# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'JobTrigger'
description: |
  A job trigger configuration.
references:
  guides:
    'Official Documentation': 'https://cloud.google.com/dlp/docs/creating-job-triggers'
  api: 'https://cloud.google.com/dlp/docs/reference/rest/v2/projects.jobTriggers'
docs:
id_format: '{{parent}}/jobTriggers/{{name}}'
base_url: '{{parent}}/jobTriggers'
self_link: '{{parent}}/jobTriggers/{{name}}'
create_url: '{{parent}}/jobTriggers'
update_verb: 'PATCH'
update_mask: true
timeouts:
  insert_minutes: 20
  update_minutes: 20
  delete_minutes: 20
custom_code:
  encoder: 'templates/terraform/encoders/dlp_job_trigger.go.tmpl'
  update_encoder: 'templates/terraform/encoders/wrap_object.go.tmpl'
  decoder: 'templates/terraform/decoders/dlp_job_trigger.go.tmpl'
  custom_import: 'templates/terraform/custom_import/dlp_import.go.tmpl'
# Skip sweeper due to non-standard URL
exclude_sweeper: true
examples:
  - name: 'dlp_job_trigger_basic'
    primary_resource_id: 'basic'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_bigquery_row_limit'
    primary_resource_id: 'bigquery_row_limit'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_bigquery_row_limit_percentage'
    primary_resource_id: 'bigquery_row_limit_percentage'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_data_catalog_output'
    primary_resource_id: 'data_catalog_output'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
    exclude_docs: true
  - name: 'dlp_job_trigger_scc_output'
    primary_resource_id: 'scc_output'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
    exclude_docs: true
  - name: 'dlp_job_trigger_job_notification_emails'
    primary_resource_id: 'job_notification_emails'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_deidentify'
    primary_resource_id: 'deidentify'
    vars:
      name: 'tf_test'
    test_env_vars:
      project: 'PROJECT_NAME'
    test_vars_overrides:
      'name': '"tf_test_" + acctest.RandString(t, 10)'
  - name: 'dlp_job_trigger_hybrid'
    primary_resource_id: 'hybrid_trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_inspect'
    primary_resource_id: 'inspect'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_publish_to_stackdriver'
    primary_resource_id: 'publish_to_stackdriver'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_with_id'
    primary_resource_id: 'with_trigger_id'
    vars:
      name: 'id-'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_multiple_actions'
    primary_resource_id: 'basic'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_cloud_storage_optional_timespan_autopopulation'
    primary_resource_id: 'basic'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
  - name: 'dlp_job_trigger_timespan_config_big_query'
    primary_resource_id: 'timespan_config_big_query'
    vars:
      trigger: 'trigger'
    test_env_vars:
      project: 'PROJECT_NAME'
parameters:
  - name: 'parent'
    type: String
    description: |
      The parent of the trigger, either in the format `projects/{{project}}`
      or `projects/{{project}}/locations/{{location}}`
    url_param_only: true
    required: true
    immutable: true
properties:
  - name: 'name'
    type: String
    description: |
      The resource name of the job trigger. Set by the server.
    output: true
    custom_flatten: 'templates/terraform/custom_flatten/name_from_self_link.tmpl'
  - name: 'createTime'
    type: String
    description: |
      The creation timestamp of an inspectTemplate. Set by the server.
    output: true
  - name: 'updateTime'
    type: String
    description: |
      The last update timestamp of an inspectTemplate. Set by the server.
    output: true
  - name: 'description'
    type: String
    description: |
      A description of the job trigger.
  - name: 'displayName'
    type: String
    description: |
      User set display name of the job trigger.
  - name: 'triggerId'
    type: String
    description: |
      The trigger id can contain uppercase and lowercase letters, numbers, and hyphens;
      that is, it must match the regular expression: [a-zA-Z\d-_]+.
      The maximum length is 100 characters. Can be empty to allow the system to generate one.
    url_param_only: true
    immutable: true
    default_from_api: true
  - name: 'lastRunTime'
    type: Time
    description: The timestamp of the last time this trigger executed.
    output: true
  - name: 'status'
    type: Enum
    description: |
      Whether the trigger is currently active.
    default_value: "HEALTHY"
    enum_values:
      - 'PAUSED'
      - 'HEALTHY'
      - 'CANCELLED'
  - name: 'triggers'
    type: Array
    description: |
      What event needs to occur for a new job to be started.
    required: true
    item_type:
      type: NestedObject
      properties:
        - name: 'schedule'
          type: NestedObject
          description: |
            Schedule for triggered jobs
          properties:
            - name: 'recurrencePeriodDuration'
              type: String
              description: |
                With this option a job is started a regular periodic basis. For example: every day (86400 seconds).

                A scheduled start time will be skipped if the previous execution has not ended when its scheduled time occurs.

                This value must be set to a time duration greater than or equal to 1 day and can be no longer than 60 days.

                A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
        - name: 'manual'
          type: NestedObject
          description: |
            For use with hybrid jobs. Jobs must be manually created and finished.
          send_empty_value: true
          allow_empty_object: true
          properties:
            []
  - name: 'inspectJob'
    type: NestedObject
    description: Controls what and how to inspect for findings.
    properties:
      - name: 'inspectTemplateName'
        type: String
        description: The name of the template to run when this job is triggered.
      - name: 'inspectConfig'
        type: NestedObject
        description: The core content of the template.
        properties:
          - name: 'excludeInfoTypes'
            type: Boolean
            description: When true, excludes type information of the findings.
          - name: 'includeQuote'
            type: Boolean
            description:
              When true, a contextual quote from the data that triggered a
              finding is included in the response.
          - name: 'minLikelihood'
            type: Enum
            description: |
              Only returns findings equal or above this threshold. See https://cloud.google.com/dlp/docs/likelihood for more info
            default_value: "POSSIBLE"
            enum_values:
              - 'VERY_UNLIKELY'
              - 'UNLIKELY'
              - 'POSSIBLE'
              - 'LIKELY'
              - 'VERY_LIKELY'
          - name: 'limits'
            type: NestedObject
            description:
              Configuration to control the number of findings returned.
            properties:
              - name: 'maxFindingsPerItem'
                type: Integer
                description:
                  Max number of findings that will be returned for each item
                  scanned. The maximum returned is 2000.
                at_least_one_of:
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_item'
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_request'
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_info_type'
              - name: 'maxFindingsPerRequest'
                type: Integer
                description:
                  Max number of findings that will be returned per request/job.
                  The maximum returned is 2000.
                at_least_one_of:
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_item'
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_request'
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_info_type'
              - name: 'maxFindingsPerInfoType'
                type: Array
                description: |
                  Configuration of findings limit given for specified infoTypes.
                at_least_one_of:
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_item'
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_request'
                  - 'inspect_job.0.inspect_config.0.limits.0.max_findings_per_info_type'
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'infoType'
                      type: NestedObject
                      description: |
                        Type of information the findings limit applies to. Only one limit per infoType should be provided. If InfoTypeLimit does
                        not have an infoType, the DLP API applies the limit against all infoTypes that are found but not
                        specified in another InfoTypeLimit.
                      properties:
                        - name: 'name'
                          type: String
                          description: |
                            Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
                            at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
                          required: true
                        - name: 'version'
                          type: String
                          description: |
                            Version of the information type to use. By default, the version is set to stable
                        - name: 'sensitivityScore'
                          type: NestedObject
                          description: |
                            Optional custom sensitivity for this InfoType. This only applies to data profiling.
                          properties:
                            - name: 'score'
                              type: Enum
                              description: |
                                The sensitivity score applied to the resource.
                              required: true
                              enum_values:
                                - 'SENSITIVITY_LOW'
                                - 'SENSITIVITY_MODERATE'
                                - 'SENSITIVITY_HIGH'
                    - name: 'maxFindings'
                      type: Integer
                      description: Max findings limit for the given infoType.
          - name: 'infoTypes'
            type: Array
            description: |
              Restricts what infoTypes to look for. The values must correspond to InfoType values returned by infoTypes.list
              or listed at https://cloud.google.com/dlp/docs/infotypes-reference.

              When no InfoTypes or CustomInfoTypes are specified in a request, the system may automatically choose what detectors to run.
              By default this may be all types, but may change over time as detectors are updated.
            item_type:
              type: NestedObject
              properties:
                - name: 'name'
                  type: String
                  description: |
                    Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
                    at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
                  required: true
                - name: 'version'
                  type: String
                  description: |
                    Version of the information type to use. By default, the version is set to stable
                - name: 'sensitivityScore'
                  type: NestedObject
                  description: |
                    Optional custom sensitivity for this InfoType. This only applies to data profiling.
                  properties:
                    - name: 'score'
                      type: Enum
                      description: |
                        The sensitivity score applied to the resource.
                      required: true
                      enum_values:
                        - 'SENSITIVITY_LOW'
                        - 'SENSITIVITY_MODERATE'
                        - 'SENSITIVITY_HIGH'
          - name: 'ruleSet'
            type: Array
            description: |
              Set of rules to apply to the findings for this InspectConfig. Exclusion rules, contained in the set are executed in the end,
              other rules are executed in the order they are specified for each info type.
            item_type:
              type: NestedObject
              properties:
                - name: 'infoTypes'
                  type: Array
                  description: |
                    List of infoTypes this rule set is applied to.
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'name'
                        type: String
                        description: |
                          Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
                          at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
                        required: true
                      - name: 'version'
                        type: String
                        description: |
                          Version of the information type to use. By default, the version is set to stable.
                      - name: 'sensitivityScore'
                        type: NestedObject
                        description: |
                          Optional custom sensitivity for this InfoType. This only applies to data profiling.
                        properties:
                          - name: 'score'
                            type: Enum
                            description: |
                              The sensitivity score applied to the resource.
                            required: true
                            enum_values:
                              - 'SENSITIVITY_LOW'
                              - 'SENSITIVITY_MODERATE'
                              - 'SENSITIVITY_HIGH'
                - name: 'rules'
                  type: Array
                  description: |
                    Set of rules to be applied to infoTypes. The rules are applied in order.
                  required: true
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'hotwordRule'
                        type: NestedObject
                        description: Hotword-based detection rule.
                        properties:
                          - name: 'hotwordRegex'
                            type: NestedObject
                            description:
                              Regular expression pattern defining what qualifies
                              as a hotword.
                            properties:
                              - name: 'pattern'
                                type: String
                                description: |
                                  Pattern defining the regular expression. Its syntax
                                  (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.
                              - name: 'groupIndexes'
                                type: Array
                                description: |
                                  The index of the submatch to extract as findings. When not specified,
                                  the entire match is returned. No more than 3 may be included.
                                item_type:
                                  type: Integer
                          - name: 'proximity'
                            type: NestedObject
                            description: |
                              Proximity of the finding within which the entire hotword must reside. The total length of the window cannot
                              exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be
                              used to match substrings of the finding itself. For example, the certainty of a phone number regex
                              `(\d{3}) \d{3}-\d{4}` could be adjusted upwards if the area code is known to be the local area code of a company
                              office using the hotword regex `(xxx)`, where `xxx` is the area code in question.
                            properties:
                              - name: 'windowBefore'
                                type: Integer
                                description: |
                                  Number of characters before the finding to consider. Either this or window_after must be specified
                              - name: 'windowAfter'
                                type: Integer
                                description: |
                                  Number of characters after the finding to consider. Either this or window_before must be specified
                          - name: 'likelihoodAdjustment'
                            type: NestedObject
                            description: |
                              Likelihood adjustment to apply to all matching findings.
                            properties:
                              - name: 'fixedLikelihood'
                                type: Enum
                                description: |
                                  Set the likelihood of a finding to a fixed value. Either this or relative_likelihood can be set.
                                enum_values:
                                  - 'VERY_UNLIKELY'
                                  - 'UNLIKELY'
                                  - 'POSSIBLE'
                                  - 'LIKELY'
                                  - 'VERY_LIKELY'
                              - name: 'relativeLikelihood'
                                type: Integer
                                description: |
                                  Increase or decrease the likelihood by the specified number of levels. For example,
                                  if a finding would be POSSIBLE without the detection rule and relativeLikelihood is 1,
                                  then it is upgraded to LIKELY, while a value of -1 would downgrade it to UNLIKELY.
                                  Likelihood may never drop below VERY_UNLIKELY or exceed VERY_LIKELY, so applying an
                                  adjustment of 1 followed by an adjustment of -1 when base likelihood is VERY_LIKELY
                                  will result in a final likelihood of LIKELY. Either this or fixed_likelihood can be set.
                      - name: 'exclusionRule'
                        type: NestedObject
                        description:
                          The rule that specifies conditions when findings of
                          infoTypes specified in InspectionRuleSet are removed
                          from results.
                        properties:
                          - name: 'matchingType'
                            type: Enum
                            description: |
                              How the rule is applied. See the documentation for more information: https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#MatchingType
                            required: true
                            enum_values:
                              - 'MATCHING_TYPE_FULL_MATCH'
                              - 'MATCHING_TYPE_PARTIAL_MATCH'
                              - 'MATCHING_TYPE_INVERSE_MATCH'
                          - name: 'dictionary'
                            type: NestedObject
                            description: Dictionary which defines the rule.
                            properties:
                              - name: 'wordList'
                                type: NestedObject
                                description:
                                  List of words or phrases to search for.
                                properties:
                                  - name: 'words'
                                    type: Array
                                    description: |
                                      Words or phrases defining the dictionary. The dictionary must contain at least one
                                      phrase and every phrase must contain at least 2 characters that are letters or digits.
                                    required: true
                                    item_type:
                                      type: String
                              - name: 'cloudStoragePath'
                                type: NestedObject
                                description:
                                  Newline-delimited file of words in Cloud
                                  Storage. Only a single file is accepted.
                                properties:
                                  - name: 'path'
                                    type: String
                                    description: |
                                      A url representing a file or path (no wildcards) in Cloud Storage. Example: `gs://[BUCKET_NAME]/dictionary.txt`
                                    required: true
                          - name: 'regex'
                            type: NestedObject
                            description:
                              Regular expression which defines the rule.
                            properties:
                              - name: 'pattern'
                                type: String
                                description: |
                                  Pattern defining the regular expression.
                                  Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.
                                required: true
                              - name: 'groupIndexes'
                                type: Array
                                description: |
                                  The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.
                                item_type:
                                  type: Integer
                          - name: 'excludeInfoTypes'
                            type: NestedObject
                            description:
                              Set of infoTypes for which findings would affect
                              this rule.
                            properties:
                              - name: 'infoTypes'
                                type: Array
                                description: |
                                  If a finding is matched by any of the infoType detectors listed here, the finding will be excluded from the scan results.
                                required: true
                                item_type:
                                  type: NestedObject
                                  properties:
                                    - name: 'name'
                                      type: String
                                      description: |
                                        Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
                                        at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
                                      required: true
                                    - name: 'version'
                                      type: String
                                      description: |
                                        Version of the information type to use. By default, the version is set to stable.
                                    - name: 'sensitivityScore'
                                      type: NestedObject
                                      description: |
                                        Optional custom sensitivity for this InfoType. This only applies to data profiling.
                                      properties:
                                        - name: 'score'
                                          type: Enum
                                          description: |
                                            The sensitivity score applied to the resource.
                                          required: true
                                          enum_values:
                                            - 'SENSITIVITY_LOW'
                                            - 'SENSITIVITY_MODERATE'
                                            - 'SENSITIVITY_HIGH'
                          - name: 'excludeByHotword'
                            type: NestedObject
                            description:
                              Drop if the hotword rule is contained in the
                              proximate context.
                            properties:
                              - name: 'hotwordRegex'
                                type: NestedObject
                                description:
                                  Regular expression pattern defining what
                                  qualifies as a hotword.
                                properties:
                                  - name: 'pattern'
                                    type: String
                                    description: |
                                      Pattern defining the regular expression. Its syntax
                                      (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.
                                  - name: 'groupIndexes'
                                    type: Array
                                    description: |
                                      The index of the submatch to extract as findings. When not specified,
                                      the entire match is returned. No more than 3 may be included.
                                    item_type:
                                      type: Integer
                              - name: 'proximity'
                                type: NestedObject
                                description: |
                                  Proximity of the finding within which the entire hotword must reside. The total length of the window cannot
                                  exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be
                                  used to match substrings of the finding itself. For example, the certainty of a phone number regex
                                  `(\d{3}) \d{3}-\d{4}` could be adjusted upwards if the area code is known to be the local area code of a company
                                  office using the hotword regex `(xxx)`, where `xxx` is the area code in question.
                                properties:
                                  - name: 'windowBefore'
                                    type: Integer
                                    description: |
                                      Number of characters before the finding to consider. Either this or window_after must be specified
                                  - name: 'windowAfter'
                                    type: Integer
                                    description: |
                                      Number of characters after the finding to consider. Either this or window_before must be specified
          - name: 'customInfoTypes'
            type: Array
            description: |
              Custom info types to be used. See https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
            item_type:
              type: NestedObject
              properties:
                - name: 'infoType'
                  type: NestedObject
                  description: |
                    CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing
                    infoTypes and that infoType is specified in `info_types` field. Specifying the latter adds findings to the
                    one detected by the system. If built-in info type is not specified in `info_types` list then the name is
                    treated as a custom info type.
                  required: true
                  properties:
                    - name: 'name'
                      type: String
                      description: |
                        Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names
                        listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
                      required: true
                    - name: 'version'
                      type: String
                      description: |
                        Version of the information type to use. By default, the version is set to stable.
                    - name: 'sensitivityScore'
                      type: NestedObject
                      description: |
                        Optional custom sensitivity for this InfoType. This only applies to data profiling.
                      properties:
                        - name: 'score'
                          type: Enum
                          description: |
                            The sensitivity score applied to the resource.
                          required: true
                          enum_values:
                            - 'SENSITIVITY_LOW'
                            - 'SENSITIVITY_MODERATE'
                            - 'SENSITIVITY_HIGH'
                - name: 'likelihood'
                  type: Enum
                  description: |
                    Likelihood to return for this CustomInfoType. This base value can be altered by a detection rule if the finding meets the criteria
                    specified by the rule.
                  default_value: "VERY_LIKELY"
                  enum_values:
                    - 'VERY_UNLIKELY'
                    - 'UNLIKELY'
                    - 'POSSIBLE'
                    - 'LIKELY'
                    - 'VERY_LIKELY'
                - name: 'exclusionType'
                  type: Enum
                  description: |
                    If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding to be returned. It still can be used for rules matching.
                  enum_values:
                    - 'EXCLUSION_TYPE_EXCLUDE'
                - name: 'sensitivityScore'
                  type: NestedObject
                  description: |
                    Optional custom sensitivity for this InfoType. This only applies to data profiling.
                  properties:
                    - name: 'score'
                      type: Enum
                      description: |
                        The sensitivity score applied to the resource.
                      required: true
                      enum_values:
                        - 'SENSITIVITY_LOW'
                        - 'SENSITIVITY_MODERATE'
                        - 'SENSITIVITY_HIGH'
                - name: 'regex'
                  type: NestedObject
                  description: Regular expression which defines the rule.
                  properties:
                    - name: 'pattern'
                      type: String
                      description: |
                        Pattern defining the regular expression.
                        Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.
                      required: true
                    - name: 'groupIndexes'
                      type: Array
                      description: |
                        The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.
                      item_type:
                        type: Integer
                - name: 'dictionary'
                  type: NestedObject
                  description: Dictionary which defines the rule.
                  properties:
                    - name: 'wordList'
                      type: NestedObject
                      description: List of words or phrases to search for.
                      properties:
                        - name: 'words'
                          type: Array
                          description: |
                            Words or phrases defining the dictionary. The dictionary must contain at least one
                            phrase and every phrase must contain at least 2 characters that are letters or digits.
                          required: true
                          item_type:
                            type: String
                    - name: 'cloudStoragePath'
                      type: NestedObject
                      description:
                        Newline-delimited file of words in Cloud Storage. Only a
                        single file is accepted.
                      properties:
                        - name: 'path'
                          type: String
                          description: |
                            A url representing a file or path (no wildcards) in Cloud Storage. Example: `gs://[BUCKET_NAME]/dictionary.txt`
                          required: true
                - name: 'storedType'
                  type: NestedObject
                  description:
                    A reference to a StoredInfoType to use with scanning.
                  properties:
                    - name: 'name'
                      type: String
                      description: |
                        Resource name of the requested StoredInfoType, for example `organizations/433245324/storedInfoTypes/432452342`
                        or `projects/project-id/storedInfoTypes/432452342`.
                      required: true
                    - name: 'createTime'
                      type: String
                      description: |
                        The creation timestamp of an inspectTemplate. Set by the server.
                      output: true
                - name: 'surrogateType'
                  type: NestedObject
                  description: |
                    Message for detecting output from deidentification transformations that support reversing.
                  # The fields below are necessary to include the "surrogateType" in the payload
                  send_empty_value: true
                  allow_empty_object: true
                  properties:
 # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#SurrogateType
                    []
      - name: 'storageConfig'
        type: NestedObject
        description: Information on where to inspect
        required: true
        properties:
          - name: 'timespanConfig'
            type: NestedObject
            description: Configuration of the timespan of the items to include in scanning
            properties:
              - name: 'startTime'
                type: String
                description: Exclude files, tables, or rows older than this value. If not set, no lower time limit is applied.
                conflicts:
                  - inspect_job.0.storage_config.0.timespan_config.0.enable_auto_population_of_timespan_config
                at_least_one_of:
                  - 'inspect_job.0.storage_config.0.timespan_config.0.start_time'
                  - 'inspect_job.0.storage_config.0.timespan_config.0.end_time'
                  - 'inspect_job.0.storage_config.0.timespan_config.0.enable_auto_population_of_timespan_config'
              - name: 'endTime'
                type: String
                description: Exclude files, tables, or rows newer than this value. If not set, no upper time limit is applied.
                at_least_one_of:
                  - 'inspect_job.0.storage_config.0.timespan_config.0.start_time'
                  - 'inspect_job.0.storage_config.0.timespan_config.0.end_time'
                  - 'inspect_job.0.storage_config.0.timespan_config.0.enable_auto_population_of_timespan_config'
              - name: 'enableAutoPopulationOfTimespanConfig'
                type: Boolean
                description: |
                  When the job is started by a JobTrigger we will automatically figure out a valid startTime to avoid
                  scanning files that have not been modified since the last time the JobTrigger executed. This will
                  be based on the time of the execution of the last run of the JobTrigger or the timespan endTime
                  used in the last run of the JobTrigger.
                conflicts:
                  - inspect_job.0.storage_config.0.timespan_config.0.start_time
                at_least_one_of:
                  - 'inspect_job.0.storage_config.0.timespan_config.0.start_time'
                  - 'inspect_job.0.storage_config.0.timespan_config.0.end_time'
                  - 'inspect_job.0.storage_config.0.timespan_config.0.enable_auto_population_of_timespan_config'
              - name: 'timestampField'
                type: NestedObject
                description: Specification of the field containing the timestamp of scanned items.
                properties:
                  - name: 'name'
                    type: String
                    description: |
                      Specification of the field containing the timestamp of scanned items. Used for data sources like Datastore and BigQuery.

                      For BigQuery: Required to filter out rows based on the given start and end times. If not specified and the table was
                      modified between the given start and end times, the entire table will be scanned. The valid data types of the timestamp
                      field are: INTEGER, DATE, TIMESTAMP, or DATETIME BigQuery column.

                      For Datastore. Valid data types of the timestamp field are: TIMESTAMP. Datastore entity will be scanned if the
                      timestamp property does not exist or its value is empty or invalid.
                    required: true
          - name: 'datastoreOptions'
            type: NestedObject
            description:
              Options defining a data set within Google Cloud Datastore.
            properties:
              - name: 'partitionId'
                type: NestedObject
                description: |
                  Datastore partition ID. A partition ID identifies a grouping of entities. The grouping
                  is always by project and namespace, however the namespace ID may be empty.
                required: true
                properties:
                  - name: 'projectId'
                    type: String
                    description:
                      The ID of the project to which the entities belong.
                    required: true
                  - name: 'namespaceId'
                    type: String
                    description:
                      If not empty, the ID of the namespace to which the
                      entities belong.
              - name: 'kind'
                type: NestedObject
                description: |
                  A representation of a Datastore kind.
                required: true
                properties:
                  - name: 'name'
                    type: String
                    description: The name of the Datastore kind.
                    required: true
          - name: 'cloudStorageOptions'
            type: NestedObject
            description:
              Options defining a file or a set of files within a Google Cloud
              Storage bucket.
            properties:
              - name: 'fileSet'
                type: NestedObject
                description: |
                  Set of files to scan.
                required: true
                properties:
                  - name: 'url'
                    type: String
                    description: |
                      The Cloud Storage url of the file(s) to scan, in the format `gs://<bucket>/<path>`. Trailing wildcard
                      in the path is allowed.

                      If the url ends in a trailing slash, the bucket or directory represented by the url will be scanned
                      non-recursively (content in sub-directories will not be scanned). This means that `gs://mybucket/` is
                      equivalent to `gs://mybucket/*`, and `gs://mybucket/directory/` is equivalent to `gs://mybucket/directory/*`.
                    exactly_one_of:
                      - 'inspect_job.0.storage_config.0.cloud_storage_options.0.file_set.0.url'
                      - 'inspect_job.0.storage_config.0.cloud_storage_options.0.file_set.0.regex_file_set'
                  - name: 'regexFileSet'
                    type: NestedObject
                    description: |
                      The regex-filtered set of files to scan.
                    exactly_one_of:
                      - 'inspect_job.0.storage_config.0.cloud_storage_options.0.file_set.0.url'
                      - 'inspect_job.0.storage_config.0.cloud_storage_options.0.file_set.0.regex_file_set'
                    properties:
                      - name: 'bucketName'
                        type: String
                        description: The name of a Cloud Storage bucket.
                        required: true
                      - name: 'includeRegex'
                        type: Array
                        description: |
                          A list of regular expressions matching file paths to include. All files in the bucket
                          that match at least one of these regular expressions will be included in the set of files,
                          except for those that also match an item in excludeRegex. Leaving this field empty will
                          match all files by default (this is equivalent to including .* in the list)
                        item_type:
                          type: String
                      - name: 'excludeRegex'
                        type: Array
                        description: |
                          A list of regular expressions matching file paths to exclude. All files in the bucket that match at
                          least one of these regular expressions will be excluded from the scan.
                        item_type:
                          type: String
              - name: 'bytesLimitPerFile'
                type: Integer
                description: |
                  Max number of bytes to scan from a file. If a scanned file's size is bigger than this value
                  then the rest of the bytes are omitted.
              - name: 'bytesLimitPerFilePercent'
                type: Integer
                description: |
                  Max percentage of bytes to scan from a file. The rest are omitted. The number of bytes scanned is rounded down.
                  Must be between 0 and 100, inclusively. Both 0 and 100 means no limit.
              - name: 'filesLimitPercent'
                type: Integer
                description: |
                  Limits the number of files to scan to this percentage of the input FileSet. Number of files scanned is rounded down.
                  Must be between 0 and 100, inclusively. Both 0 and 100 means no limit.
              - name: 'fileTypes'
                type: Array
                description: |
                  List of file type groups to include in the scan. If empty, all files are scanned and available data
                  format processors are applied. In addition, the binary content of the selected files is always scanned as well.
                  Images are scanned only as binary if the specified region does not support image inspection and no fileTypes were specified.
                item_type:
                  type: Enum
                  description: |
                    This field only has a name and description because of MM
                    limitations. It should not appear in downstreams.
                  enum_values:
                    - 'BINARY_FILE'
                    - 'TEXT_FILE'
                    - 'IMAGE'
                    - 'WORD'
                    - 'PDF'
                    - 'AVRO'
                    - 'CSV'
                    - 'TSV'
                    - 'POWERPOINT'
                    - 'EXCEL'
              - name: 'sampleMethod'
                type: Enum
                description: |
                  How to sample bytes if not all bytes are scanned. Meaningful only when used in conjunction with bytesLimitPerFile.
                  If not specified, scanning would start from the top.
                enum_values:
                  - 'TOP'
                  - 'RANDOM_START'
          - name: 'bigQueryOptions'
            type: NestedObject
            description: Options defining BigQuery table and row identifiers.
            properties:
              - name: 'tableReference'
                type: NestedObject
                description: |
                  Set of files to scan.
                required: true
                properties:
                  - name: 'projectId'
                    type: String
                    description: |
                      The Google Cloud Platform project ID of the project containing the table.
                    required: true
                  - name: 'datasetId'
                    type: String
                    description: |
                      The dataset ID of the table.
                    required: true
                  - name: 'tableId'
                    type: String
                    description: |
                      The name of the table.
                    required: true
              - name: 'rowsLimit'
                type: Integer
                description: |
                  Max number of rows to scan. If the table has more rows than this value, the rest of the rows are omitted.
                  If not set, or if set to 0, all rows will be scanned. Only one of rowsLimit and rowsLimitPercent can be
                  specified. Cannot be used in conjunction with TimespanConfig.
              - name: 'rowsLimitPercent'
                type: Integer
                description: |
                  Max percentage of rows to scan. The rest are omitted. The number of rows scanned is rounded down.
                  Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0. Only one of
                  rowsLimit and rowsLimitPercent can be specified. Cannot be used in conjunction with TimespanConfig.
              - name: 'sampleMethod'
                type: Enum
                description: |
                  How to sample rows if not all rows are scanned. Meaningful only when used in conjunction with either
                  rowsLimit or rowsLimitPercent. If not specified, rows are scanned in the order BigQuery reads them.
                  If TimespanConfig is set, set this to an empty string to avoid using the default value.
                default_value: "TOP"
                enum_values:
                  - 'TOP'
                  - 'RANDOM_START'
              - name: 'identifyingFields'
                type: Array
                description: |
                  Specifies the BigQuery fields that will be returned with findings.
                  If not specified, no identifying fields will be returned for findings.
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'name'
                      type: String
                      description: |
                        Name of a BigQuery field to be returned with the findings.
                      required: true
              - name: 'includedFields'
                type: Array
                description: |
                  Limit scanning only to these fields.
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'name'
                      type: String
                      description: |
                        Name describing the field to which scanning is limited.
                      required: true
              - name: 'excludedFields'
                type: Array
                description: |
                  References to fields excluded from scanning.
                  This allows you to skip inspection of entire columns which you know have no findings.
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'name'
                      type: String
                      description: |
                        Name describing the field excluded from scanning.
                      required: true
          - name: 'hybridOptions'
            type: NestedObject
            description: |
              Configuration to control jobs where the content being inspected is outside of Google Cloud Platform.
            send_empty_value: true
            allow_empty_object: true
            properties:
              - name: 'description'
                type: String
                description: |
                  A short description of where the data is coming from. Will be stored once in the job. 256 max length.
              - name: 'requiredFindingLabelKeys'
                type: Array
                description: |
                  These are labels that each inspection request must include within their 'finding_labels' map. Request
                  may contain others, but any missing one of these will be rejected.

                  Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

                  No more than 10 keys can be required.
                item_type:
                  type: String
              - name: 'tableOptions'
                type: NestedObject
                description: |
                  If the container is a table, additional information to make findings meaningful such as the columns that are primary keys.
                properties:
                  - name: 'identifyingFields'
                    type: Array
                    description: |
                      The columns that are the primary keys for table objects included in ContentItem. A copy of this
                      cell's value will stored alongside alongside each finding so that the finding can be traced to
                      the specific row it came from. No more than 3 may be provided.
                    item_type:
                      type: NestedObject
                      properties:
                        - name: 'name'
                          type: String
                          description: |
                            Name describing the field.
                          required: true
              - name: 'labels'
                type: KeyValuePairs
                description: |
                  To organize findings, these labels will be added to each finding.

                  Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

                  Label values must be between 0 and 63 characters long and must conform to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

                  No more than 10 labels can be associated with a given finding.

                  Examples:
                  * `"environment" : "production"`
                  * `"pipeline" : "etl"`
      - name: 'actions'
        type: Array
        description: |
          Configuration block for the actions to execute on the completion of a job. Can be specified multiple times, but only one for each type. Each action block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
        item_type:
          type: NestedObject
          properties:
            - name: 'saveFindings'
              type: NestedObject
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              description: |
                If set, the detailed findings will be persisted to the specified OutputStorageConfig. Only a single instance of this action can be specified. Compatible with: Inspect, Risk
              properties:
                - name: 'outputConfig'
                  type: NestedObject
                  description: |
                    Information on where to store output
                  required: true
                  properties:
                    - name: 'table'
                      type: NestedObject
                      description: |
                        Information on the location of the target BigQuery Table.
                      required: true
                      properties:
                        - name: 'projectId'
                          type: String
                          description: |
                            The Google Cloud Platform project ID of the project containing the table.
                          required: true
                        - name: 'datasetId'
                          type: String
                          description: |
                            Dataset ID of the table.
                          required: true
                        - name: 'tableId'
                          type: String
                          description: |
                            Name of the table. If is not set a new one will be generated for you with the following format:
                            `dlp_googleapis_yyyy_mm_dd_[dlp_job_id]`. Pacific timezone will be used for generating the date details.
                    - name: 'outputSchema'
                      type: Enum
                      description: |
                        Schema used for writing the findings for Inspect jobs. This field is only used for
                        Inspect and must be unspecified for Risk jobs. Columns are derived from the Finding
                        object. If appending to an existing table, any columns from the predefined schema
                        that are missing will be added. No columns in the existing table will be deleted.

                        If unspecified, then all available columns will be used for a new table or an (existing)
                        table with no schema, and no changes will be made to an existing table that has a schema.
                        Only for use with external storage.
                      enum_values:
                        - 'BASIC_COLUMNS'
                        - 'GCS_COLUMNS'
                        - 'DATASTORE_COLUMNS'
                        - 'BIG_QUERY_COLUMNS'
                        - 'ALL_COLUMNS'
            - name: 'pubSub'
              type: NestedObject
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              description: |
                Publish a message into a given Pub/Sub topic when the job completes.
              properties:
                - name: 'topic'
                  type: String
                  description: |
                    Cloud Pub/Sub topic to send notifications to.
                  required: true
            - name: 'publishSummaryToCscc'
              type: NestedObject
              description: |
                Publish the result summary of a DlpJob to the Cloud Security Command Center.
              send_empty_value: true
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              allow_empty_object: true
              properties:
                []
            - name: 'publishFindingsToCloudDataCatalog'
              type: NestedObject
              description: |
                Publish findings of a DlpJob to Data Catalog.
              send_empty_value: true
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              allow_empty_object: true
              properties:
                []
            - name: 'jobNotificationEmails'
              type: NestedObject
              description: |
                Sends an email when the job completes. The email goes to IAM project owners and technical Essential Contacts.
              send_empty_value: true
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              allow_empty_object: true
              properties:
                []
            - name: 'deidentify'
              type: NestedObject
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              description: |
                Create a de-identified copy of the requested table or files.
              properties:
                - name: 'cloudStorageOutput'
                  type: String
                  description: |
                    User settable Cloud Storage bucket and folders to store de-identified files.

                    This field must be set for cloud storage deidentification.

                    The output Cloud Storage bucket must be different from the input bucket.

                    De-identified files will overwrite files in the output path.

                    Form of: gs://bucket/folder/ or gs://bucket
                  required: true
                - name: 'fileTypesToTransform'
                  type: Array
                  description: |
                    List of user-specified file type groups to transform. If specified, only the files with these filetypes will be transformed.

                    If empty, all supported files will be transformed. Supported types may be automatically added over time.

                    If a file type is set in this field that isn't supported by the Deidentify action then the job will fail and will not be successfully created/started.
                  item_type:
                    type: Enum
                    description: |
                      This field only has a name and description because of MM
                      limitations. It should not appear in downstreams.
                    enum_values:
                      - 'IMAGE'
                      - 'TEXT_FILE'
                      - 'CSV'
                      - 'TSV'
                - name: 'transformationConfig'
                  type: NestedObject
                  description: |
                    User specified deidentify templates and configs for structured, unstructured, and image files.
                  properties:
                    - name: 'deidentifyTemplate'
                      type: String
                      description: |
                        If this template is specified, it will serve as the default de-identify template.
                    - name: 'structuredDeidentifyTemplate'
                      type: String
                      description: |
                        If this template is specified, it will serve as the de-identify template for structured content such as delimited files and tables.
                    - name: 'imageRedactTemplate'
                      type: String
                      description: |
                        If this template is specified, it will serve as the de-identify template for images.
                - name: 'transformationDetailsStorageConfig'
                  type: NestedObject
                  description: |
                    Config for storing transformation details.
                  properties:
                    - name: 'table'
                      type: NestedObject
                      description: |
                        The BigQuery table in which to store the output.
                      required: true
                      properties:
                        - name: 'datasetId'
                          type: String
                          description:
                            The ID of the dataset containing this table.
                          required: true
                        - name: 'projectId'
                          type: String
                          description:
                            The ID of the project containing this table.
                          required: true
                        - name: 'tableId'
                          type: String
                          description: |
                            The ID of the table. The ID must contain only letters (a-z,
                            A-Z), numbers (0-9), or underscores (_). The maximum length
                            is 1,024 characters.
            - name: 'publishToStackdriver'
              type: NestedObject
              description: |
                Enable Stackdriver metric dlp.googleapis.com/findingCount.
              send_empty_value: true
              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
              # exactly_one_of:
              #   - save_findings
              #   - pub_sub
              #   - publish_findings_to_cloud_data_catalog
              #   - publish_summary_to_cscc
              #   - job_notification_emails
              #   - deidentify
              #   - publish_to_stackdriver
              allow_empty_object: true
              properties:
                []
