Skip to content

Commit d6be8f0

Browse files
ankitiit84ankitiit84
authored
Add Big Query Data Policy V2 resource (#14979)
1 parent 2f06c6f commit d6be8f0

12 files changed

+344
-0
lines changed

‎mmv1/products/bigquerydatapolicyv2/DataPolicy.yaml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: DataPolicy
16+
description: BigQuery Data Policy
17+
references:
18+
guides:
19+
'Official Documentation': 'https://cloud.google.com/bigquery/docs/column-data-masking-intro'
20+
api: 'https://cloud.google.com/bigquery/docs/reference/bigquerydatapolicy/rest/v2/projects.locations.dataPolicies'
21+
docs: null
22+
id_format: 'projects/{{project}}/locations/{{location}}/dataPolicies/{{data_policy_id}}'
23+
base_url: 'projects/{{project}}/locations/{{location}}/dataPolicies'
24+
self_link: 'projects/{{project}}/locations/{{location}}/dataPolicies/{{data_policy_id}}'
25+
create_url: 'projects/{{project}}/locations/{{location}}/dataPolicies'
26+
update_verb: 'PATCH'
27+
update_mask: true
28+
import_format:
29+
- 'projects/{{project}}/locations/{{location}}/dataPolicies/{{data_policy_id}}'
30+
- '{{project}}/{{location}}/{{data_policy_id}}'
31+
- '{{location}}/{{data_policy_id}}'
32+
timeouts:
33+
insert_minutes: 20
34+
update_minutes: 20
35+
delete_minutes: 20
36+
iam_policy:
37+
method_name_separator: ':'
38+
fetch_iam_policy_verb: 'POST'
39+
parent_resource_attribute: 'data_policy_id'
40+
example_config_body: 'templates/terraform/iam/iam_attributes.go.tmpl'
41+
import_format:
42+
- 'projects/{{project}}/locations/{{location}}/dataPolicies/{{data_policy_id}}'
43+
- '{{data_policy_id}}'
44+
custom_code:
45+
encoder: templates/terraform/encoders/bigquery_datapolicyv2_datapolicy.go.tmpl
46+
update_encoder: templates/terraform/update_encoder/bigquery_datapolicyv2_datapolicy.go.tmpl
47+
examples:
48+
- name: 'bigquery_datapolicyv2_datapolicy_basic'
49+
primary_resource_id: 'basic_data_policy'
50+
primary_resource_name: 'fmt.Sprintf("tf_test_basic_data_policy%s", context["random_suffix"])'
51+
vars:
52+
data_policy_id: 'basic_data_policy'
53+
- name: 'bigquery_datapolicyv2_datapolicy_predefined_masking'
54+
primary_resource_id: 'predefined_masking_data_policy'
55+
primary_resource_name: 'fmt.Sprintf("tf_test_predefined_masking_data_policy%s", context["random_suffix"])'
56+
vars:
57+
data_policy_id: 'predefined_masking_data_policy'
58+
- name: 'bigquery_datapolicyv2_datapolicy_routine'
59+
primary_resource_id: 'routine_data_policy'
60+
primary_resource_name: 'fmt.Sprintf("tf_test_routine_data_policy%s", context["random_suffix"])'
61+
vars:
62+
data_policy_id: 'routine_data_policy'
63+
dataset_id: 'dataset_id'
64+
- name: 'bigquery_datapolicyv2_datapolicy_withgrantees'
65+
primary_resource_id: 'data_policy_with_grantees'
66+
primary_resource_name: 'fmt.Sprintf("tf_test_data_policy_with_grantees%s", context["random_suffix"])'
67+
exclude_test: true
68+
vars:
69+
data_policy_id: 'data_policy_with_grantees'
70+
- name: 'bigquery_datapolicyv2_datapolicy_withgrantees_test'
71+
primary_resource_id: 'data_policy_with_grantees'
72+
primary_resource_name: 'fmt.Sprintf("tf_test_data_policy_with_grantees%s", context["random_suffix"])'
73+
exclude_docs: true
74+
vars:
75+
data_policy_id: 'data_policy_with_grantees'
76+
parameters:
77+
- name: location
78+
type: String
79+
description: Resource ID segment making up resource `name`. It identifies the resource
80+
within its parent collection as described in https://google.aip.dev/122.
81+
immutable: true
82+
url_param_only: true
83+
required: true
84+
properties:
85+
- name: dataMaskingPolicy
86+
type: NestedObject
87+
description: The policy used to specify data masking rule.
88+
properties:
89+
- name: predefinedExpression
90+
type: String
91+
description: |-
92+
A predefined masking expression.
93+
Possible values:
94+
SHA256
95+
ALWAYS_NULL
96+
DEFAULT_MASKING_VALUE
97+
LAST_FOUR_CHARACTERS
98+
FIRST_FOUR_CHARACTERS
99+
EMAIL_MASK
100+
DATE_YEAR_MASK
101+
RANDOM_HASH
102+
- name: routine
103+
type: String
104+
description: |-
105+
The name of the BigQuery routine that contains the custom masking
106+
routine, in the format of
107+
`projects/{project_number}/datasets/{dataset_id}/routines/{routine_id}`.
108+
diff_suppress_func: 'tpgresource.ProjectNumberDiffSuppress'
109+
- name: dataPolicyType
110+
type: String
111+
description: |-
112+
Type of data policy.
113+
Possible values:
114+
DATA_MASKING_POLICY
115+
RAW_DATA_ACCESS_POLICY
116+
COLUMN_LEVEL_SECURITY_POLICY
117+
required: true
118+
- name: etag
119+
type: Fingerprint
120+
description: |-
121+
The etag for this Data Policy.
122+
This field is used for UpdateDataPolicy calls. If Data Policy exists, this
123+
field is required and must match the server's etag. It will also be
124+
populated in the response of GetDataPolicy, CreateDataPolicy, and
125+
UpdateDataPolicy calls.
126+
default_from_api: true
127+
- name: grantees
128+
type: Array
129+
description: |-
130+
The list of IAM principals that have Fine Grained Access to the underlying
131+
data goverened by this data policy.
132+
133+
Uses the [IAM V2 principal
134+
syntax](https://cloud.google.com/iam/docs/principal-identifiers#v2) Only
135+
supports principal types users, groups, serviceaccounts, cloudidentity.
136+
This field is supported in V2 Data Policy only. In case of V1 data policies
137+
(i.e. verion = 1 and policy_tag is set), this field is not populated.
138+
item_type:
139+
type: String
140+
default_from_api: true
141+
- name: name
142+
type: String
143+
description: |-
144+
Identifier. Resource name of this data policy, in the format of
145+
`projects/{project_number}/locations/{location_id}/dataPolicies/{data_policy_id}`.
146+
output: true
147+
- name: policyTag
148+
type: String
149+
description: |-
150+
Policy tag resource name, in the format of
151+
`projects/{project_number}/locations/{location_id}/taxonomies/{taxonomy_id}/policyTags/{policyTag_id}`.
152+
policy_tag is supported only for V1 data policies.
153+
output: true
154+
- name: version
155+
type: String
156+
description: |-
157+
The version of the Data Policy resource.
158+
Possible values:
159+
V1
160+
V2
161+
output: true
162+
- name: dataPolicyId
163+
type: String
164+
description: |-
165+
User-assigned (human readable) ID of the data policy that needs to be
166+
unique within a project. Used as {data_policy_id} in part of the resource
167+
name.
168+
required: true

‎mmv1/products/bigquerydatapolicyv2/product.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: BigqueryDatapolicyv2
16+
display_name: BigQuery Data Policy V2
17+
scopes:
18+
- https://www.googleapis.com/auth/cloud-platform
19+
versions:
20+
- base_url: https://bigquerydatapolicy.googleapis.com/v2/
21+
name: ga
22+
caibaseurl: ""
23+
resourceswithcaiassettype: {}

‎mmv1/templates/terraform/encoders/bigquery_datapolicyv2_datapolicy.go.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// The create request is not in the same format as the resource.
2+
// The API request needs resource to be nested inside the "data_policy" field.
3+
newObj := make(map[string]interface{})
4+
newObj["dataPolicy"] = obj
5+
newObj["dataPolicyId"] = obj["dataPolicyId"].(string)
6+
return newObj, nil

‎mmv1/templates/terraform/examples/bigquery_datapolicyv2_datapolicy_basic.tf.tmpl‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "google_bigquery_datapolicyv2_data_policy" "{{$.PrimaryResourceId}}" {
2+
location = "us-central1"
3+
data_policy_type = "RAW_DATA_ACCESS_POLICY"
4+
data_policy_id = "{{index $.Vars "data_policy_id"}}"
5+
}

‎mmv1/templates/terraform/examples/bigquery_datapolicyv2_datapolicy_predefined_masking.tf.tmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "google_bigquery_datapolicyv2_data_policy" "{{$.PrimaryResourceId}}" {
2+
location = "us-central1"
3+
data_policy_type = "DATA_MASKING_POLICY"
4+
data_masking_policy {
5+
predefined_expression = "SHA256"
6+
}
7+
data_policy_id = "{{index $.Vars "data_policy_id"}}"
8+
}

‎mmv1/templates/terraform/examples/bigquery_datapolicyv2_datapolicy_routine.tf.tmpl‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
resource "google_bigquery_datapolicyv2_data_policy" "{{$.PrimaryResourceId}}" {
2+
location = "us-central1"
3+
data_policy_id = "{{index $.Vars "data_policy_id"}}"
4+
data_policy_type = "DATA_MASKING_POLICY"
5+
data_masking_policy {
6+
routine = google_bigquery_routine.custom_masking_routine.id
7+
}
8+
}
9+
10+
resource "google_bigquery_dataset" "test" {
11+
dataset_id = "{{index $.Vars "dataset_id"}}"
12+
location = "us-central1"
13+
}
14+
15+
resource "google_bigquery_routine" "custom_masking_routine" {
16+
dataset_id = google_bigquery_dataset.test.dataset_id
17+
routine_id = "custom_masking_routine"
18+
routine_type = "SCALAR_FUNCTION"
19+
language = "SQL"
20+
data_governance_type = "DATA_MASKING"
21+
definition_body = "SAFE.REGEXP_REPLACE(ssn, '[0-9]', 'X')"
22+
return_type = "{\"typeKind\" : \"STRING\"}"
23+
24+
arguments {
25+
name = "ssn"
26+
data_type = "{\"typeKind\" : \"STRING\"}"
27+
}
28+
}

‎mmv1/templates/terraform/examples/bigquery_datapolicyv2_datapolicy_withgrantees.tf.tmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "google_bigquery_datapolicyv2_data_policy" "{{$.PrimaryResourceId}}" {
2+
location = "us-central1"
3+
data_policy_type = "RAW_DATA_ACCESS_POLICY"
4+
grantees = [
5+
"principal://goog/subject/[email protected]"
6+
]
7+
data_policy_id = "{{index $.Vars "data_policy_id"}}"
8+
}

‎mmv1/templates/terraform/examples/bigquery_datapolicyv2_datapolicy_withgrantees_test.tf.tmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "google_bigquery_datapolicyv2_data_policy" "{{$.PrimaryResourceId}}" {
2+
location = "us-central1"
3+
data_policy_type = "RAW_DATA_ACCESS_POLICY"
4+
grantees = [
5+
"principalSet://goog/group/[email protected]"
6+
]
7+
data_policy_id = "{{index $.Vars "data_policy_id"}}"
8+
}

‎mmv1/templates/terraform/update_encoder/bigquery_datapolicyv2_datapolicy.go.tmpl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
return obj, nil

‎mmv1/third_party/terraform/.teamcity/components/inputs/services_beta.kt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,11 @@ var ServicesListBeta = mapOf(
111111
"displayName" to "Bigquerydatapolicy",
112112
"path" to "./google-beta/services/bigquerydatapolicy"
113113
),
114+
"bigquerydatapolicyv2" to mapOf(
115+
"name" to "bigquerydatapolicyv2",
116+
"displayName" to "Bigquerydatapolicyv2",
117+
"path" to "./google-beta/services/bigquerydatapolicyv2"
118+
),
114119
"bigquerydatatransfer" to mapOf(
115120
"name" to "bigquerydatatransfer",
116121
"displayName" to "Bigquerydatatransfer",

0 commit comments

Comments
 (0)