Regulatory support in AlloyDB for PostgreSQL

This document describes the features, configurations and APIs in AlloyDB for PostgreSQL that align with the controls for supported control packages. This document assumes that you're using Assured Workloads.

Data Boundary for ITAR

Supported services

The following table lists the AlloyDB for PostgreSQL APIs and versions that meet the requirements of Data Boundary for ITAR.

Service Version Status
alloydb.googleapis.com v1 SUPPORTED
alloydb.googleapis.com v1alpha SUPPORTED
alloydb.googleapis.com v1beta SUPPORTED

Compliance supported regions

AlloyDB for PostgreSQL is available for Data Boundary for ITAR in the following Google Cloud regions:

  • us-central1
  • us-east1
  • us-east4
  • us-east5
  • us-south1
  • us-west1
  • us-west2
  • us-west3
  • us-west4

API fields for sensitive data

Resource: alloydb.googleapis.com/Cluster

The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.

API Method Protected fields

Service: alloydb.googleapis.com

REST API: PATCH /v1/{cluster.name=projects/*/locations/*/clusters/*}

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.UpdateCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: PATCH /v1alpha/{cluster.name=projects/*/locations/*/clusters/*}

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.UpdateCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: PATCH /v1beta/{cluster.name=projects/*/locations/*/clusters/*}

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.UpdateCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1/{name=projects/*/locations/*/clusters/*}:import

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.ImportCluster
  • password

Service: alloydb.googleapis.com

REST API: POST /v1/{parent=projects/*/locations/*}/clusters

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.CreateCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1/{parent=projects/*/locations/*}/clusters:createsecondary

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.CreateSecondaryCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1/{parent=projects/*/locations/*}/clusters:restore

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.RestoreCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1/{parent=projects/*/locations/*}/clusters:restoreFromCloudSQL

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBCSQLAdmin.RestoreFromCloudSQL
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{name=projects/*/locations/*/clusters/*}:import

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.ImportCluster
  • password

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{parent=projects/*/locations/*}/clusters

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.CreateCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{parent=projects/*/locations/*}/clusters:createsecondary

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.CreateSecondaryCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{parent=projects/*/locations/*}/clusters:restore

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.RestoreCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{parent=projects/*/locations/*}/clusters:restoreFromCloudSQL

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBCSQLAdmin.RestoreFromCloudSQL
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1beta/{name=projects/*/locations/*/clusters/*}:import

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.ImportCluster
  • password

Service: alloydb.googleapis.com

REST API: POST /v1beta/{parent=projects/*/locations/*}/clusters

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.CreateCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1beta/{parent=projects/*/locations/*}/clusters:createsecondary

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.CreateSecondaryCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1beta/{parent=projects/*/locations/*}/clusters:restore

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.RestoreCluster
  • cluster.initialUser.password
  • cluster.initialUser.user

Service: alloydb.googleapis.com

REST API: POST /v1beta/{parent=projects/*/locations/*}/clusters:restoreFromCloudSQL

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBCSQLAdmin.RestoreFromCloudSQL
  • cluster.initialUser.password
  • cluster.initialUser.user

Resource: alloydb.googleapis.com/Instance

The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.

API Method Protected fields

Service: alloydb.googleapis.com

REST API: POST /v1/{instance=projects/*/locations/*/clusters/*/instances/*}:executeSql

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.ExecuteSql
  • password
  • sqlStatement

Service: alloydb.googleapis.com

REST API: POST /v1/{instance=projects/*/locations/*/clusters/*/instances/*}:executeSqlReadOnly

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.ExecuteSqlReadOnly
  • password
  • sqlStatement

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{instance=projects/*/locations/*/clusters/*/instances/*}:executeSql

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.ExecuteSql
  • password
  • sqlStatement

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{instance=projects/*/locations/*/clusters/*/instances/*}:executeSqlReadOnly

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.ExecuteSqlReadOnly
  • password
  • sqlStatement

Service: alloydb.googleapis.com

REST API: POST /v1beta/{instance=projects/*/locations/*/clusters/*/instances/*}:executeSql

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.ExecuteSql
  • password
  • sqlStatement

Service: alloydb.googleapis.com

REST API: POST /v1beta/{instance=projects/*/locations/*/clusters/*/instances/*}:executeSqlReadOnly

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.ExecuteSqlReadOnly
  • password
  • sqlStatement

Resource: alloydb.googleapis.com/User

The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.

API Method Protected fields

Service: alloydb.googleapis.com

REST API: PATCH /v1/{user.name=projects/*/locations/*/clusters/*/users/*}

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.UpdateUser
  • user.password

Service: alloydb.googleapis.com

REST API: PATCH /v1alpha/{user.name=projects/*/locations/*/clusters/*/users/*}

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.UpdateUser
  • user.password

Service: alloydb.googleapis.com

REST API: PATCH /v1beta/{user.name=projects/*/locations/*/clusters/*/users/*}

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.UpdateUser
  • user.password

Service: alloydb.googleapis.com

REST API: POST /v1/{parent=projects/*/locations/*/clusters/*}/users

RPC methods:

  • google.cloud.alloydb.v1.AlloyDBAdmin.CreateUser
  • user.password

Service: alloydb.googleapis.com

REST API: POST /v1alpha/{parent=projects/*/locations/*/clusters/*}/users

RPC methods:

  • google.cloud.alloydb.v1alpha.AlloyDBAdmin.CreateUser
  • user.password

Service: alloydb.googleapis.com

REST API: POST /v1beta/{parent=projects/*/locations/*/clusters/*}/users

RPC methods:

  • google.cloud.alloydb.v1beta.AlloyDBAdmin.CreateUser
  • user.password

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and credentials
  • cloudSqlSource.authConfig.usernamePassword.username
  • pemCsr
  • publicKey
Backup configuration
  • backup.clusterName
  • backup.description
  • backup.displayName
  • backup.encryptionConfig.kmsKeyName
  • backup.tags.key
  • backup.tags.value
Cluster configuration
  • cluster.automatedBackupPolicy.location
  • cluster.displayName
  • cluster.encryptionConfig.kmsKeyName
  • cluster.maintenanceVersionName
  • cluster.networkConfig.network
  • cluster.tags.key
Data export options
  • csvExportOptions.escapeCharacter
  • csvExportOptions.fieldDelimiter
  • csvExportOptions.quoteCharacter
  • csvExportOptions.selectQuery
  • gcsDestination.uri
  • sqlExportOptions.tables
Data import options
  • csvImportOptions.columns
  • csvImportOptions.escapeCharacter
  • csvImportOptions.fieldDelimiter
  • csvImportOptions.quoteCharacter
  • csvImportOptions.table
  • gcsUri
Filtering and ordering
  • filter
  • orderBy
  • pageToken
Instance configuration
  • instance.connectionPoolConfig.userFlags.users
  • instance.databaseFlags.key
  • instance.displayName
  • instance.labels.value
  • instance.machineConfig.machineType
  • instance.networkConfig.allocatedIpRangeOverride
Location and scope
  • database
  • instance
  • location
  • parent
  • user
Request metadata
  • backup.etag
  • cluster.etag
  • endpoint.etag
  • etag
  • instance.etag
  • requestId
Resource identification
  • backupId
  • clusterId
  • databaseId
  • endpointId
  • instanceId
  • name

What's next