resource_value_configs

Creates, updates, deletes, gets or lists a resource_value_configs resource.

Overview

Name	resource_value_configs
Type	Resource
Id	google.securitycenter.resource_value_configs

Fields

The following fields are returned by SELECT queries:

organizations_resource_value_configs_get

Successful response

Name	Datatype	Description
name	string	Name for the resource value configuration
cloudProvider	string	Cloud provider this configuration applies to
createTime	string (google-datetime)	Output only. Timestamp this resource value configuration was created.
description	string	Description of the resource value configuration.
resourceLabelsSelector	object	List of resource labels to search for, evaluated with AND. For example, "resource_labels_selector": {"key": "value", "env": "prod"} will match resources with labels "key": "value" AND "env": "prod" https://cloud.google.com/resource-manager/docs/creating-managing-labels
resourceType	string	Apply resource_value only to resources that match resource_type. resource_type will be checked with AND of other resources. For example, "storage.googleapis.com/Bucket" with resource_value "HIGH" will apply "HIGH" value only to "storage.googleapis.com/Bucket" resources.
resourceValue	string	Required. Resource value level this expression represents
scope	string	Project or folder to scope this configuration to. For example, "project/456" would apply this configuration only to resources in "project/456" scope will be checked with AND of other resources.
sensitiveDataProtectionMapping	object	A mapping of the sensitivity on Sensitive Data Protection finding to resource values. This mapping can only be used in combination with a resource_type that is related to BigQuery, e.g. "bigquery.googleapis.com/Dataset". (id: GoogleCloudSecuritycenterV1SensitiveDataProtectionMapping)
tagValues	array	Required. Tag values combined with AND to check against. For Google Cloud resources, they are tag value IDs in the form of "tagValues/123". Example: [ "tagValues/123", "tagValues/456", "tagValues/789" ] https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing
updateTime	string (google-datetime)	Output only. Timestamp this resource value configuration was last updated.

organizations_resource_value_configs_list

Successful response

Name	Datatype	Description
name	string	Name for the resource value configuration
cloudProvider	string	Cloud provider this configuration applies to
createTime	string (google-datetime)	Output only. Timestamp this resource value configuration was created.
description	string	Description of the resource value configuration.
resourceLabelsSelector	object	List of resource labels to search for, evaluated with AND. For example, "resource_labels_selector": {"key": "value", "env": "prod"} will match resources with labels "key": "value" AND "env": "prod" https://cloud.google.com/resource-manager/docs/creating-managing-labels
resourceType	string	Apply resource_value only to resources that match resource_type. resource_type will be checked with AND of other resources. For example, "storage.googleapis.com/Bucket" with resource_value "HIGH" will apply "HIGH" value only to "storage.googleapis.com/Bucket" resources.
resourceValue	string	Required. Resource value level this expression represents
scope	string	Project or folder to scope this configuration to. For example, "project/456" would apply this configuration only to resources in "project/456" scope will be checked with AND of other resources.
sensitiveDataProtectionMapping	object	A mapping of the sensitivity on Sensitive Data Protection finding to resource values. This mapping can only be used in combination with a resource_type that is related to BigQuery, e.g. "bigquery.googleapis.com/Dataset". (id: GoogleCloudSecuritycenterV1SensitiveDataProtectionMapping)
tagValues	array	Required. Tag values combined with AND to check against. For Google Cloud resources, they are tag value IDs in the form of "tagValues/123". Example: [ "tagValues/123", "tagValues/456", "tagValues/789" ] https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing
updateTime	string (google-datetime)	Output only. Timestamp this resource value configuration was last updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
organizations_resource_value_configs_get	select	organizationsId, resourceValueConfigsId		Gets a ResourceValueConfig.
organizations_resource_value_configs_list	select	organizationsId	pageSize, pageToken	Lists all ResourceValueConfigs.
organizations_resource_value_configs_batch_create	insert	organizationsId		Creates a ResourceValueConfig for an organization. Maps user's tags to difference resource values for use by the attack path simulation.
organizations_resource_value_configs_patch	update	organizationsId, resourceValueConfigsId	updateMask	Updates an existing ResourceValueConfigs with new rules.
organizations_resource_value_configs_delete	delete	organizationsId, resourceValueConfigsId		Deletes a ResourceValueConfig.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
organizationsId	string
resourceValueConfigsId	string
pageSize	integer (int32)
pageToken	string
updateMask	string (google-fieldmask)

SELECT examples

organizations_resource_value_configs_get

Gets a ResourceValueConfig.

SELECT
name,
cloudProvider,
createTime,
description,
resourceLabelsSelector,
resourceType,
resourceValue,
scope,
sensitiveDataProtectionMapping,
tagValues,
updateTime
FROM google.securitycenter.resource_value_configs
WHERE organizationsId = '{{ organizationsId }}' -- required
AND resourceValueConfigsId = '{{ resourceValueConfigsId }}' -- required;

organizations_resource_value_configs_list

Lists all ResourceValueConfigs.

SELECT
name,
cloudProvider,
createTime,
description,
resourceLabelsSelector,
resourceType,
resourceValue,
scope,
sensitiveDataProtectionMapping,
tagValues,
updateTime
FROM google.securitycenter.resource_value_configs
WHERE organizationsId = '{{ organizationsId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}';

INSERT examples

organizations_resource_value_configs_batch_create

Creates a ResourceValueConfig for an organization. Maps user's tags to difference resource values for use by the attack path simulation.

INSERT INTO google.securitycenter.resource_value_configs (
data__requests,
organizationsId
)
SELECT 
'{{ requests }}',
'{{ organizationsId }}'
RETURNING
resourceValueConfigs
;

Manifest

# Description fields are for documentation purposes
- name: resource_value_configs
  props:
    - name: organizationsId
      value: string
      description: Required parameter for the resource_value_configs resource.
    - name: requests
      value: array
      description: >
        Required. The resource value configs to be created.
        

UPDATE examples

organizations_resource_value_configs_patch

Updates an existing ResourceValueConfigs with new rules.

UPDATE google.securitycenter.resource_value_configs
SET 
data__name = '{{ name }}',
data__resourceValue = '{{ resourceValue }}',
data__tagValues = '{{ tagValues }}',
data__resourceType = '{{ resourceType }}',
data__scope = '{{ scope }}',
data__resourceLabelsSelector = '{{ resourceLabelsSelector }}',
data__description = '{{ description }}',
data__cloudProvider = '{{ cloudProvider }}',
data__sensitiveDataProtectionMapping = '{{ sensitiveDataProtectionMapping }}'
WHERE 
organizationsId = '{{ organizationsId }}' --required
AND resourceValueConfigsId = '{{ resourceValueConfigsId }}' --required
AND updateMask = '{{ updateMask}}'
RETURNING
name,
cloudProvider,
createTime,
description,
resourceLabelsSelector,
resourceType,
resourceValue,
scope,
sensitiveDataProtectionMapping,
tagValues,
updateTime;

DELETE examples

organizations_resource_value_configs_delete

Deletes a ResourceValueConfig.

DELETE FROM google.securitycenter.resource_value_configs
WHERE organizationsId = '{{ organizationsId }}' --required
AND resourceValueConfigsId = '{{ resourceValueConfigsId }}' --required;