Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Cyral Provider
  3. API Docs
  4. RepositoryConfAnalysis
cyral 4.16.3 published on Monday, Apr 14, 2025 by cyralinc
cyralinc/terraform-provider-cyral

cyral.RepositoryConfAnalysis

Explore with Pulumi AI

cyral logo
cyral 4.16.3 published on Monday, Apr 14, 2025 by cyralinc
cyralinc/terraform-provider-cyral

    Manages Repository Analysis Configuration. This resource allows configuring Data Activity Logs, Alerts and Policy Enforcement settings for Data Repositories.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cyral from "@pulumi/cyral";

//## All Config enabled
const allConfAnalysisEnabled = new cyral.RepositoryConfAnalysis("allConfAnalysisEnabled", {
    repositoryId: cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.id,
    redact: "all",
    alertOnViolation: true,
    disablePreConfiguredAlerts: false,
    blockOnViolation: true,
    disableFilterAnalysis: false,
    enableDatasetRewrites: true,
    enableDataMasking: true,
    maskAllOccurrences: true,
    commentAnnotationGroups: ["identity"],
    logGroups: ["everything"],
});
//## All Config disabled
const allConfAnalysisDisabled = new cyral.RepositoryConfAnalysis("allConfAnalysisDisabled", {
    repositoryId: cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.id,
    redact: "none",
    alertOnViolation: false,
    disablePreConfiguredAlerts: true,
    blockOnViolation: false,
    disableFilterAnalysis: true,
    enableDatasetRewrites: false,
    enableDataMasking: false,
    maskAllOccurrences: false,
    commentAnnotationGroups: [],
    logGroups: [],
});

    import pulumi
import pulumi_cyral as cyral

### All Config enabled
all_conf_analysis_enabled = cyral.RepositoryConfAnalysis("allConfAnalysisEnabled",
    repository_id=cyral_repository["SOME_REPOSITORY_RESOURCE_NAME"]["id"],
    redact="all",
    alert_on_violation=True,
    disable_pre_configured_alerts=False,
    block_on_violation=True,
    disable_filter_analysis=False,
    enable_dataset_rewrites=True,
    enable_data_masking=True,
    mask_all_occurrences=True,
    comment_annotation_groups=["identity"],
    log_groups=["everything"])
### All Config disabled
all_conf_analysis_disabled = cyral.RepositoryConfAnalysis("allConfAnalysisDisabled",
    repository_id=cyral_repository["SOME_REPOSITORY_RESOURCE_NAME"]["id"],
    redact="none",
    alert_on_violation=False,
    disable_pre_configured_alerts=True,
    block_on_violation=False,
    disable_filter_analysis=True,
    enable_dataset_rewrites=False,
    enable_data_masking=False,
    mask_all_occurrences=False,
    comment_annotation_groups=[],
    log_groups=[])

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/cyral/v4/cyral"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// ## All Config enabled
		_, err := cyral.NewRepositoryConfAnalysis(ctx, "allConfAnalysisEnabled", &cyral.RepositoryConfAnalysisArgs{
			RepositoryId:               pulumi.Any(cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.Id),
			Redact:                     pulumi.String("all"),
			AlertOnViolation:           pulumi.Bool(true),
			DisablePreConfiguredAlerts: pulumi.Bool(false),
			BlockOnViolation:           pulumi.Bool(true),
			DisableFilterAnalysis:      pulumi.Bool(false),
			EnableDatasetRewrites:      pulumi.Bool(true),
			EnableDataMasking:          pulumi.Bool(true),
			MaskAllOccurrences:         pulumi.Bool(true),
			CommentAnnotationGroups: pulumi.StringArray{
				pulumi.String("identity"),
			},
			LogGroups: pulumi.StringArray{
				pulumi.String("everything"),
			},
		})
		if err != nil {
			return err
		}
		// ## All Config disabled
		_, err = cyral.NewRepositoryConfAnalysis(ctx, "allConfAnalysisDisabled", &cyral.RepositoryConfAnalysisArgs{
			RepositoryId:               pulumi.Any(cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.Id),
			Redact:                     pulumi.String("none"),
			AlertOnViolation:           pulumi.Bool(false),
			DisablePreConfiguredAlerts: pulumi.Bool(true),
			BlockOnViolation:           pulumi.Bool(false),
			DisableFilterAnalysis:      pulumi.Bool(true),
			EnableDatasetRewrites:      pulumi.Bool(false),
			EnableDataMasking:          pulumi.Bool(false),
			MaskAllOccurrences:         pulumi.Bool(false),
			CommentAnnotationGroups:    pulumi.StringArray{},
			LogGroups:                  pulumi.StringArray{},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cyral = Pulumi.Cyral;

return await Deployment.RunAsync(() => 
{
    //## All Config enabled
    var allConfAnalysisEnabled = new Cyral.RepositoryConfAnalysis("allConfAnalysisEnabled", new()
    {
        RepositoryId = cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.Id,
        Redact = "all",
        AlertOnViolation = true,
        DisablePreConfiguredAlerts = false,
        BlockOnViolation = true,
        DisableFilterAnalysis = false,
        EnableDatasetRewrites = true,
        EnableDataMasking = true,
        MaskAllOccurrences = true,
        CommentAnnotationGroups = new[]
        {
            "identity",
        },
        LogGroups = new[]
        {
            "everything",
        },
    });

    //## All Config disabled
    var allConfAnalysisDisabled = new Cyral.RepositoryConfAnalysis("allConfAnalysisDisabled", new()
    {
        RepositoryId = cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.Id,
        Redact = "none",
        AlertOnViolation = false,
        DisablePreConfiguredAlerts = true,
        BlockOnViolation = false,
        DisableFilterAnalysis = true,
        EnableDatasetRewrites = false,
        EnableDataMasking = false,
        MaskAllOccurrences = false,
        CommentAnnotationGroups = new[] {},
        LogGroups = new[] {},
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cyral.RepositoryConfAnalysis;
import com.pulumi.cyral.RepositoryConfAnalysisArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        //## All Config enabled
        var allConfAnalysisEnabled = new RepositoryConfAnalysis("allConfAnalysisEnabled", RepositoryConfAnalysisArgs.builder()
            .repositoryId(cyral_repository.SOME_REPOSITORY_RESOURCE_NAME().id())
            .redact("all")
            .alertOnViolation(true)
            .disablePreConfiguredAlerts(false)
            .blockOnViolation(true)
            .disableFilterAnalysis(false)
            .enableDatasetRewrites(true)
            .enableDataMasking(true)
            .maskAllOccurrences(true)
            .commentAnnotationGroups("identity")
            .logGroups("everything")
            .build());

        //## All Config disabled
        var allConfAnalysisDisabled = new RepositoryConfAnalysis("allConfAnalysisDisabled", RepositoryConfAnalysisArgs.builder()
            .repositoryId(cyral_repository.SOME_REPOSITORY_RESOURCE_NAME().id())
            .redact("none")
            .alertOnViolation(false)
            .disablePreConfiguredAlerts(true)
            .blockOnViolation(false)
            .disableFilterAnalysis(true)
            .enableDatasetRewrites(false)
            .enableDataMasking(false)
            .maskAllOccurrences(false)
            .commentAnnotationGroups()
            .logGroups()
            .build());

    }
}

    resources:
  ### All Config enabled
  allConfAnalysisEnabled:
    type: cyral:RepositoryConfAnalysis
    properties:
      repositoryId: ${cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.id}
      redact: all
      alertOnViolation: true
      disablePreConfiguredAlerts: false
      blockOnViolation: true
      disableFilterAnalysis: false
      enableDatasetRewrites: true
      enableDataMasking: true
      maskAllOccurrences: true
      commentAnnotationGroups:
        - identity
      logGroups:
        - everything
  ### All Config disabled
  allConfAnalysisDisabled:
    type: cyral:RepositoryConfAnalysis
    properties:
      repositoryId: ${cyral_repository.SOME_REPOSITORY_RESOURCE_NAME.id}
      redact: none
      alertOnViolation: false
      disablePreConfiguredAlerts: true
      blockOnViolation: false
      disableFilterAnalysis: true
      enableDatasetRewrites: false
      enableDataMasking: false
      maskAllOccurrences: false
      commentAnnotationGroups: []
      logGroups: []

    Create RepositoryConfAnalysis Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RepositoryConfAnalysis(name: string, args: RepositoryConfAnalysisArgs, opts?: CustomResourceOptions);
    @overload
def RepositoryConfAnalysis(resource_name: str,
                           args: RepositoryConfAnalysisArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def RepositoryConfAnalysis(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           repository_id: Optional[str] = None,
                           alert_on_violation: Optional[bool] = None,
                           block_on_violation: Optional[bool] = None,
                           comment_annotation_groups: Optional[Sequence[str]] = None,
                           disable_filter_analysis: Optional[bool] = None,
                           disable_pre_configured_alerts: Optional[bool] = None,
                           enable_data_masking: Optional[bool] = None,
                           enable_dataset_rewrites: Optional[bool] = None,
                           log_groups: Optional[Sequence[str]] = None,
                           mask_all_occurrences: Optional[bool] = None,
                           redact: Optional[str] = None)
    func NewRepositoryConfAnalysis(ctx *Context, name string, args RepositoryConfAnalysisArgs, opts ...ResourceOption) (*RepositoryConfAnalysis, error)
    public RepositoryConfAnalysis(string name, RepositoryConfAnalysisArgs args, CustomResourceOptions? opts = null)
    public RepositoryConfAnalysis(String name, RepositoryConfAnalysisArgs args)
public RepositoryConfAnalysis(String name, RepositoryConfAnalysisArgs args, CustomResourceOptions options)

    type: cyral:RepositoryConfAnalysis
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args RepositoryConfAnalysisArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RepositoryConfAnalysisArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RepositoryConfAnalysisArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RepositoryConfAnalysisArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RepositoryConfAnalysisArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var repositoryConfAnalysisResource = new Cyral.RepositoryConfAnalysis("repositoryConfAnalysisResource", new()
{
    RepositoryId = "string",
    AlertOnViolation = false,
    BlockOnViolation = false,
    CommentAnnotationGroups = new[]
    {
        "string",
    },
    DisableFilterAnalysis = false,
    DisablePreConfiguredAlerts = false,
    EnableDataMasking = false,
    EnableDatasetRewrites = false,
    LogGroups = new[]
    {
        "string",
    },
    MaskAllOccurrences = false,
    Redact = "string",
});

    example, err := cyral.NewRepositoryConfAnalysis(ctx, "repositoryConfAnalysisResource", &cyral.RepositoryConfAnalysisArgs{
	RepositoryId:     pulumi.String("string"),
	AlertOnViolation: pulumi.Bool(false),
	BlockOnViolation: pulumi.Bool(false),
	CommentAnnotationGroups: pulumi.StringArray{
		pulumi.String("string"),
	},
	DisableFilterAnalysis:      pulumi.Bool(false),
	DisablePreConfiguredAlerts: pulumi.Bool(false),
	EnableDataMasking:          pulumi.Bool(false),
	EnableDatasetRewrites:      pulumi.Bool(false),
	LogGroups: pulumi.StringArray{
		pulumi.String("string"),
	},
	MaskAllOccurrences: pulumi.Bool(false),
	Redact:             pulumi.String("string"),
})

    var repositoryConfAnalysisResource = new RepositoryConfAnalysis("repositoryConfAnalysisResource", RepositoryConfAnalysisArgs.builder()
    .repositoryId("string")
    .alertOnViolation(false)
    .blockOnViolation(false)
    .commentAnnotationGroups("string")
    .disableFilterAnalysis(false)
    .disablePreConfiguredAlerts(false)
    .enableDataMasking(false)
    .enableDatasetRewrites(false)
    .logGroups("string")
    .maskAllOccurrences(false)
    .redact("string")
    .build());

    repository_conf_analysis_resource = cyral.RepositoryConfAnalysis("repositoryConfAnalysisResource",
    repository_id="string",
    alert_on_violation=False,
    block_on_violation=False,
    comment_annotation_groups=["string"],
    disable_filter_analysis=False,
    disable_pre_configured_alerts=False,
    enable_data_masking=False,
    enable_dataset_rewrites=False,
    log_groups=["string"],
    mask_all_occurrences=False,
    redact="string")

    const repositoryConfAnalysisResource = new cyral.RepositoryConfAnalysis("repositoryConfAnalysisResource", {
    repositoryId: "string",
    alertOnViolation: false,
    blockOnViolation: false,
    commentAnnotationGroups: ["string"],
    disableFilterAnalysis: false,
    disablePreConfiguredAlerts: false,
    enableDataMasking: false,
    enableDatasetRewrites: false,
    logGroups: ["string"],
    maskAllOccurrences: false,
    redact: "string",
});

    type: cyral:RepositoryConfAnalysis
properties:
    alertOnViolation: false
    blockOnViolation: false
    commentAnnotationGroups:
        - string
    disableFilterAnalysis: false
    disablePreConfiguredAlerts: false
    enableDataMasking: false
    enableDatasetRewrites: false
    logGroups:
        - string
    maskAllOccurrences: false
    redact: string
    repositoryId: string

    RepositoryConfAnalysis Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The RepositoryConfAnalysis resource accepts the following input properties:

    RepositoryId string
    The ID of an existing data repository resource that will be configured.
    AlertOnViolation bool
    If set to true it will enable alert on policy violations.
    BlockOnViolation bool
    If set to true it will enable query blocking in case of a policy violation.
    CommentAnnotationGroups List<string>
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    DisableFilterAnalysis bool
    If set to true it will disable filter analysis.
    DisablePreConfiguredAlerts bool
    If set to true it will disable preconfigured alerts.
    EnableDataMasking bool
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    EnableDatasetRewrites bool
    If set to true it will enable rewriting queries.
    LogGroups List<string>
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    MaskAllOccurrences bool
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    Redact string
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    RepositoryId string
    The ID of an existing data repository resource that will be configured.
    AlertOnViolation bool
    If set to true it will enable alert on policy violations.
    BlockOnViolation bool
    If set to true it will enable query blocking in case of a policy violation.
    CommentAnnotationGroups []string
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    DisableFilterAnalysis bool
    If set to true it will disable filter analysis.
    DisablePreConfiguredAlerts bool
    If set to true it will disable preconfigured alerts.
    EnableDataMasking bool
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    EnableDatasetRewrites bool
    If set to true it will enable rewriting queries.
    LogGroups []string
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    MaskAllOccurrences bool
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    Redact string
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repositoryId String
    The ID of an existing data repository resource that will be configured.
    alertOnViolation Boolean
    If set to true it will enable alert on policy violations.
    blockOnViolation Boolean
    If set to true it will enable query blocking in case of a policy violation.
    commentAnnotationGroups List<String>
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disableFilterAnalysis Boolean
    If set to true it will disable filter analysis.
    disablePreConfiguredAlerts Boolean
    If set to true it will disable preconfigured alerts.
    enableDataMasking Boolean
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enableDatasetRewrites Boolean
    If set to true it will enable rewriting queries.
    logGroups List<String>
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    maskAllOccurrences Boolean
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact String
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repositoryId string
    The ID of an existing data repository resource that will be configured.
    alertOnViolation boolean
    If set to true it will enable alert on policy violations.
    blockOnViolation boolean
    If set to true it will enable query blocking in case of a policy violation.
    commentAnnotationGroups string[]
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disableFilterAnalysis boolean
    If set to true it will disable filter analysis.
    disablePreConfiguredAlerts boolean
    If set to true it will disable preconfigured alerts.
    enableDataMasking boolean
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enableDatasetRewrites boolean
    If set to true it will enable rewriting queries.
    logGroups string[]
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    maskAllOccurrences boolean
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact string
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repository_id str
    The ID of an existing data repository resource that will be configured.
    alert_on_violation bool
    If set to true it will enable alert on policy violations.
    block_on_violation bool
    If set to true it will enable query blocking in case of a policy violation.
    comment_annotation_groups Sequence[str]
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disable_filter_analysis bool
    If set to true it will disable filter analysis.
    disable_pre_configured_alerts bool
    If set to true it will disable preconfigured alerts.
    enable_data_masking bool
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enable_dataset_rewrites bool
    If set to true it will enable rewriting queries.
    log_groups Sequence[str]
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    mask_all_occurrences bool
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact str
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repositoryId String
    The ID of an existing data repository resource that will be configured.
    alertOnViolation Boolean
    If set to true it will enable alert on policy violations.
    blockOnViolation Boolean
    If set to true it will enable query blocking in case of a policy violation.
    commentAnnotationGroups List<String>
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disableFilterAnalysis Boolean
    If set to true it will disable filter analysis.
    disablePreConfiguredAlerts Boolean
    If set to true it will disable preconfigured alerts.
    enableDataMasking Boolean
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enableDatasetRewrites Boolean
    If set to true it will enable rewriting queries.
    logGroups List<String>
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    maskAllOccurrences Boolean
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact String
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RepositoryConfAnalysis resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing RepositoryConfAnalysis Resource

    Get an existing RepositoryConfAnalysis resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RepositoryConfAnalysisState, opts?: CustomResourceOptions): RepositoryConfAnalysis
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alert_on_violation: Optional[bool] = None,
        block_on_violation: Optional[bool] = None,
        comment_annotation_groups: Optional[Sequence[str]] = None,
        disable_filter_analysis: Optional[bool] = None,
        disable_pre_configured_alerts: Optional[bool] = None,
        enable_data_masking: Optional[bool] = None,
        enable_dataset_rewrites: Optional[bool] = None,
        log_groups: Optional[Sequence[str]] = None,
        mask_all_occurrences: Optional[bool] = None,
        redact: Optional[str] = None,
        repository_id: Optional[str] = None) -> RepositoryConfAnalysis
    func GetRepositoryConfAnalysis(ctx *Context, name string, id IDInput, state *RepositoryConfAnalysisState, opts ...ResourceOption) (*RepositoryConfAnalysis, error)
    public static RepositoryConfAnalysis Get(string name, Input<string> id, RepositoryConfAnalysisState? state, CustomResourceOptions? opts = null)
    public static RepositoryConfAnalysis get(String name, Output<String> id, RepositoryConfAnalysisState state, CustomResourceOptions options)
    resources:  _:    type: cyral:RepositoryConfAnalysis    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AlertOnViolation bool
    If set to true it will enable alert on policy violations.
    BlockOnViolation bool
    If set to true it will enable query blocking in case of a policy violation.
    CommentAnnotationGroups List<string>
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    DisableFilterAnalysis bool
    If set to true it will disable filter analysis.
    DisablePreConfiguredAlerts bool
    If set to true it will disable preconfigured alerts.
    EnableDataMasking bool
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    EnableDatasetRewrites bool
    If set to true it will enable rewriting queries.
    LogGroups List<string>
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    MaskAllOccurrences bool
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    Redact string
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    RepositoryId string
    The ID of an existing data repository resource that will be configured.
    AlertOnViolation bool
    If set to true it will enable alert on policy violations.
    BlockOnViolation bool
    If set to true it will enable query blocking in case of a policy violation.
    CommentAnnotationGroups []string
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    DisableFilterAnalysis bool
    If set to true it will disable filter analysis.
    DisablePreConfiguredAlerts bool
    If set to true it will disable preconfigured alerts.
    EnableDataMasking bool
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    EnableDatasetRewrites bool
    If set to true it will enable rewriting queries.
    LogGroups []string
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    MaskAllOccurrences bool
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    Redact string
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    RepositoryId string
    The ID of an existing data repository resource that will be configured.
    alertOnViolation Boolean
    If set to true it will enable alert on policy violations.
    blockOnViolation Boolean
    If set to true it will enable query blocking in case of a policy violation.
    commentAnnotationGroups List<String>
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disableFilterAnalysis Boolean
    If set to true it will disable filter analysis.
    disablePreConfiguredAlerts Boolean
    If set to true it will disable preconfigured alerts.
    enableDataMasking Boolean
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enableDatasetRewrites Boolean
    If set to true it will enable rewriting queries.
    logGroups List<String>
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    maskAllOccurrences Boolean
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact String
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repositoryId String
    The ID of an existing data repository resource that will be configured.
    alertOnViolation boolean
    If set to true it will enable alert on policy violations.
    blockOnViolation boolean
    If set to true it will enable query blocking in case of a policy violation.
    commentAnnotationGroups string[]
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disableFilterAnalysis boolean
    If set to true it will disable filter analysis.
    disablePreConfiguredAlerts boolean
    If set to true it will disable preconfigured alerts.
    enableDataMasking boolean
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enableDatasetRewrites boolean
    If set to true it will enable rewriting queries.
    logGroups string[]
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    maskAllOccurrences boolean
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact string
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repositoryId string
    The ID of an existing data repository resource that will be configured.
    alert_on_violation bool
    If set to true it will enable alert on policy violations.
    block_on_violation bool
    If set to true it will enable query blocking in case of a policy violation.
    comment_annotation_groups Sequence[str]
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disable_filter_analysis bool
    If set to true it will disable filter analysis.
    disable_pre_configured_alerts bool
    If set to true it will disable preconfigured alerts.
    enable_data_masking bool
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enable_dataset_rewrites bool
    If set to true it will enable rewriting queries.
    log_groups Sequence[str]
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    mask_all_occurrences bool
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact str
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repository_id str
    The ID of an existing data repository resource that will be configured.
    alertOnViolation Boolean
    If set to true it will enable alert on policy violations.
    blockOnViolation Boolean
    If set to true it will enable query blocking in case of a policy violation.
    commentAnnotationGroups List<String>
    Valid values are: identity, client, repo, sidecar. The default behavior is to set only the identity when this option is enabled, but you can also opt to add the contents of client, repo, sidecar logging blocks as query comments. Learn more.
    disableFilterAnalysis Boolean
    If set to true it will disable filter analysis.
    disablePreConfiguredAlerts Boolean
    If set to true it will disable preconfigured alerts.
    enableDataMasking Boolean
    If set to true it will allow policies to force the masking of specified data fields in the results of queries. Learn more.
    enableDatasetRewrites Boolean
    If set to true it will enable rewriting queries.
    logGroups List<String>
    Responsible for configuring the Log Settings. Valid values are documented below. The log_groups list support the following values: - everything - Enables all the Log Settings. - dql - Enables the DQLs setting for all requests. - dml - Enables the DMLs setting for all requests. - ddl - Enables the DDLs setting for all requests. - sensitive & dql - Enables the DQLs setting for logged fields. - sensitive & dml - Enables the DMLs setting for logged fields. - sensitive & ddl - Enables the DDLs setting for logged fields. - privileged

    • Enables the Privileged commands setting. - port-scan - Enables the Port scans setting. - auth-failure - Enables the Authentication failures setting. - full-table-scan - Enables the Full scans setting. - violations - Enables the Policy violations setting. - connections - Enables the Connection activity setting. - sensitive - Log all queries manipulating sensitive fields (watches) - data-classification - Log all queries whose response was automatically classified as sensitive (credit card numbers, emails and so on). - audit - Log sensitive, DQLs, DDLs, DMLs and privileged. - error - Log analysis errors. - new-connections - Log new connections. - closed-connections - Log closed connections.
    maskAllOccurrences Boolean
    If set to true it will also mask filtering conditions like in WHERE, HAVING or ON clauses. Note: Enabling this may cause some performance degradation on large tables. It is required to set enable_data_masking=true to use this feature.
    redact String
    Valid values are: all, none and watched. If set to all it will enable the redact of all literal values, none will disable it, and watched will only redact values from tracked fields set in the Datamap.
    repositoryId String
    The ID of an existing data repository resource that will be configured.

    Package Details

    Repository
    cyral cyralinc/terraform-provider-cyral
    License
    Notes
    This Pulumi package is based on the cyral Terraform Provider.
    cyral logo
    cyral 4.16.3 published on Monday, Apr 14, 2025 by cyralinc
    cyralinc/terraform-provider-cyral