes'
                                        type: Integer
                                        description:
                                          Minutes of hour of day. Must be from 0
                                          to 59.
                                      - name: 'seconds'
                                        type: Integer
                                        description:
                                          Seconds of minutes of the time. Must
                                          normally be from 0 to 59. An API may
                                          allow the value 60 if it allows
                                          leap-seconds.
                                      - name: 'nanos'
                                        type: Integer
                                        description:
                                          Fractions of seconds in nanoseconds.
                                          Must be from 0 to 999,999,999.
                                  - name: 'dateValue'
                                    type: NestedObject
                                    description:
                                      Represents a whole or partial calendar
                                      date.
                                    properties:
                                      - name: 'year'
                                        type: Integer
                                        description:
                                          Year of the date. Must be from 1 to
                                          9999, or 0 to specify a date without a
                                          year.
                                      - name: 'month'
                                        type: Integer
                                        description:
                                          Month of a year. Must be from 1 to 12,
                                          or 0 to specify a year without a month
                                          and day.
                                      - name: 'day'
                                        type: Integer
                                        description:
                                          Day of a month. Must be from 1 to 31
                                          and valid for the year and month, or 0
                                          to specify a year by itself or a year
                                          and month where the day isn't
                                          significant.
                                  - name: 'dayOfWeekValue'
                                    type: Enum
                                    description: Represents a day of the week.
                                    enum_values:
                                      - 'MONDAY'
                                      - 'TUESDAY'
                                      - 'WEDNESDAY'
                                      - 'THURSDAY'
                                      - 'FRIDAY'
                                      - 'SATURDAY'
                                      - 'SUNDAY'
                              - name: 'replacementValue'
                                type: NestedObject
                                description: |
                                  Replacement value for this bucket.
                                  The `replacement_value` block must only contain one argument.
                                required: true
                                properties:
                                  - name: 'integerValue'
                                    type: String
                                    description: An integer value (int64 format)
                                  - name: 'floatValue'
                                    type: Double
                                    description: A float value.
                                  - name: 'stringValue'
                                    type: String
                                    description: A string value.
                                  - name: 'booleanValue'
                                    type: Boolean
                                    description: A boolean value.
                                  - name: 'timestampValue'
                                    type: String
                                    description: |
                                      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                  - name: 'timeValue'
                                    type: NestedObject
                                    description: Represents a time of day.
                                    properties:
                                      - name: 'hours'
                                        type: Integer
                                        description: |
                                          Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                      - name: 'minutes'
                                        type: Integer
                                        description:
                                          Minutes of hour of day. Must be from 0
                                          to 59.
                                      - name: 'seconds'
                                        type: Integer
                                        description:
                                          Seconds of minutes of the time. Must
                                          normally be from 0 to 59. An API may
                                          allow the value 60 if it allows
                                          leap-seconds.
                                      - name: 'nanos'
                                        type: Integer
                                        description:
                                          Fractions of seconds in nanoseconds.
                                          Must be from 0 to 999,999,999.
                                  - name: 'dateValue'
                                    type: NestedObject
                                    description:
                                      Represents a whole or partial calendar
                                      date.
                                    properties:
                                      - name: 'year'
                                        type: Integer
                                        description:
                                          Year of the date. Must be from 1 to
                                          9999, or 0 to specify a date without a
                                          year.
                                      - name: 'month'
                                        type: Integer
                                        description:
                                          Month of a year. Must be from 1 to 12,
                                          or 0 to specify a year without a month
                                          and day.
                                      - name: 'day'
                                        type: Integer
                                        description:
                                          Day of a month. Must be from 1 to 31
                                          and valid for the year and month, or 0
                                          to specify a year by itself or a year
                                          and month where the day isn't
                                          significant.
                                  - name: 'dayOfWeekValue'
                                    type: Enum
                                    description: Represents a day of the week.
                                    enum_values:
                                      - 'MONDAY'
                                      - 'TUESDAY'
                                      - 'WEDNESDAY'
                                      - 'THURSDAY'
                                      - 'FRIDAY'
                                      - 'SATURDAY'
                                      - 'SUNDAY'
                    - name: 'timePartConfig'
                      type: NestedObject
                      description:
                        For use with Date, Timestamp, and TimeOfDay, extract or
                        preserve a portion of the value.
                      properties:
                        - name: 'partToExtract'
                          type: Enum
                          description: The part of the time to keep.
                          enum_values:
                            - 'YEAR'
                            - 'MONTH'
                            - 'DAY_OF_MONTH'
                            - 'DAY_OF_WEEK'
                            - 'WEEK_OF_YEAR'
                            - 'HOUR_OF_DAY'
                    - name: 'cryptoHashConfig'
                      type: NestedObject
                      description: |
                        Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes.
                        Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
                        Currently, only string and integer values can be hashed.
                        See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
                      properties:
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption function.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                    - name: 'dateShiftConfig'
                      type: NestedObject
                      description: |
                        Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more.
                      properties:
                        - name: 'upperBoundDays'
                          type: Integer
                          description: |
                            Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.

                            For example, 3 means shift date to at most 3 days into the future.
                          required: true
                        - name: 'lowerBoundDays'
                          type: Integer
                          description: |
                            For example, -5 means shift date to at most 5 days back in the past.
                          required: true
                        - name: 'context'
                          type: NestedObject
                          description: |
                            Points to the field that contains the context, for example, an entity id.
                            If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name describing the field.
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and cryptoKey. If set, must also set context. Can only be applied to table items.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                    - name: 'cryptoDeterministicConfig'
                      type: NestedObject
                      description: |
                        Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297).
                      properties:
                        - name: 'cryptoKey'
                          type: NestedObject
                          description: |
                            The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
                          properties:
                            - name: 'transient'
                              type: NestedObject
                              description: |
                                Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes.
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                  required: true
                            - name: 'unwrapped'
                              type: NestedObject
                              description: |
                                Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
                              properties:
                                - name: 'key'
                                  type: String
                                  description: |
                                    A 128/192/256 bit key.

                                    A base64-encoded string.
                                  required: true
                            - name: 'kmsWrapped'
                              type: NestedObject
                              description: |
                                KMS wrapped key.
                                Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
                                Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                              properties:
                                - name: 'wrappedKey'
                                  type: String
                                  description: |
                                    The wrapped data crypto key.

                                    A base64-encoded string.
                                  required: true
                                - name: 'cryptoKeyName'
                                  type: String
                                  description: |
                                    The resource name of the KMS CryptoKey to use for unwrapping.
                                  required: true
                        - name: 'surrogateInfoType'
                          type: NestedObject
                          description: |
                            The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}

                            For example, if the name of custom info type is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'

                            This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.

                            Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.

                            In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either

                            *   reverse a surrogate that does not correspond to an actual identifier
                            *   be unable to parse the surrogate and result in an error

                            Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE.
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
                            - name: 'version'
                              type: String
                              description: |
                                Optional version name for this InfoType.
                            - name: 'sensitivityScore'
                              type: NestedObject
                              description: |
                                Optional custom sensitivity for this InfoType. This only applies to data profiling.
                              properties:
                                - name: 'score'
                                  type: Enum
                                  description: |
                                    The sensitivity score applied to the resource.
                                  required: true
                                  enum_values:
                                    - 'SENSITIVITY_LOW'
                                    - 'SENSITIVITY_MODERATE'
                                    - 'SENSITIVITY_HIGH'
                        - name: 'context'
                          type: NestedObject
                          description: |
                            A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.

                            If the context is not set, plaintext would be used as is for encryption. If the context is set but:

                            1. there is no record present when transforming a given value or
                            2. the field is not present when transforming a given value,

                            plaintext would be used as is for encryption.

                            Note that case (1) is expected when an InfoTypeTransformation is applied to both structured and unstructured ContentItems.
                          properties:
                            - name: 'name'
                              type: String
                              description: |
                                Name describing the field.
                    - name: 'replaceDictionaryConfig'
                      type: NestedObject
                      description:
                        Replace with a value randomly drawn (with replacement)
                        from a dictionary.
                      properties:
                        - name: 'wordList'
                          type: NestedObject
                          description: |
                            A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries.
                          properties:
                            - name: 'words'
                              type: Array
                              description: |
                                Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.
                              required: true
                              item_type:
                                type: String
                # infoTypeTransformations inside the recordTransformations
                - name: 'infoTypeTransformations'
                  type: NestedObject
                  description: |
                    Treat the contents of the field as free text, and selectively transform content that matches an InfoType.
                    Only one of `primitive_transformation` or `info_type_transformations` must be specified.
                  properties:
                    - name: 'transformations'
                      type: Array
                      description: |
                        Transformation for each infoType. Cannot specify more than one for a given infoType.
                      required: true
                      item_type:
                        type: NestedObject
                        properties:
                          - name: 'infoTypes'
                            type: Array
                            description: |
                              InfoTypes to apply the transformation to. Leaving this empty will apply the transformation to apply to
                              all findings that correspond to infoTypes that were requested in InspectConfig.
                            item_type:
                              type: NestedObject
                              properties:
                                - name: 'name'
                                  type: String
                                  description: |
                                    Name of the information type.
                                  required: true
                                - name: 'version'
                                  type: String
                                  description: |
                                    Version name for this InfoType.
                                - name: 'sensitivityScore'
                                  type: NestedObject
                                  description: |
                                    Optional custom sensitivity for this InfoType. This only applies to data profiling.
                                  properties:
                                    - name: 'score'
                                      type: Enum
                                      description: |
                                        The sensitivity score applied to the resource.
                                      required: true
                                      enum_values:
                                        - 'SENSITIVITY_LOW'
                                        - 'SENSITIVITY_MODERATE'
                                        - 'SENSITIVITY_HIGH'
                          - name: 'primitiveTransformation'
                            type: NestedObject
                            description: |
                              Apply the transformation to the entire field.
                              The `primitive_transformation` block must only contain one argument, corresponding to the type of transformation.
                            required: true
                            properties:
                              - name: 'replaceConfig'
                                type: NestedObject
                                description: |
                                  Replace each input value with a given value.
                                properties:
                                  - name: 'newValue'
                                    type: NestedObject
                                    description: |
                                      Replace each input value with a given value.
                                      The `new_value` block must only contain one argument. For example when replacing the contents of a string-type field, only `string_value` should be set.
                                    required: true
                                    properties:
                                      - name: 'integerValue'
                                        type: String
                                        description:
                                          An integer value (int64 format)
                                      - name: 'floatValue'
                                        type: Double
                                        description: A float value.
                                      - name: 'stringValue'
                                        type: String
                                        description: A string value.
                                      - name: 'booleanValue'
                                        type: Boolean
                                        description: A boolean value.
                                      - name: 'timestampValue'
                                        type: String
                                        description: |
                                          A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
                                          Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                        validation:
                                          function: 'verify.ValidateRFC3339Date'
                                      - name: 'timeValue'
                                        type: NestedObject
                                        description: Represents a time of day.
                                        properties:
                                          - name: 'hours'
                                            type: Integer
                                            description: |
                                              Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                            validation:
                                              function: 'validation.IntBetween(0, 24)'
                                          - name: 'minutes'
                                            type: Integer
                                            description: |
                                              Minutes of hour of day. Must be from 0 to 59.
                                            validation:
                                              function: 'validation.IntBetween(0, 59)'
                                          - name: 'seconds'
                                            type: Integer
                                            description: |
                                              Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.
                                            validation:
                                              function: 'validation.IntBetween(0, 60)'
                                          - name: 'nanos'
                                            type: Integer
                                            description: |
                                              Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
                                            validation:
                                              function: 'validation.IntBetween(0, 999999999)'
                                      - name: 'dateValue'
                                        type: NestedObject
                                        description:
                                          Represents a whole or partial calendar
                                          date.
                                        properties:
                                          - name: 'year'
                                            type: Integer
                                            description: |
                                              Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
                                            validation:
                                              function: 'validation.IntBetween(1, 9999)'
                                          - name: 'month'
                                            type: Integer
                                            description: |
                                              Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
                                            validation:
                                              function: 'validation.IntBetween(0, 12)'
                                          - name: 'day'
                                            type: Integer
                                            description: |
                                              Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
                                            validation:
                                              function: 'validation.IntBetween(0, 31)'
                                      - name: 'dayOfWeekValue'
                                        type: Enum
                                        description:
                                          Represents a day of the week.
                                        enum_values:
                                          - 'MONDAY'
                                          - 'TUESDAY'
                                          - 'WEDNESDAY'
                                          - 'THURSDAY'
                                          - 'FRIDAY'
                                          - 'SATURDAY'
                                          - 'SUNDAY'
                              - name: 'redactConfig'
                                type: NestedObject
                                description: |
                                  Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
                                # The fields below are necessary to include the "redactConfig" transformation in the payload
                                # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                                send_empty_value: true
                                allow_empty_object: true
                                properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#redactconfig
                                  []
                              - name: 'characterMaskConfig'
                                type: NestedObject
                                description: |
                                  Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3).
                                properties:
                                  - name: 'maskingCharacter'
                                    type: String
                                    description: |
                                      Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string
                                      such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for
                                      strings, and 0 for digits.
                                  - name: 'numberToMask'
                                    type: Integer
                                    description: |
                                      Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.
                                      If number_to_mask is negative, this denotes inverse masking. Cloud DLP masks all but a number of characters. For example, suppose you have the following values:
                                      - `masking_character` is *
                                      - `number_to_mask` is -4
                                      - `reverse_order` is false
                                      - `characters_to_ignore` includes -
                                      - Input string is 1234-5678-9012-3456

                                      The resulting de-identified string is ****-****-****-3456. Cloud DLP masks all but the last four characters. If reverseOrder is true, all but the first four characters are masked as 1234-****-****-****.
                                  - name: 'reverseOrder'
                                    type: Boolean
                                    description: |
                                      Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is `false`, then the
                                      input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.
                                  - name: 'charactersToIgnore'
                                    type: Array
                                    description: |
                                      Characters to skip when doing de-identification of a value. These will be left alone and skipped.
                                    item_type:
                                      type: NestedObject
                                      properties:
                                        - name: 'charactersToSkip'
                                          type: String
                                          description: |
                                            Characters to not transform when masking. Only one of this or `common_characters_to_ignore` must be specified.
                                        - name: 'commonCharactersToIgnore'
                                          type: Enum
                                          description: |
                                            Common characters to not transform when masking. Useful to avoid removing punctuation. Only one of this or `characters_to_skip` must be specified.
                                          enum_values:
                                            - 'NUMERIC'
                                            - 'ALPHA_UPPER_CASE'
                                            - 'ALPHA_LOWER_CASE'
                                            - 'PUNCTUATION'
                                            - 'WHITESPACE'
                              - name: 'cryptoReplaceFfxFpeConfig'
                                type: NestedObject
                                description: |
                                  Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `content.reidentify` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.

                                  Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity.
                                properties:
                                  - name: 'cryptoKey'
                                    type: NestedObject
                                    description: |
                                      The key used by the encryption algorithm.
                                    required: true
                                    properties:
                                      - name: 'transient'
                                        type: NestedObject
                                        description: |
                                          Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, `unwrapped` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'name'
                                            type: String
                                            description: |
                                              Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                            required: true
                                      - name: 'unwrapped'
                                        type: NestedObject
                                        description: |
                                          Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, `transient` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'key'
                                            type: String
                                            description: |
                                              A 128/192/256 bit key.

                                              A base64-encoded string.
                                            required: true
                                            sensitive: true
                                      - name: 'kmsWrapped'
                                        type: NestedObject
                                        description: |
                                          KMS wrapped key.
                                          Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                          For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, `transient` or `unwrapped` must be specified.
                                          Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                                        properties:
                                          - name: 'wrappedKey'
                                            type: String
                                            description: |
                                              The wrapped data crypto key.

                                              A base64-encoded string.
                                            required: true
                                          - name: 'cryptoKeyName'
                                            type: String
                                            description: |
                                              The resource name of the KMS CryptoKey to use for unwrapping.
                                            required: true
                                  - name: 'context'
                                    type: NestedObject
                                    description: |
                                      The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.

                                      If the context is set but:

                                      1.  there is no record present when transforming a given value or
                                      2.  the field is not present when transforming a given value,

                                      a default tweak will be used.

                                      Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string.

                                      The tweak is constructed as a sequence of bytes in big endian byte order such that:

                                      *   a 64 bit integer is encoded followed by a single byte of value 1
                                      *   a string is encoded in UTF-8 format followed by a single byte of value 2
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: |
                                          Name describing the field.
                                        required: true
                                  - name: 'surrogateInfoType'
                                    type: NestedObject
                                    description: |
                                      The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\_type\_name(surrogate\_character\_count):surrogate

                                      For example, if the name of custom infoType is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'

                                      This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.

                                      In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: |
                                          Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
                                        required: true
                                      - name: 'version'
                                        type: String
                                        description: |
                                          Optional version name for this InfoType.
                                      - name: 'sensitivityScore'
                                        type: NestedObject
                                        description: |
                                          Optional custom sensitivity for this InfoType. This only applies to data profiling.
                                        properties:
                                          - name: 'score'
                                            type: Enum
                                            description: |
                                              The sensitivity score applied to the resource.
                                            required: true
                                            enum_values:
                                              - 'SENSITIVITY_LOW'
                                              - 'SENSITIVITY_MODERATE'
                                              - 'SENSITIVITY_HIGH'
                                  - name: 'commonAlphabet'
                                    type: Enum
                                    description: |
                                      Common alphabets. Only one of this, `custom_alphabet` or `radix` must be specified.
                                    enum_values:
 # [0-9] (radix of 10)
                                      - 'NUMERIC'
 # [0-9A-F] (radix of 16)
                                      - 'HEXADECIMAL'
 # [0-9A-Z] (radix of 36)
                                      - 'UPPER_CASE_ALPHA_NUMERIC'
 # [0-9A-Za-z] (radix of 62)
                                      - 'ALPHA_NUMERIC'
                                  - name: 'customAlphabet'
                                    type: String
                                    description: |
                                      This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:

                                      ``0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|:;"'<,>.?/``. Only one of this, `common_alphabet` or `radix` must be specified.
                                  - name: 'radix'
                                    type: Integer
                                    description: |
                                      The native way to select the alphabet. Must be in the range \[2, 95\]. Only one of this, `custom_alphabet` or `common_alphabet` must be specified.
                              - name: 'fixedSizeBucketingConfig'
                                type: NestedObject
                                description: |
                                  Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.

                                  The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".

                                  This can be used on data of type: double, long.

                                  If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.

                                  See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
                                properties:
                                  - name: 'lowerBound'
                                    type: NestedObject
                                    description: |
                                      Lower bound value of buckets.
                                      All values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".
                                      The `lower_bound` block must only contain one argument. See the `fixed_size_bucketing_config` block description for more information about choosing a data type.
                                    required: true
                                    properties:
                                      - name: 'integerValue'
                                        type: String
                                        description:
                                          An integer value (int64 format)
                                      - name: 'floatValue'
                                        type: Double
                                        description: A float value.
                                  - name: 'upperBound'
                                    type: NestedObject
                                    description: |
                                      Upper bound value of buckets.
                                      All values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".
                                      The `upper_bound` block must only contain one argument. See the `fixed_size_bucketing_config` block description for more information about choosing a data type.
                                    required: true
                                    properties:
                                      - name: 'integerValue'
                                        type: String
                                        description:
                                          An integer value (int64 format)
                                      - name: 'floatValue'
                                        type: Double
                                        description: A float value.
                                  - name: 'bucketSize'
                                    type: Double
                                    description: |
                                      Size of each bucket (except for minimum and maximum buckets).
                                      So if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.
                                      Precision up to 2 decimals works.
                                    required: true
                              - name: 'bucketingConfig'
                                type: NestedObject
                                description: |
                                  Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
                                  This can be used on data of type: number, long, string, timestamp.
                                  If the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
                                  See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
                                properties:
                                  - name: 'buckets'
                                    type: Array
                                    description: |
                                      Set of buckets. Ranges must be non-overlapping.
                                      Bucket is represented as a range, along with replacement values.
                                    required: true
                                    item_type:
                                      type: NestedObject
                                      properties:
                                        - name: 'min'
                                          type: NestedObject
                                          description: |
                                            Lower bound of the range, inclusive. Type should be the same as max if used.
                                            The `min` block must only contain one argument. See the `bucketing_config` block description for more information about choosing a data type.
                                          properties:
                                            - name: 'integerValue'
                                              type: String
                                              description:
                                                An integer value (int64 format)
                                            - name: 'floatValue'
                                              type: Double
                                              description: A float value.
                                            - name: 'stringValue'
                                              type: String
                                              description: A string value.
                                            - name: 'timestampValue'
                                              type: String
                                              description: |
                                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                            - name: 'timeValue'
                                              type: NestedObject
                                              description:
                                                Represents a time of day.
                                              properties:
                                                - name: 'hours'
                                                  type: Integer
                                                  description: |
                                                    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                                - name: 'minutes'
                                                  type: Integer
                                                  description:
                                                    Minutes of hour of day. Must
                                                    be from 0 to 59.
                                                - name: 'seconds'
                                                  type: Integer
                                                  description:
                                                    Seconds of minutes of the
                                                    time. Must normally be from
                                                    0 to 59. An API may allow
                                                    the value 60 if it allows
                                                    leap-seconds.
                                                - name: 'nanos'
                                                  type: Integer
                                                  description:
                                                    Fractions of seconds in
                                                    nanoseconds. Must be from 0
                                                    to 999,999,999.
                                            - name: 'dateValue'
                                              type: NestedObject
                                              description:
                                                Represents a whole or partial
                                                calendar date.
                                              properties:
                                                - name: 'year'
                                                  type: Integer
                                                  description:
                                                    Year of the date. Must be
                                                    from 1 to 9999, or 0 to
                                                    specify a date without a
                                                    year.
                                                - name: 'month'
                                                  type: Integer
                                                  description:
                                                    Month of a year. Must be
                                                    from 1 to 12, or 0 to
                                                    specify a year without a
                                                    month and day.
                                                - name: 'day'
                                                  type: Integer
                                                  description:
                                                    Day of a month. Must be from
                                                    1 to 31 and valid for the
                                                    year and month, or 0 to
                                                    specify a year by itself or
                                                    a year and month where the
                                                    day isn't significant.
                                            - name: 'dayOfWeekValue'
                                              type: Enum
                                              description:
                                                Represents a day of the week.
                                              enum_values:
                                                - 'MONDAY'
                                                - 'TUESDAY'
                                                - 'WEDNESDAY'
                                                - 'THURSDAY'
                                                - 'FRIDAY'
                                                - 'SATURDAY'
                                                - 'SUNDAY'
                                        - name: 'max'
                                          type: NestedObject
                                          description: |
                                            Upper bound of the range, exclusive; type must match min.
                                            The `max` block must only contain one argument. See the `bucketing_config` block description for more information about choosing a data type.
                                          properties:
                                            - name: 'integerValue'
                                              type: String
                                              description:
                                                An integer value (int64 format)
                                            - name: 'floatValue'
                                              type: Double
                                              description: A float value.
                                            - name: 'stringValue'
                                              type: String
                                              description: A string value.
                                            - name: 'timestampValue'
                                              type: String
                                              description: |
                                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                            - name: 'timeValue'
                                              type: NestedObject
                                              description:
                                                Represents a time of day.
                                              properties:
                                                - name: 'hours'
                                                  type: Integer
                                                  description: |
                                                    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                                - name: 'minutes'
                                                  type: Integer
                                                  description:
                                                    Minutes of hour of day. Must
                                                    be from 0 to 59.
                                                - name: 'seconds'
                                                  type: Integer
                                                  description:
                                                    Seconds of minutes of the
                                                    time. Must normally be from
                                                    0 to 59. An API may allow
                                                    the value 60 if it allows
                                                    leap-seconds.
                                                - name: 'nanos'
                                                  type: Integer
                                                  description:
                                                    Fractions of seconds in
                                                    nanoseconds. Must be from 0
                                                    to 999,999,999.
                                            - name: 'dateValue'
                                              type: NestedObject
                                              description:
                                                Represents a whole or partial
                                                calendar date.
                                              properties:
                                                - name: 'year'
                                                  type: Integer
                                                  description:
                                                    Year of the date. Must be
                                                    from 1 to 9999, or 0 to
                                                    specify a date without a
                                                    year.
                                                - name: 'month'
                                                  type: Integer
                                                  description:
                                                    Month of a year. Must be
                                                    from 1 to 12, or 0 to
                                                    specify a year without a
                                                    month and day.
                                                - name: 'day'
                                                  type: Integer
                                                  description:
                                                    Day of a month. Must be from
                                                    1 to 31 and valid for the
                                                    year and month, or 0 to
                                                    specify a year by itself or
                                                    a year and month where the
                                                    day isn't significant.
                                            - name: 'dayOfWeekValue'
                                              type: Enum
                                              description:
                                                Represents a day of the week.
                                              enum_values:
                                                - 'MONDAY'
                                                - 'TUESDAY'
                                                - 'WEDNESDAY'
                                                - 'THURSDAY'
                                                - 'FRIDAY'
                                                - 'SATURDAY'
                                                - 'SUNDAY'
                                        - name: 'replacementValue'
                                          type: NestedObject
                                          description: |
                                            Replacement value for this bucket.
                                            The `replacement_value` block must only contain one argument.
                                          required: true
                                          properties:
                                            - name: 'integerValue'
                                              type: String
                                              description:
                                                An integer value (int64 format)
                                            - name: 'floatValue'
                                              type: Double
                                              description: A float value.
                                            - name: 'stringValue'
                                              type: String
                                              description: A string value.
                                            - name: 'timestampValue'
                                              type: String
                                              description: |
                                                A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                            - name: 'timeValue'
                                              type: NestedObject
                                              description:
                                                Represents a time of day.
                                              properties:
                                                - name: 'hours'
                                                  type: Integer
                                                  description: |
                                                    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                                - name: 'minutes'
                                                  type: Integer
                                                  description:
                                                    Minutes of hour of day. Must
                                                    be from 0 to 59.
                                                - name: 'seconds'
                                                  type: Integer
                                                  description:
                                                    Seconds of minutes of the
                                                    time. Must normally be from
                                                    0 to 59. An API may allow
                                                    the value 60 if it allows
                                                    leap-seconds.
                                                - name: 'nanos'
                                                  type: Integer
                                                  description:
                                                    Fractions of seconds in
                                                    nanoseconds. Must be from 0
                                                    to 999,999,999.
                                            - name: 'dateValue'
                                              type: NestedObject
                                              description:
                                                Represents a whole or partial
                                                calendar date.
                                              properties:
                                                - name: 'year'
                                                  type: Integer
                                                  description:
                                                    Year of the date. Must be
                                                    from 1 to 9999, or 0 to
                                                    specify a date without a
                                                    year.
                                                - name: 'month'
                                                  type: Integer
                                                  description:
                                                    Month of a year. Must be
                                                    from 1 to 12, or 0 to
                                                    specify a year without a
                                                    month and day.
                                                - name: 'day'
                                                  type: Integer
                                                  description:
                                                    Day of a month. Must be from
                                                    1 to 31 and valid for the
                                                    year and month, or 0 to
                                                    specify a year by itself or
                                                    a year and month where the
                                                    day isn't significant.
                                            - name: 'dayOfWeekValue'
                                              type: Enum
                                              description:
                                                Represents a day of the week.
                                              enum_values:
                                                - 'MONDAY'
                                                - 'TUESDAY'
                                                - 'WEDNESDAY'
                                                - 'THURSDAY'
                                                - 'FRIDAY'
                                                - 'SATURDAY'
                                                - 'SUNDAY'
                              - name: 'replaceWithInfoTypeConfig'
                                type: NestedObject
                                description: |
                                  Replace each matching finding with the name of the info type.
                                # The fields below are necessary to include the "replaceWithInfoTypeConfig" transformation in the payload
                                # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                                send_empty_value: true
                                allow_empty_object: true
                                properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceWithInfoTypeConfig
                                  []
                              - name: 'timePartConfig'
                                type: NestedObject
                                description:
                                  For use with Date, Timestamp, and TimeOfDay,
                                  extract or preserve a portion of the value.
                                properties:
                                  - name: 'partToExtract'
                                    type: Enum
                                    description: The part of the time to keep.
                                    required: true
                                    enum_values:
 # [0-9999]
                                      - 'YEAR'
 # [1-12]
                                      - 'MONTH'
 # [1-31]
                                      - 'DAY_OF_MONTH'
 # [1-7]
                                      - 'DAY_OF_WEEK'
 # [1-53]
                                      - 'WEEK_OF_YEAR'
 # [0-23]
                                      - 'HOUR_OF_DAY'
                              - name: 'cryptoHashConfig'
                                type: NestedObject
                                description: |
                                  Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes.
                                  Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
                                  Currently, only string and integer values can be hashed.
                                  See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
                                properties:
                                  - name: 'cryptoKey'
                                    type: NestedObject
                                    description: |
                                      The key used by the encryption function.
                                    required: true
                                    properties:
                                      - name: 'transient'
                                        type: NestedObject
                                        description: |
                                          Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, `unwrapped` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'name'
                                            type: String
                                            description: |
                                              Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                            required: true
                                      - name: 'unwrapped'
                                        type: NestedObject
                                        description: |
                                          Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, `transient` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'key'
                                            type: String
                                            description: |
                                              A 128/192/256 bit key.

                                              A base64-encoded string.
                                            required: true
                                            sensitive: true
                                      - name: 'kmsWrapped'
                                        type: NestedObject
                                        description: |
                                          KMS wrapped key.
                                          Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                          For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, `transient` or `unwrapped` must be specified.
                                          Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                                        properties:
                                          - name: 'wrappedKey'
                                            type: String
                                            description: |
                                              The wrapped data crypto key.

                                              A base64-encoded string.
                                            required: true
                                          - name: 'cryptoKeyName'
                                            type: String
                                            description: |
                                              The resource name of the KMS CryptoKey to use for unwrapping.
                                            required: true
                              - name: 'dateShiftConfig'
                                type: NestedObject
                                description: |
                                  Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more.
                                properties:
                                  - name: 'upperBoundDays'
                                    type: Integer
                                    description: |
                                      Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.

                                      For example, 3 means shift date to at most 3 days into the future.
                                    required: true
                                  - name: 'lowerBoundDays'
                                    type: Integer
                                    description: |
                                      For example, -5 means shift date to at most 5 days back in the past.
                                    required: true
                                  - name: 'context'
                                    type: NestedObject
                                    description: |
                                      Points to the field that contains the context, for example, an entity id.
                                      If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: |
                                          Name describing the field.
                                        required: true
                                  - name: 'cryptoKey'
                                    type: NestedObject
                                    description: |
                                      Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and cryptoKey. If set, must also set context. Can only be applied to table items.
                                    properties:
                                      - name: 'transient'
                                        type: NestedObject
                                        description: |
                                          Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, `unwrapped` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'name'
                                            type: String
                                            description: |
                                              Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                            required: true
                                      - name: 'unwrapped'
                                        type: NestedObject
                                        description: |
                                          Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, `transient` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'key'
                                            type: String
                                            description: |
                                              A 128/192/256 bit key.

                                              A base64-encoded string.
                                            required: true
                                            sensitive: true
                                      - name: 'kmsWrapped'
                                        type: NestedObject
                                        description: |
                                          KMS wrapped key.
                                          Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                          For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, `transient` or `unwrapped` must be specified.
                                          Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                                        properties:
                                          - name: 'wrappedKey'
                                            type: String
                                            description: |
                                              The wrapped data crypto key.

                                              A base64-encoded string.
                                            required: true
                                          - name: 'cryptoKeyName'
                                            type: String
                                            description: |
                                              The resource name of the KMS CryptoKey to use for unwrapping.
                                            required: true
                              - name: 'cryptoDeterministicConfig'
                                type: NestedObject
                                description: |
                                  Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297).
                                properties:
                                  - name: 'cryptoKey'
                                    type: NestedObject
                                    description: |
                                      The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
                                    required: true
                                    properties:
                                      - name: 'transient'
                                        type: NestedObject
                                        description: |
                                          Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, `unwrapped` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'name'
                                            type: String
                                            description: |
                                              Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
                                            required: true
                                      - name: 'unwrapped'
                                        type: NestedObject
                                        description: |
                                          Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, `transient` or `kms_wrapped` must be specified.
                                        properties:
                                          - name: 'key'
                                            type: String
                                            description: |
                                              A 128/192/256 bit key.

                                              A base64-encoded string.
                                            required: true
                                            sensitive: true
                                      - name: 'kmsWrapped'
                                        type: NestedObject
                                        description: |
                                          KMS wrapped key.
                                          Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
                                          For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, `transient` or `unwrapped` must be specified.
                                          Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).
                                        properties:
                                          - name: 'wrappedKey'
                                            type: String
                                            description: |
                                              The wrapped data crypto key.

                                              A base64-encoded string.
                                            required: true
                                          - name: 'cryptoKeyName'
                                            type: String
                                            description: |
                                              The resource name of the KMS CryptoKey to use for unwrapping.
                                            required: true
                                  - name: 'surrogateInfoType'
                                    type: NestedObject
                                    description: |
                                      The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}

                                      For example, if the name of custom info type is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'

                                      This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.

                                      Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.

                                      In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either

                                      *   reverse a surrogate that does not correspond to an actual identifier
                                      *   be unable to parse the surrogate and result in an error

                                      Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE.
                                    required: true
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: |
                                          Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
                                        required: true
                                      - name: 'version'
                                        type: String
                                        description: |
                                          Optional version name for this InfoType.
                                      - name: 'sensitivityScore'
                                        type: NestedObject
                                        description: |
                                          Optional custom sensitivity for this InfoType. This only applies to data profiling.
                                        properties:
                                          - name: 'score'
                                            type: Enum
                                            description: |
                                              The sensitivity score applied to the resource.
                                            required: true
                                            enum_values:
                                              - 'SENSITIVITY_LOW'
                                              - 'SENSITIVITY_MODERATE'
                                              - 'SENSITIVITY_HIGH'
                                  - name: 'context'
                                    type: NestedObject
                                    description: |
                                      A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.

                                      If the context is not set, plaintext would be used as is for encryption. If the context is set but:

                                      1. there is no record present when transforming a given value or
                                      2. the field is not present when transforming a given value,

                                      plaintext would be used as is for encryption.

                                      Note that case (1) is expected when an InfoTypeTransformation is applied to both structured and unstructured ContentItems.
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: |
                                          Name describing the field.
                                        required: true
                              - name: 'replaceDictionaryConfig'
                                type: NestedObject
                                description:
                                  Replace with a value randomly drawn (with
                                  replacement) from a dictionary.
                                properties:
                                  - name: 'wordList'
                                    type: NestedObject
                                    description: |
                                      A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries.
                                    required: true
                                    properties:
                                      - name: 'words'
                                        type: Array
                                        description: |
                                          Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.
                                        required: true
                                        item_type:
                                          type: String
          - name: 'recordSuppressions'
            type: Array
            description:
              Configuration defining which records get suppressed entirely.
              Records that match any suppression rule are omitted from the
              output.
            at_least_one_of:
              - 'deidentify_config.0.record_transformations.0.field_transformations'
              - 'deidentify_config.0.record_transformations.0.record_suppressions'
            item_type:
              type: NestedObject
              properties:
                - name: 'condition'
                  type: NestedObject
                  description:
                    A condition that when it evaluates to true will result in
                    the record being evaluated to be suppressed from the
                    transformed content.
                  properties:
                    - name: 'expressions'
                      type: NestedObject
                      description:
                        An expression, consisting of an operator and conditions.
                      properties:
                        - name: 'logicalOperator'
                          type: Enum
                          description:
                            The operator to apply to the result of conditions.
                            Default and currently only supported value is AND.
                          default_value: "AND"
                          enum_values:
                            - 'AND'
                        - name: 'conditions'
                          type: NestedObject
                          description: Conditions to apply to the expression.
                          properties:
                            - name: 'conditions'
                              type: Array
                              description: A collection of conditions.
                              item_type:
                                type: NestedObject
                                properties:
                                  - name: 'field'
                                    type: NestedObject
                                    description:
                                      Field within the record this condition is
                                      evaluated against.
                                    required: true
                                    properties:
                                      - name: 'name'
                                        type: String
                                        description: Name describing the field.
                                  - name: 'operator'
                                    type: Enum
                                    description:
                                      Operator used to compare the field or
                                      infoType to the value.
                                    required: true
                                    enum_values:
                                      - 'EQUAL_TO'
                                      - 'NOT_EQUAL_TO'
                                      - 'GREATER_THAN'
                                      - 'LESS_THAN'
                                      - 'GREATER_THAN_OR_EQUALS'
                                      - 'LESS_THAN_OR_EQUALS'
                                      - 'EXISTS'
                                  - name: 'value'
                                    type: NestedObject
                                    description:
                                      Value to compare against. [Mandatory,
                                      except for EXISTS tests.]
                                    properties:
                                      - name: 'integerValue'
                                        type: String
                                        description:
                                          An integer value (int64 format)
                                      - name: 'floatValue'
                                        type: Double
                                        description: A float value.
                                      - name: 'stringValue'
                                        type: String
                                        description: A string value.
                                      - name: 'booleanValue'
                                        type: Boolean
                                        description: A boolean value.
                                      - name: 'timestampValue'
                                        type: String
                                        description: |
                                          A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
                                      - name: 'timeValue'
                                        type: NestedObject
                                        description: Represents a time of day.
                                        properties:
                                          - name: 'hours'
                                            type: Integer
                                            description: |
                                              Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                          - name: 'minutes'
                                            type: Integer
                                            description:
                                              Minutes of hour of day. Must be
                                              from 0 to 59.
                                          - name: 'seconds'
                                            type: Integer
                                            description:
                                              Seconds of minutes of the time.
                                              Must normally be from 0 to 59. An
                                              API may allow the value 60 if it
                                              allows leap-seconds.
                                          - name: 'nanos'
                                            type: Integer
                                            description:
                                              Fractions of seconds in
                                              nanoseconds. Must be from 0 to
                                              999,999,999.
                                      - name: 'dateValue'
                                        type: NestedObject
                                        description:
                                          Represents a whole or partial calendar
                                          date.
                                        properties:
                                          - name: 'year'
                                            type: Integer
                                            description:
                                              Year of the date. Must be from 1
                                              to 9999, or 0 to specify a date
                                              without a year.
                                          - name: 'month'
                                            type: Integer
                                            description:
                                              Month of a year. Must be from 1 to
                                              12, or 0 to specify a year without
                                              a month and day.
                                          - name: 'day'
                                            type: Integer
                                            description:
                                              Day of a month. Must be from 1 to
                                              31 and valid for the year and
                                              month, or 0 to specify a year by
                                              itself or a year and month where
                                              the day isn't significant.
                                      - name: 'dayOfWeekValue'
                                        type: Enum
                                        description:
                                          Represents a day of the week.
                                        enum_values:
                                          - 'MONDAY'
                                          - 'TUESDAY'
                                          - 'WEDNESDAY'
                                          - 'THURSDAY'
                                          - 'FRIDAY'
                                          - 'SATURDAY'
                                          - 'SUNDAY'
