Check whether GCP Dataflow API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; Dataflow &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > Dataflow

GCP > Dataflow > API Enabled

Record and synchronize details for the GCP Dataflow into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Dataflow > CMDB

Discover GCP Dataflow resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > Dataflow > Discovery

Take an action when an GCP Dataflow job is not active based on the&#92;n`GCP &gt; Dataflow &gt; Job &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Dataflow &gt; Job &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > Dataflow > Job

GCP > Dataflow > Job > Active

GCP > Dataflow > Job > Active > Age

GCP > Dataflow > Job > Active > Last Modified

Take an action when a GCP Dataflow job is not approved based on `GCP &gt; Dataflow &gt; Job &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > Dataflow > Job > Approved

GCP > Dataflow > Job > Approved > Custom

GCP > Dataflow > Job > Approved > Encryption at Rest

GCP > Dataflow > Job > Approved > Encryption at Rest > Customer Managed Key

GCP > Dataflow > Job > Approved > Regions

GCP > Dataflow > Job > Approved > Usage

Record and synchronize details for the GCP Dataflow job into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; Dataflow &gt; Job &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n&#92;nThis control will automatically re-run every 24 hours because GCP does not currently support real-time events for this resource type.&#92;n

GCP > Dataflow > Job > CMDB

Discover GCP Dataflow job resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; Dataflow &gt; Job &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n&#92;nThis control will automatically re-run every 24 hours because GCP does not currently support real-time events for this resource type.&#92;n

GCP > Region

GCP > Dataflow > Job > Discovery

The Usage control determines whether the number of GCP Dataflow job resources exceeds the configured usage limit for this project.&#92;n&#92;nYou can configure the behavior of this control with the  `GCP &gt; Dataflow &gt; Job &gt; Usage` policy, and set the limit with the `GCP &gt; Dataflow &gt; Job &gt; Usage &gt; Limit` policy.&#92;n

GCP > Dataflow > Job > Usage

GCP > Dataflow > Job > Usage > Limit

The maximum number of workers to cap scaling at.

AutoscalingSettings

Metadata for a BigQuery connector used by the job.

Query used to access data in the connection.

BigQueryIODetails

Metadata for a Cloud Bigtable connector used by the job.

BigTableIODetails

Description of an interstitial value between transforms in an execution stage.

Dataflow service generated name for this source.

User name for the original user transform or collection with which this source is most closely associated.

Human-readable name for this transform; may be user or system generated.

ComponentSource

Description of a transform executed as part of an execution stage.

User name for the original user transform with which this transform is most closely associated.

ComponentTransform

Configuration options for sampling elements.

List of given sampling behaviors to enable. For example, specifying behaviors = [ALWAYS_ON] samples in-flight elements but does not sample exceptions. Can be used to specify multiple behaviors like, behaviors = [ALWAYS_ON, EXCEPTIONS] for specifying periodic sampling and exception sampling. If DISABLED is in the list, then sampling will be disabled and ignore the other given behaviors. Ordering does not matter.

DataSamplingConfig

Metadata for a Datastore connector used by the job.

DatastoreIODetails

Describes any options that have an effect on the debugging of pipelines.

Configuration options for sampling elements from a running pipeline.

When true, enables the logging of the literal hot key to the user's Cloud Logging.

DebugOptions

Describes the data disk used by a workflow job.

Disk storage type, as defined by Google Compute Engine. This must be a disk type appropriate to the project and zone in which the workers will run. If unknown or unspecified, the service will attempt to choose a reasonable default. For example, the standard persistent disk type is a resource name typically ending in "pd-standard". If SSD persistent disks are available, the resource name typically ends with "pd-ssd". The actual valid values are defined the Google Compute Engine API, not by the Cloud Dataflow API; consult the Google Compute Engine documentation for more information about determining the set of available disk types for a particular project and zone. Google Compute Engine Disk types are local to a particular project in a particular zone, and so the resource name will typically look something like this: compute.googleapis.com/projects/project-id/zones/zone/diskTypes/pd-standard

Size of disk in GB. If zero or unspecified, the service will attempt to choose a reasonable default.

Disk

Data provided with a pipeline or transform to provide descriptive info.

Contains value if the data is of a boolean type.

Contains value if the data is of duration type.

Contains value if the data is of float type.

Contains value if the data is of int64 type.

Contains value if the data is of java class type.

The key identifying the display data. This is intended to be used as a label for the display data when viewed in a dax monitoring system.

An optional label to display in a dax UI for the element.

The namespace for the key. This is usually a class name or programming language namespace (i.e. python module) which defines the display data. This allows a dax monitoring system to specially handle the data and perform custom rendering.

A possible additional shorter value to display. For example a java_class_name_value of com.mypackage.MyDoFn will be stored with MyDoFn as the short_str_value and com.mypackage.MyDoFn as the java_class_name value. short_str_value can be displayed and java_class_name_value will be displayed as a tooltip.

Contains value if the data is of string type.

Contains value if the data is of timestamp type.

DisplayData

Describes the environment in which a Dataflow Job runs.

The type of cluster manager API to use. If unknown or unspecified, the service will attempt to choose a reasonable default. This should be in the form of the API service name, e.g. "compute.googleapis.com".

The dataset for the current project where various workflow related tables are stored. The supported resource type is: Google BigQuery: bigquery.googleapis.com/{dataset}

Any debugging options to be supplied to the job.

The list of experiments to enable. This field should be used for SDK related experiments and not for service related experiments. The proper field for service related experiments is service_options.

Which Flexible Resource Scheduling mode to run in.

Properties of the object. Contains field @type with type URL.

The Cloud Dataflow SDK pipeline options specified by the user. These options are passed through the service and are used to recreate the SDK pipeline options on the worker in a language agnostic and platform independent way.

Identity to run virtual machines as. Defaults to the default account.

If set, contains the Cloud KMS key identifier used to encrypt data at rest, AKA a Customer Managed Encryption Key (CMEK). Format: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY

The list of service options to enable. This field should be used for service related experiments only. These experiments, when graduating to GA, should be replaced by dedicated fields or become default (i.e. always on).

Output only. The shuffle mode used for the job.

Optional. Specifies the Streaming Engine message processing guarantees. Reduces cost and latency but might result in duplicate messages committed to storage. Designed to run simple mapping streaming ETL jobs at the lowest cost. For example, Change Data Capture (CDC) to BigQuery is a canonical use case.

The prefix of the resources the system should use for temporary storage. The system will append the suffix "/temp-{JOBNAME} to this resource prefix, where {JOBNAME} is the value of the job_name field. The resulting bucket and object prefix is used as the prefix of the resources used to store temporary data needed during the job execution. NOTE: This will override the value in taskrunner_settings. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}

Output only. Whether the job uses the Streaming Engine resource-based billing model.

A description of the process that generated the request.

A structure describing which components and their versions of the service are required in order to run the job.

The worker pools. At least one "harness" worker pool must be specified in order for the job to have workers.

The Compute Engine region (https://cloud.google.com/compute/docs/regions-zones/regions-zones) in which worker processing should occur, e.g. "us-west1". Mutually exclusive with worker_zone. If neither worker_region nor worker_zone is specified, default to the control plane's region.

The Compute Engine zone (https://cloud.google.com/compute/docs/regions-zones/regions-zones) in which worker processing should occur, e.g. "us-west1-a". Mutually exclusive with worker_region. If neither worker_region nor worker_zone is specified, a zone in the control plane's region is chosen based on available capacity.

Environment

A message describing the state of a particular execution stage.

The time at which the stage transitioned to this state.

Executions stage states allow the same set of values as JobState.

ExecutionStageState

Description of the composing transforms, names/ids, and input/outputs of a stage of execution. Some composing transforms and sources may have been generated by the Dataflow service during execution planning.

Collections produced and consumed by component transforms of this stage.

Transforms that comprise this execution stage.

Dataflow service generated id for this stage.

Type of transform this stage is executing.

Dataflow service generated name for this stage.

Other stages that must complete before this stage can run.

ExecutionStageSummary

Metadata for a File connector used by the job.

File Pattern used to access files by the connector.

FileIODetails

Defines a job to be run by the Cloud Dataflow service. Do not enter confidential information when you supply string values using the API.

The client's unique identifier of the job, re-used across retried attempts. If this field is set, the service will ensure its uniqueness. The request to create a job will fail if the service has knowledge of a previously submitted job with the same client's ID and job name. The caller may use this field to ensure idempotence of job creation across retried attempts to create a job. By default, the field is empty and, in that case, the service ignores it.

The timestamp when the job was initially created. Immutable and set by the Cloud Dataflow service.

If this is specified, the job's initial state is populated from the given snapshot.

The current state of the job. Jobs are created in the `JOB_STATE_STOPPED` state unless otherwise specified. A job in the `JOB_STATE_RUNNING` state may asynchronously enter a terminal state. After a job has reached a terminal state, no further state updates may be made. This field might be mutated by the Dataflow service; callers cannot mutate it.

The timestamp associated with the current state.

The unique ID of this job. This field is set by the Dataflow service when the job is created, and is immutable for the life of the job.

This field is populated by the Dataflow service to support filtering jobs by the metadata values provided here. Populated for ListJobs and all GetJob views SUMMARY and higher.

User-defined labels for this job. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: * Keys must conform to regexp: \p{Ll}\p{Lo}{0,62} * Values must conform to regexp: [\p{Ll}\p{Lo}\p{N}_-]{0,63} * Both keys and values are additionally constrained to be <= 128 bytes in size.

The [regional endpoint] (https://cloud.google.com/dataflow/docs/concepts/regional-endpoints) that contains this job.

The user-specified Dataflow job name. Only one active job with a given name can exist in a project within one region at any given time. Jobs in different regions can have the same name. If a caller attempts to create a job with the same name as an active job that already exists, the attempt returns the existing job. The name must match the regular expression `[a-z]([-a-z0-9]{0,1022}[a-z0-9])?`

Preliminary field: The format of this data may change at any time. A description of the user pipeline and stages through which it is executed. Created by Cloud Dataflow service. Only retrieved with JOB_VIEW_DESCRIPTION or JOB_VIEW_ALL.

The ID of the Google Cloud project that the job belongs to.

If this job is an update of an existing job, this field is the job ID of the job it replaced. When sending a `CreateJobRequest`, you can update a job by specifying it here. The job named here is stopped, and its intermediate state is transferred to this job.

If another job is an update of this job (and thus, this job is in `JOB_STATE_UPDATED`), this field contains the ID of that job.

The job's requested state. Applies to `UpdateJob` requests. Set `requested_state` with `UpdateJob` requests to switch between the states `JOB_STATE_STOPPED` and `JOB_STATE_RUNNING`. You can also use `UpdateJob` requests to change a job's state from `JOB_STATE_RUNNING` to `JOB_STATE_CANCELLED`, `JOB_STATE_DONE`, or `JOB_STATE_DRAINED`. These states irrevocably terminate the job if it hasn't already reached a terminal state. This field has no effect on `CreateJob` requests.

This field may ONLY be modified at runtime using the projects.jobs.update method to adjust job behavior. This field has no effect when specified at job creation.

Output only. Reserved for future use. This field is set only in responses from the server; it is ignored if it is set in any requests.

Reserved for future use. This field is set only in responses from the server; it is ignored if it is set in any requests.

This field may be mutated by the Cloud Dataflow service; callers cannot mutate it.

The timestamp when the job was started (transitioned to JOB_STATE_PENDING). Flexible resource scheduling jobs are started with some delay after job creation, so start_time is unset before start and is updated when the job is started by the Cloud Dataflow service. For other jobs, start_time always equals to create_time and is immutable and set by the Cloud Dataflow service.

Exactly one of step or steps_location should be specified. The top-level steps that constitute the entire job. Only retrieved with JOB_VIEW_ALL.

The Cloud Storage location where the steps are stored.

A set of files the system should be aware of that are used for temporary storage. These temporary files will be removed on job completion. No duplicates are allowed. No file patterns are supported. The supported files are: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}

The map of transform name prefixes of the job to be replaced to the corresponding name prefixes of the new job.

Additional information about how a Cloud Dataflow job will be executed that isn't contained in the submitted job.

A mapping from each stage to the information about that stage.

JobExecutionInfo

Metadata available primarily for filtering jobs. Will be included in the ListJob response and Job SUMMARY view.

Identification of a Cloud Bigtable source used in the Dataflow job.

Identification of a BigQuery source used in the Dataflow job.

Identification of a Datastore source used in the Dataflow job.

Identification of a File source used in the Dataflow job.

Identification of a Pub/Sub source used in the Dataflow job.

Identification of a Spanner source used in the Dataflow job.

List of display properties to help UI filter jobs.

JobMetadata

The packages that must be installed in order for a worker to run the steps of the Cloud Dataflow job that will be assigned to its worker pool. This is the mechanism by which the Cloud Dataflow SDK causes code to be loaded onto the workers. For example, the Cloud Dataflow Java SDK might use this to install jars containing the user's code and all of the various dependencies (libraries, data files, etc.) required in order for that code to run.

The resource to read the package from. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket} bucket.storage.googleapis.com/

Package

A descriptive representation of submitted pipeline as well as the executed form. This data is provided by the Dataflow service for ease of visualizing the pipeline and interpreting Dataflow provided metrics.

Description of each stage of execution of the pipeline.

Description of each transform in the pipeline and collections between them.

A hash value of the submitted pipeline portable graph step names if exists.

PipelineDescription

Metadata for a Pub/Sub connector used by the job.

PubSubIODetails

Additional job parameters that can only be updated during runtime using the projects.jobs.update method. These fields have no effect when specified during job creation.

The maximum number of workers to cap autoscaling at. This field is currently only supported for Streaming Engine jobs.

The minimum number of workers to scale down to. This field is currently only supported for Streaming Engine jobs.

Target worker utilization, compared against the aggregate utilization of the worker pool by autoscaler, to determine upscaling and downscaling when absent other constraints such as backlog.

RuntimeUpdatableParams

Output only. Describes the impact of this SDK bug.

Output only. Link to more information on the bug.

SdkBug

Defines an SDK harness container for executing Dataflow pipelines.

The set of capabilities enumerated in the above Environment proto. See also [beam_runner_api.proto](https://github.com/apache/beam/blob/master/model/pipeline/src/main/proto/org/apache/beam/model/pipeline/v1/beam_runner_api.proto)

A docker container image that resides in Google Container Registry.

Environment ID for the Beam runner API proto Environment that corresponds to the current SDK Harness.

If true, recommends the Dataflow service to use only one core per SDK container instance with this image. If false (or unset) recommends using more than one core per SDK container instance with this image for efficiency. Note that Dataflow service may choose to override this property if needed.

SdkHarnessContainerImage

The version of the SDK used to run the job.

Output only. Known bugs found in this SDK version.

A readable string describing the version of the SDK.

SdkVersion

Metadata for a Spanner connector used by the job.

SpannerIODetails

Description of an input or output of an execution stage.

Human-readable name for this source; may be user or system generated.

StageSource

Defines a particular step within a Cloud Dataflow job. A job consists of multiple steps, each of which performs some specific operation as part of the overall job. Data is typically passed from one step to another as part of the job. **Note:** The properties of this object are not stable and might change. Here's an example of a sequence of steps which together implement a Map-Reduce job: * Read a collection of data from some source, parsing the collection's elements. * Validate the elements. * Apply a user-defined function to map each element to some value and extract an element-specific key value. * Group elements with the same key into a single element with that key, transforming a multiply-keyed collection into a uniquely-keyed collection. * Write the elements out to some data sink. Note that the Cloud Dataflow service may be used to run many different types of jobs, not just Map-Reduce.

The kind of step in the Cloud Dataflow job.

The name that identifies the step. This must be unique for each step with respect to all other steps in the Cloud Dataflow job.

Named properties associated with the step. Each kind of predefined step has its own required set of properties. Must be provided on Create. Only retrieved with JOB_VIEW_ALL.

Step

Whether to also send taskrunner log info to stderr.

The location on the worker for task-specific subdirectories.

The base URL for the taskrunner to use when accessing Google Cloud APIs. When workers access Google Cloud APIs, they logically do so via relative URLs. If this field is specified, it supplies the base URL to use for resolving these relative URLs. The normative algorithm used is defined by RFC 1808, "Relative Uniform Resource Locators". If not specified, the default value is "http://www.googleapis.com/"

The file to store preprocessing commands in.

Whether to continue taskrunner if an exception is hit.

The command to launch the worker harness.

Whether to send taskrunner log info to Google Compute Engine VM serial console.

Indicates where to put logs. If this is not specified, the logs will not be uploaded. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}

The OAuth2 scopes to be requested by the taskrunner in order to access the Cloud Dataflow API.

The settings to pass to the parallel worker harness.

The UNIX group ID on the worker VM to use for tasks launched by taskrunner; e.g. "wheel".

The UNIX user ID on the worker VM to use for tasks launched by taskrunner; e.g. "root".

The prefix of the resources the taskrunner should use for temporary storage. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}

TaskRunnerSettings

Description of the type, names/ids, and input/outputs for a transform.

SDK generated id of this transform instance.

User names for all collection inputs to this transform.

User provided name for this transform instance.

User names for all collection outputs to this transform.

TransformSummary

Describes one particular pool of Cloud Dataflow workers to be instantiated by the Cloud Dataflow service in order to perform the computations required by a job. Note that a workflow job may use multiple pools, in order to match the various computational requirements of the various stages of the job.

Mod: gcp-dataflow

Recommended Version

Resource Types

Controls

IAM Roles

Policies