dlp_tokenizing_runner_permissions.yaml

# Copyright 2020 The Data Catalog Tag History Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

title: "DLP Data tokenization Runner"
description: "Perform identification and tokenization using Dataflow and DLP."
stage: "BETA"
includedPermissions:
  # Generic
  - resourcemanager.projects.get
  # DLP permissions
  - serviceusage.services.use
  - dlp.kms.encrypt
  - dlp.inspectTemplates.get
  - dlp.inspectTemplates.list
  - dlp.deidentifyTemplates.get
  - dlp.deidentifyTemplates.list
  # BigQuery permissions to use as BigQuery source
  - bigquery.datasets.get
  - bigquery.datasets.getIamPolicy
  - bigquery.jobs.create
  - bigquery.jobs.get
  - bigquery.jobs.list
  - bigquery.jobs.listAll
  - bigquery.jobs.update
  - bigquery.tables.get
  - bigquery.tables.getData
  - bigquery.tables.list
  - bigquery.tables.export
  - bigquery.tables.getIamPolicy
  # Permission to use BigQuery Storage API for reading
  - bigquery.readsessions.create
  - bigquery.readsessions.getData
  - bigquery.readsessions.update
  # Permissions required for using as BigQuery table destination
  - bigquery.datasets.create
  - bigquery.datasets.update
  - bigquery.tables.setIamPolicy
  - bigquery.tables.create
  - bigquery.tables.delete
  - bigquery.tables.update
  - bigquery.tables.updateData
  - bigquery.datasets.create
  - bigquery.datasets.setIamPolicy
  # Dataflow permissions
  - compute.instanceGroupManagers.update
  - compute.instances.delete
  - compute.instances.setDiskAutoDelete
  - dataflow.jobs.get
  - logging.logEntries.create
  # Storage permissions
  - storage.objects.create
  - storage.objects.get
  - storage.objects.list
  - storage.objects.update
  - storage.objects.delete
  # KMS permissions
  - cloudkms.cryptoKeyVersions.useToDecrypt
  - cloudkms.cryptoKeyVersions.useToEncrypt
  # Pub/Sub permissions
  - pubsub.subscriptions.consume
  - pubsub.subscriptions.create
  - pubsub.subscriptions.get
  - pubsub.subscriptions.getIamPolicy
  - pubsub.subscriptions.list
  - pubsub.topics.attachSubscription
  - pubsub.topics.get
  - pubsub.topics.create
  - pubsub.topics.getIamPolicy
  - pubsub.topics.list
  - pubsub.topics.publish