Regulatory support in Firestore

This document describes the features, configurations and APIs in Firestore that align with the controls for supported control packages. This document assumes that you're using Assured Workloads.

Data Boundary for ITAR

Supported services

The following table lists the Firestore APIs and versions that meet the requirements of Data Boundary for ITAR.

Service Version Status
datastore.googleapis.com v1 SUPPORTED
datastore.googleapis.com v1beta1 SUPPORTED
datastore.googleapis.com v1beta3 SUPPORTED
firestore.googleapis.com v1 SUPPORTED
firestore.googleapis.com v1beta1 SUPPORTED
firestore.googleapis.com v1beta2 SUPPORTED

Compliance supported regions

Firestore is available for Data Boundary for ITAR in the following Google Cloud regions:

  • us-central1
  • us-east1
  • us-east4
  • us-east5
  • us-south1
  • us-west1
  • us-west2
  • us-west3
  • us-west4

API fields for sensitive data

Resource: firestore.googleapis.com/Document

The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.

API Method Protected fields

Service: firestore.googleapis.com

REST API: POST /v1/{parent=projects/*/databases/*/documents/**}/{collection_id}

RPC methods:

  • google.firestore.v1.Firestore.CreateDocument
  • document.fields.value

Service: firestore.googleapis.com

REST API: POST /v1/{database=projects/*/databases/*}/documents:commit

RPC methods:

  • google.firestore.v1.Firestore.Commit
  • writes.update.fields.value

Service: firestore.googleapis.com

REST API: POST /v1/{database=projects/*/databases/*}/documents:batchWrite

RPC methods:

  • google.firestore.v1.Firestore.BatchWrite
  • writes.update.fields.value

Resource: datastore.googleapis.com/Entity

The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.

API Method Protected fields

Service: datastore.googleapis.com

REST API: POST /v1/projects/{project_id}:commit

RPC methods:

  • google.datastore.v1.Datastore.Commit
  • mutations.insert.properties.value
  • mutations.update.properties.value
  • mutations.upsert.properties.value

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Database configuration
  • database.cmekConfig.kmsKeyName
  • database.etag
  • database.locationId
  • database.storagePlacement
  • encryptionConfig.customerManagedEncryption.kmsKeyName
  • pitrSnapshot.database
Document and entity specification
  • document.fields.key
  • document.fields.value.mapValue.fields.key
  • document.name
  • entityFilter.namespaceIds
  • structuredAggregationQuery.structuredQuery.from.collectionId
  • structuredQuery.from.collectionId
Index and field configuration
  • field.indexConfig.indexes.defaultCollation
  • field.indexConfig.indexes.fields.fieldPath
  • field.indexConfig.indexes.indexName
  • field.indexConfig.indexes.searchIndexOptions.textLanguageOverrideFieldPath
  • field.name
  • indexId
Key and path identification
  • keys.partitionId.databaseId
  • keys.partitionId.namespaceId
  • keys.partitionId.projectId
  • keys.path.kind
  • keys.path.name
Mutation operations
  • mutations.delete.path.name
  • mutations.insert.properties.key
  • mutations.propertyTransforms.increment.keyValue.path.kind
  • mutations.propertyTransforms.removeAllFromArray.values.keyValue.path.kind
  • mutations.update.key.path.name
  • mutations.upsert.key.path.name
Pagination and ordering
  • groupBy
  • orderBy
  • pageToken
  • structuredAggregationQuery.structuredQuery.orderBy.field.fieldPath
  • structuredQuery.orderBy.field.fieldPath
Project and database identification
  • collectionId
  • database
  • databaseId
  • name
  • parent
  • projectId
Query and filter parameters
  • aggregationQuery.nestedQuery.filter.propertyFilter.property.name
  • entityFilter.kinds
  • field.indexConfig.indexes.partialFilterExpression
  • field.indexConfig.indexes.searchIndexOptions.textLanguage
  • filter
  • gqlQuery.queryString
Request control and metadata
  • allocateIds.requestOptions.requestTags
  • commit.requestOptions.isolationKey
  • requestExtensions.typeUrl
  • requestOptions.isolationKey
  • requestOptions.requestTags
  • rollback.requestOptions.requestTags
Transformations and properties
  • mutations.propertyMask.paths
  • mutations.propertyTransforms.appendMissingElements.values.keyValue.path.kind
  • mutations.propertyTransforms.maximum.keyValue.path.kind
  • mutations.propertyTransforms.minimum.keyValue.path.kind
  • writes.transform.fieldTransforms.fieldPath
  • writes.updateTransforms.fieldPath

References

What's next