googleapis/google/cloud/databasecenter/v1beta/signals.proto

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.databasecenter.v1beta;

import "google/api/field_behavior.proto";
import "google/cloud/databasecenter/v1beta/maintenance.proto";
import "google/cloud/databasecenter/v1beta/operation_error_type.proto";
import "google/cloud/databasecenter/v1beta/product.proto";
import "google/cloud/databasecenter/v1beta/suspension_reason.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";

option csharp_namespace = "Google.Cloud.DatabaseCenter.V1Beta";
option go_package = "cloud.google.com/go/databasecenter/apiv1beta/databasecenterpb;databasecenterpb";
option java_multiple_files = true;
option java_outer_classname = "SignalsProto";
option java_package = "com.google.cloud.databasecenter.v1beta";
option php_namespace = "Google\\Cloud\\DatabaseCenter\\V1beta";
option ruby_package = "Google::Cloud::DatabaseCenter::V1beta";

// Represents the state of a signal. More enum values are expected to be added
// as needed.
enum SignalStatus {
  // Unspecified.
  SIGNAL_STATUS_UNSPECIFIED = 0;

  // Signal is not applicable to the resource.
  SIGNAL_STATUS_NOT_APPLICABLE = 1;

  // Signal is not an issue.
  SIGNAL_STATUS_OK = 2;

  // Signal is an issue.
  SIGNAL_STATUS_ISSUE = 3;

  // Signal is not enabled for the resource.
  SIGNAL_STATUS_NOT_ENABLED = 4;
}

// Represents the source system from where a signal comes from.
// More enum values are expected to be added as needed.
enum SignalSource {
  // Unspecified.
  SIGNAL_SOURCE_UNSPECIFIED = 0;

  // Signal comes from resource metadata.
  SIGNAL_SOURCE_RESOURCE_METADATA = 1;

  // Signal comes from SCC findings.
  SIGNAL_SOURCE_SECURITY_FINDINGS = 2;

  // Signal comes from recommender hub.
  SIGNAL_SOURCE_RECOMMENDER = 3;

  // Signal comes from modern observability platform.
  SIGNAL_SOURCE_MODERN_OBSERVABILITY = 4;
}

// IssueSeverity represents the severity of an issue.
enum IssueSeverity {
  // Unspecified.
  ISSUE_SEVERITY_UNSPECIFIED = 0;

  // Low severity.
  ISSUE_SEVERITY_LOW = 1;

  // Medium severity.
  ISSUE_SEVERITY_MEDIUM = 2;

  // High severity.
  ISSUE_SEVERITY_HIGH = 3;

  // Critical severity.
  ISSUE_SEVERITY_CRITICAL = 4;

  // Irrelevant severity. This means the issue should not be surfaced at all.
  ISSUE_SEVERITY_IRRELEVANT = 5;
}

// Represents the type of a signal. More values are expected to be added
// as needed.
enum SignalType {
  // Unspecified.
  SIGNAL_TYPE_UNSPECIFIED = 0;

  // Represents if a resource is protected by automatic failover.
  // Checks for resources that are configured to have redundancy
  // within a region that enables automatic failover.
  SIGNAL_TYPE_RESOURCE_FAILOVER_PROTECTED = 1;

  // Represents if a group is replicating across regions.
  // Checks for resources that are configured to have redundancy,
  // and ongoing replication, across regions.
  SIGNAL_TYPE_GROUP_MULTIREGIONAL = 2;

  // Represents if a resource has an automated backup policy.
  SIGNAL_TYPE_NO_AUTOMATED_BACKUP_POLICY = 4;

  // Represents if a resources has a short backup retention period.
  SIGNAL_TYPE_SHORT_BACKUP_RETENTION = 5;

  // Represents if the last backup of a resource failed.
  SIGNAL_TYPE_LAST_BACKUP_FAILED = 6;

  // Represents if the last backup of a resource is older than some threshold
  // value.
  SIGNAL_TYPE_LAST_BACKUP_OLD = 7;

  // Represents if a resource violates CIS Google Cloud Platform Foundation 2.0.
  SIGNAL_TYPE_VIOLATES_CIS_GCP_FOUNDATION_2_0 = 8;

  // Represents if a resource violates CIS Google Cloud Platform Foundation 1.3.
  SIGNAL_TYPE_VIOLATES_CIS_GCP_FOUNDATION_1_3 = 9;

  // Represents if a resource violates CIS Google Cloud Platform Foundation 1.2.
  SIGNAL_TYPE_VIOLATES_CIS_GCP_FOUNDATION_1_2 = 10;

  // Represents if a resource violates CIS Google Cloud Platform Foundation 1.1.
  SIGNAL_TYPE_VIOLATES_CIS_GCP_FOUNDATION_1_1 = 11;

  // Represents if a resource violates CIS Google Cloud Platform Foundation 1.0.
  SIGNAL_TYPE_VIOLATES_CIS_GCP_FOUNDATION_1_0 = 12;

  // Represents if a resource violates CIS Controls 8.0.
  SIGNAL_TYPE_VIOLATES_CIS_CONTROLS_V8_0 = 76;

  // Represents if a resource violates NIST 800-53.
  SIGNAL_TYPE_VIOLATES_NIST_800_53 = 13;

  // Represents if a resource violates NIST 800-53 R5.
  SIGNAL_TYPE_VIOLATES_NIST_800_53_R5 = 69;

  // Represents if a resource violates NIST Cybersecurity Framework 1.0.
  SIGNAL_TYPE_VIOLATES_NIST_CYBERSECURITY_FRAMEWORK_V1_0 = 72;

  // Represents if a resource violates ISO-27001.
  SIGNAL_TYPE_VIOLATES_ISO_27001 = 14;

  // Represents if a resource violates ISO 27001 2022.
  SIGNAL_TYPE_VIOLATES_ISO_27001_V2022 = 70;

  // Represents if a resource violates PCI-DSS v3.2.1.
  SIGNAL_TYPE_VIOLATES_PCI_DSS_V3_2_1 = 15;

  // Represents if a resource violates PCI-DSS v4.0.
  SIGNAL_TYPE_VIOLATES_PCI_DSS_V4_0 = 71;

  // Represents if a resource violates Cloud Controls Matrix v4.0.
  SIGNAL_TYPE_VIOLATES_CLOUD_CONTROLS_MATRIX_V4 = 73;

  // Represents if a resource violates HIPAA.
  SIGNAL_TYPE_VIOLATES_HIPAA = 74;

  // Represents if a resource violates SOC2 v2017.
  SIGNAL_TYPE_VIOLATES_SOC2_V2017 = 75;

  // Represents if log_checkpoints database flag for a Cloud SQL for PostgreSQL
  // instance is not set to on.
  SIGNAL_TYPE_LOGS_NOT_OPTIMIZED_FOR_TROUBLESHOOTING = 16;

  // Represents if the log_duration database flag for a Cloud SQL for PostgreSQL
  // instance is not set to on.
  SIGNAL_TYPE_QUERY_DURATIONS_NOT_LOGGED = 17;

  // Represents if the log_error_verbosity database flag for a Cloud SQL for
  // PostgreSQL instance is not set to default or stricter (default or terse).
  SIGNAL_TYPE_VERBOSE_ERROR_LOGGING = 18;

  // Represents if the log_lock_waits database flag for a Cloud SQL for
  // PostgreSQL instance is not set to on.
  SIGNAL_TYPE_QUERY_LOCK_WAITS_NOT_LOGGED = 19;

  // Represents if the log_min_error_statement database flag for a Cloud SQL
  // for PostgreSQL instance is not set appropriately.
  SIGNAL_TYPE_LOGGING_MOST_ERRORS = 20;

  // Represents if the log_min_error_statement database flag for a Cloud SQL
  // for PostgreSQL instance does not have an appropriate severity level.
  SIGNAL_TYPE_LOGGING_ONLY_CRITICAL_ERRORS = 21;

  // Represents if the log_min_messages database flag for a Cloud SQL for
  // PostgreSQL instance is not set to warning or another recommended value.
  SIGNAL_TYPE_MINIMAL_ERROR_LOGGING = 22;

  // Represents if the databaseFlags property of instance metadata for
  // the log_executor_status field is set to on.
  SIGNAL_TYPE_QUERY_STATS_LOGGED = 23;

  // Represents if the log_hostname database flag for a Cloud SQL for
  // PostgreSQL instance is not set to off.
  SIGNAL_TYPE_EXCESSIVE_LOGGING_OF_CLIENT_HOSTNAME = 24;

  // Represents if the log_parser_stats database flag for a Cloud SQL for
  // PostgreSQL instance is not set to off.
  SIGNAL_TYPE_EXCESSIVE_LOGGING_OF_PARSER_STATS = 25;

  // Represents if the log_planner_stats database flag for a Cloud SQL for
  // PostgreSQL instance is not set to off.
  SIGNAL_TYPE_EXCESSIVE_LOGGING_OF_PLANNER_STATS = 26;

  // Represents if the log_statement database flag for a Cloud SQL for
  // PostgreSQL instance is not set to DDL (all data definition statements).
  SIGNAL_TYPE_NOT_LOGGING_ONLY_DDL_STATEMENTS = 27;

  // Represents if the log_statement_stats database flag for a Cloud SQL for
  // PostgreSQL instance is not set to off.
  SIGNAL_TYPE_LOGGING_QUERY_STATS = 28;

  // Represents if the log_temp_files database flag for a Cloud SQL for
  // PostgreSQL instance is not set to "0". (NOTE: 0 = ON)
  SIGNAL_TYPE_NOT_LOGGING_TEMPORARY_FILES = 29;

  // Represents if the user connections database flag for a Cloud SQL for SQL
  // Server instance is configured.
  SIGNAL_TYPE_CONNECTION_MAX_NOT_CONFIGURED = 30;

  // Represents if the user options database flag for Cloud SQL SQL Server
  // instance is configured or not.
  SIGNAL_TYPE_USER_OPTIONS_CONFIGURED = 31;

  // Represents if a resource is exposed to public access.
  SIGNAL_TYPE_EXPOSED_TO_PUBLIC_ACCESS = 32;

  // Represents if a resources requires all incoming connections to use SSL
  // or not.
  SIGNAL_TYPE_UNENCRYPTED_CONNECTIONS = 33;

  // Represents if a Cloud SQL database has a password configured for the
  // root account or not.
  SIGNAL_TYPE_NO_ROOT_PASSWORD = 34;

  // Represents if a Cloud SQL database has a weak password configured for the
  // root account.
  SIGNAL_TYPE_WEAK_ROOT_PASSWORD = 35;

  // Represents if a SQL database instance is not encrypted with
  // customer-managed encryption keys (CMEK).
  SIGNAL_TYPE_ENCRYPTION_KEY_NOT_CUSTOMER_MANAGED = 36;

  // Represents if The contained database authentication database flag for a
  // Cloud SQL for SQL Server instance is not set to off.
  SIGNAL_TYPE_SERVER_AUTHENTICATION_NOT_REQUIRED = 37;

  // Represents if he external scripts enabled database flag for a Cloud SQL
  // for SQL Server instance is not set to off.
  SIGNAL_TYPE_EXPOSED_TO_EXTERNAL_SCRIPTS = 39;

  // Represents if the local_infile database flag for a Cloud SQL for MySQL
  // instance is not set to off.
  SIGNAL_TYPE_EXPOSED_TO_LOCAL_DATA_LOADS = 40;

  // Represents if the log_connections database flag for a Cloud SQL for
  // PostgreSQL instance is not set to on.
  SIGNAL_TYPE_CONNECTION_ATTEMPTS_NOT_LOGGED = 41;

  // Represents if the log_disconnections database flag for a Cloud SQL for
  // PostgreSQL instance is not set to on.
  SIGNAL_TYPE_DISCONNECTIONS_NOT_LOGGED = 42;

  // Represents if the log_min_duration_statement database flag for a Cloud SQL
  // for PostgreSQL instance is not set to -1.
  SIGNAL_TYPE_LOGGING_EXCESSIVE_STATEMENT_INFO = 43;

  // Represents if the remote access database flag for a Cloud SQL for SQL
  // Server instance is not set to off.
  SIGNAL_TYPE_EXPOSED_TO_REMOTE_ACCESS = 44;

  // Represents if the skip_show_database database flag for a Cloud SQL for
  // MySQL instance is not set to on.
  SIGNAL_TYPE_DATABASE_NAMES_EXPOSED = 45;

  // Represents if the 3625 (trace flag) database flag for a Cloud SQL for
  // SQL Server instance is not set to on.
  SIGNAL_TYPE_SENSITIVE_TRACE_INFO_NOT_MASKED = 46;

  // Represents if public IP is enabled.
  SIGNAL_TYPE_PUBLIC_IP_ENABLED = 47;

  // Represents idle instance helps to reduce costs.
  SIGNAL_TYPE_IDLE = 48;

  // Represents instances that are unnecessarily large for given workload.
  SIGNAL_TYPE_OVERPROVISIONED = 49;

  // Represents high number of concurrently opened tables.
  SIGNAL_TYPE_HIGH_NUMBER_OF_OPEN_TABLES = 50;

  // Represents high table count close to SLA limit.
  SIGNAL_TYPE_HIGH_NUMBER_OF_TABLES = 51;

  // Represents high number of unvacuumed transactions
  SIGNAL_TYPE_HIGH_TRANSACTION_ID_UTILIZATION = 52;

  // Represents need for more CPU and/or memory
  SIGNAL_TYPE_UNDERPROVISIONED = 53;

  // Represents out of disk.
  SIGNAL_TYPE_OUT_OF_DISK = 54;

  // Represents server certificate is near expiry.
  SIGNAL_TYPE_SERVER_CERTIFICATE_NEAR_EXPIRY = 55;

  // Represents database auditing is disabled.
  SIGNAL_TYPE_DATABASE_AUDITING_DISABLED = 56;

  // Represents not restricted to authorized networks.
  SIGNAL_TYPE_RESTRICT_AUTHORIZED_NETWORKS = 57;

  // Represents violate org policy restrict public ip.
  SIGNAL_TYPE_VIOLATE_POLICY_RESTRICT_PUBLIC_IP = 58;

  // Cluster nearing quota limit
  SIGNAL_TYPE_QUOTA_LIMIT = 59;

  // No password policy set on resources
  SIGNAL_TYPE_NO_PASSWORD_POLICY = 60;

  // Performance impact of connections settings
  SIGNAL_TYPE_CONNECTIONS_PERFORMANCE_IMPACT = 61;

  // Performance impact of temporary tables settings
  SIGNAL_TYPE_TMP_TABLES_PERFORMANCE_IMPACT = 62;

  // Performance impact of transaction logs settings
  SIGNAL_TYPE_TRANS_LOGS_PERFORMANCE_IMPACT = 63;

  // Performance impact of high joins without indexes
  SIGNAL_TYPE_HIGH_JOINS_WITHOUT_INDEXES = 64;

  // Detects events where a database superuser (postgres for PostgreSQL servers
  // or root for MySQL users) writes to non-system tables.
  SIGNAL_TYPE_SUPERUSER_WRITING_TO_USER_TABLES = 65;

  // Detects events where a database user or role has been granted all
  // privileges to a database, or to all tables, procedures, or functions in a
  // schema.
  SIGNAL_TYPE_USER_GRANTED_ALL_PERMISSIONS = 66;

  // Detects if database instance data exported to a Cloud Storage bucket
  // outside of the organization.
  SIGNAL_TYPE_DATA_EXPORT_TO_EXTERNAL_CLOUD_STORAGE_BUCKET = 67;

  // Detects if database instance data exported to a Cloud Storage bucket that
  // is owned by the organization and is publicly accessible.
  SIGNAL_TYPE_DATA_EXPORT_TO_PUBLIC_CLOUD_STORAGE_BUCKET = 68;

  // Detects if a database instance is using a weak password hash algorithm.
  SIGNAL_TYPE_WEAK_PASSWORD_HASH_ALGORITHM = 77;

  // Detects if a database instance has no user password policy set.
  SIGNAL_TYPE_NO_USER_PASSWORD_POLICY = 78;

  // Detects if a database instance/cluster has a hot node.
  SIGNAL_TYPE_HOT_NODE = 79;

  // Deletion Protection Disabled for the resource
  SIGNAL_TYPE_NO_DELETION_PROTECTION = 80;

  // Detects if a database instance has no point in time recovery enabled.
  SIGNAL_TYPE_NO_POINT_IN_TIME_RECOVERY = 81;

  // Detects if a database instance/cluster has suspended resources.
  SIGNAL_TYPE_RESOURCE_SUSPENDED = 82;

  // Detects that expensive commands are being run on a database instance
  // impacting overall performance.
  SIGNAL_TYPE_EXPENSIVE_COMMANDS = 83;

  // Indicates that the instance does not have a maintenance policy configured.
  SIGNAL_TYPE_NO_MAINTENANCE_POLICY_CONFIGURED = 84;

  // Indicates that the instance has inefficient queries detected.
  SIGNAL_TYPE_INEFFICIENT_QUERY = 85;

  // Indicates that the instance has read intensive workload.
  SIGNAL_TYPE_READ_INTENSIVE_WORKLOAD = 86;

  // Indicates that the instance is nearing memory limit.
  SIGNAL_TYPE_MEMORY_LIMIT = 87;

  // Indicates that the instance's max server memory is configured higher than
  // the recommended value.
  SIGNAL_TYPE_MAX_SERVER_MEMORY = 88;

  // Indicates that the database has large rows beyond the recommended limit.
  SIGNAL_TYPE_LARGE_ROWS = 89;

  // Heavy write pressure on the database rows.
  SIGNAL_TYPE_HIGH_WRITE_PRESSURE = 90;

  // Heavy read pressure on the database rows.
  SIGNAL_TYPE_HIGH_READ_PRESSURE = 91;

  // Encryption org policy not satisfied.
  SIGNAL_TYPE_ENCRYPTION_ORG_POLICY_NOT_SATISFIED = 92;

  // Location org policy not satisfied.
  SIGNAL_TYPE_LOCATION_ORG_POLICY_NOT_SATISFIED = 93;

  // Outdated DB minor version.
  SIGNAL_TYPE_OUTDATED_MINOR_VERSION = 94;

  // Schema not optimized.
  SIGNAL_TYPE_SCHEMA_NOT_OPTIMIZED = 95;

  // Replication delay.
  SIGNAL_TYPE_REPLICATION_LAG = 97;

  // Outdated client.
  SIGNAL_TYPE_OUTDATED_CLIENT = 99;

  // Databoost is disabled.
  SIGNAL_TYPE_DATABOOST_DISABLED = 100;

  // Recommended maintenance policy.
  SIGNAL_TYPE_RECOMMENDED_MAINTENANCE_POLICIES = 101;

  // Resource version is in extended support.
  SIGNAL_TYPE_EXTENDED_SUPPORT = 102;

  // Represents a database version nearing end of life.
  SIGNAL_TYPE_VERSION_NEARING_END_OF_LIFE = 104;
}

// A group of signal types that specifies what the user is interested in.
//
// Used by QueryDatabaseResourceGroups API.
//
// Example:
//
// signal_type_group {
//   name = "AVAILABILITY"
//   types = [SIGNAL_TYPE_NO_PROMOTABLE_REPLICA]
// }
message SignalTypeGroup {
  // Required. The display name of a signal group.
  string display_name = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. List of signal types present in the group.
  repeated SignalType signal_types = 2 [(google.api.field_behavior) = OPTIONAL];
}

// A filter for Signals.
//
// If signal_type is left unset, all signals should be returned.
// For example, the following filter returns all issues.
//   signal_filter: {
//     signal_status: SIGNAL_STATUS_ISSUE;
//   }
//
// Another example, the following filter returns issues of the given type:
// signal_filter: {
//   type: SIGNAL_TYPE_NO_PROMOTABLE_REPLICA
//   signal_status: ISSUE
// }
//
// If signal_status is left unset or set to SIGNAL_STATE_UNSPECIFIED, an error
// should be returned.
message SignalFilter {
  // Optional. Represents the type of the Signal for which the filter is for.
  SignalType signal_type = 1 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Represents the status of the Signal for which the filter is for.
  SignalStatus signal_status = 2 [(google.api.field_behavior) = OPTIONAL];
}

// A group of signals and their counts.
message SignalGroup {
  // Title of a signal group corresponding to the request.
  string display_name = 1;

  // When applied to a DatabaseResource represents count of issues associated
  // with the resource. A signal is an issue when its SignalStatus field is
  // set to SIGNAL_STATUS_ISSUE.
  int32 issue_count = 2;

  // List of signals present in the group and associated with the resource.
  //
  // Only applies to a DatabaseResource.
  repeated Signal signals = 3;
}

// Count of issues for a group of signals.
message IssueCount {
  // Title of a signal group corresponding to the request.
  string display_name = 1;

  // The count of the number of issues associated with those resources that
  // are explicitly filtered in by the filters present in the request.
  // A signal is an issue when its SignalStatus field is set to
  // SIGNAL_STATUS_ISSUE.
  int32 issue_count = 2;
}

// Details related to signal.
message AdditionalDetail {
  // Details related to signal.
  oneof detail {
    // Short backup retention information applies to signals with type
    // SIGNAL_TYPE_SHORT_BACKUP_RETENTION.
    RetentionSettingsInfo short_backup_retention_info = 2;

    // Backup run information applies to signals with types
    // SIGNAL_TYPE_LAST_BACKUP_FAILED and SIGNAL_TYPE_LAST_BACKUP_OLD.
    BackupRunInfo backup_run_info = 3;

    // SCC information applies to SCC signals.
    SCCInfo scc_info = 4;

    // Recommendation information applies to recommendations.
    RecommendationInfo recommendation_info = 6;

    // Automated backup policy information applies to signals with type
    // SIGNAL_TYPE_NO_AUTOMATED_BACKUP_POLICY.
    AutomatedBackupPolicyInfo automated_backup_policy_info = 8;

    // Deletion protection information applies to signals with type
    // [SIGNAL_TYPE_NO_DELETION_PROTECTION][google.cloud.databasecenter.v1beta.SignalType.SIGNAL_TYPE_NO_DELETION_PROTECTION]
    DeletionProtectionInfo deletion_protection_info = 9;

    // Resource suspension information applies to signals with type
    // [SIGNAL_TYPE_RESOURCE_SUSPENDED][google.cloud.databasecenter.v1beta.SignalType.SIGNAL_TYPE_RESOURCE_SUSPENDED].
    ResourceSuspensionInfo resource_suspension_info = 10;

    // Inefficient query information applies to signals with type
    // [SIGNAL_TYPE_INEFFICIENT_QUERY][google.cloud.databasecenter.v1beta.SignalType.SIGNAL_TYPE_INEFFICIENT_QUERY].
    InefficientQueryInfo inefficient_query_info = 11;

    // Outdated minor version information applies to signals with type
    // SIGNAL_TYPE_OUTDATED_MINOR_VERSION.
    OutdatedMinorVersionInfo outdated_minor_version_info = 12;

    // Maintenance recommendation information applies to signals
    // with type SIGNAL_TYPE_RECOMMENDED_MAINTENANCE_POLICIES.
    MaintenanceRecommendationInfo maintenance_recommendation_info = 13;
  }

  // Where the signal is coming from.
  SignalSource signal_source = 1;

  // Type of the signal.
  SignalType signal_type = 5;

  // Event time when signal was recorded by source service.
  google.protobuf.Timestamp signal_event_time = 7;
}

// Sub resource details
// For Spanner/Bigtable instance certain data protection settings are at
// sub resource level like database/table.
// This message is used to capture such sub resource details.
message SubResource {
  // Optional. Resource type associated with the sub resource where backup
  // settings are configured. E.g. "spanner.googleapis.com/Database" for Spanner
  // where backup retention is configured on database within an instance
  // OPTIONAL
  string resource_type = 1 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Resource name associated with the sub resource where backup
  // settings are configured.
  // E.g."//spanner.googleapis.com/projects/project1/instances/inst1/databases/db1"
  // for Spanner where backup retention is configured on database within
  // an instance
  // OPTIONAL
  string full_resource_name = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Product information associated with the sub resource where
  // backup retention settings are configured.
  // e.g.
  // ```
  // product: {
  //  type   : PRODUCT_TYPE_SPANNER
  //  engine : ENGINE_CLOUD_SPANNER_WITH_POSTGRES_DIALECT
  // }
  // ```
  // for Spanner where backup is configured on database within
  // an instance
  // OPTIONAL
  Product product = 3 [(google.api.field_behavior) = OPTIONAL];

  // Specifies where the resource is created. For Google Cloud resources, it is
  // the full name of the project.
  string container = 4;
}

// Metadata about backup retention settings for a database resource.
message RetentionSettingsInfo {
  // Depending on the value of retention_unit, this is used to determine
  // if a backup needs to be deleted.  If retention_unit is 'COUNT', we will
  // retain this many backups.
  oneof retention {
    // Number of backups that will be retained.
    google.protobuf.Int32Value quantity_based_retention = 3;

    // Duration based retention period i.e. 172800 seconds (2 days)
    google.protobuf.Duration duration_based_retention = 5;

    // Timestamp based retention period i.e. till 2024-05-01T00:00:00Z
    google.protobuf.Timestamp timestamp_based_retention_time = 6;
  }

  // Optional. Sub resource details associated with the backup configuration.
  SubResource sub_resource = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Automated backup policy signal info
message AutomatedBackupPolicyInfo {
  // Optional. Sub resource details associated with the signal.
  SubResource sub_resource = 1 [(google.api.field_behavior) = OPTIONAL];

  // Is automated policy enabled.
  bool is_enabled = 2;
}

// Deletion protection signal info for a database resource.
message DeletionProtectionInfo {
  // Optional. Sub resource details associated with the signal.
  SubResource sub_resource = 1 [(google.api.field_behavior) = OPTIONAL];

  // Is deletion protection enabled.
  bool deletion_protection_enabled = 2;
}

// Resource suspension info for a database resource.
message ResourceSuspensionInfo {
  // Is resource suspended.
  bool resource_suspended = 1;

  // Suspension reason for the resource.
  SuspensionReason suspension_reason = 2;
}

// Metadata about latest backup run state for a database resource.
message BackupRunInfo {
  // The status of a backup run.
  enum State {
    // Unspecified.
    STATE_UNSPECIFIED = 0;

    // The backup succeeded.
    SUCCEEDED = 1;

    // The backup was unsuccessful.
    FAILED = 2;
  }

  // The time the backup operation started.
  google.protobuf.Timestamp start_time = 1;

  // The time the backup operation completed.
  google.protobuf.Timestamp end_time = 6;

  // Output only. The state of this run.
  State state = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Additional information about the error encountered.
  string error_message = 3;

  // Optional. OperationErrorType to expose specific error when backup operation
  // of database resource failed, that is state is FAILED.
  OperationErrorType operation_error_type = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Sub resource details associated with the backup run.
  SubResource sub_resource = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Metadata about inefficient query signal info for a database resource.
message InefficientQueryInfo {
  // Name of the database where index is required. For example, "db1", which is
  // the name of the database present in the instance.
  string database = 1;

  // Name of the table where index is required
  string table = 2;

  // SQL statement of the index. Based on the ddl type, this will be either
  // CREATE INDEX or DROP INDEX.
  string sql_index_statement = 3;

  // Cost of additional disk usage in bytes
  int64 storage_cost_bytes = 4;

  // Count of queries to be impacted if index is applied
  int64 impacted_queries_count = 5;
}

// Info associated with SCC signals.
message SCCInfo {
  // Name of the signal.
  string signal = 1;

  // Name by which SCC calls this signal.
  string category = 2;

  // Compliances that are associated with the signal.
  repeated RegulatoryStandard regulatory_standards = 3;

  // External URI which points to a SCC page associated with the signal.
  string external_uri = 4;
}

// Info associated with recommendation.
message RecommendationInfo {
  // Name of recommendation.
  // Examples:
  // organizations/1234/locations/us-central1/recommenders/google.cloudsql.instance.PerformanceRecommender/recommendations/9876
  string recommender = 1;

  // ID of recommender.
  // Examples: "google.cloudsql.instance.PerformanceRecommender"
  string recommender_id = 2;

  // Contains an identifier for a subtype of recommendations produced for the
  // same recommender. Subtype is a function of content and impact, meaning a
  // new subtype might be added when significant changes to `content` or
  // `primary_impact.category` are introduced. See the Recommenders section
  // to see a list of subtypes for a given Recommender.
  //
  // Examples:
  //   For recommender = "google.cloudsql.instance.PerformanceRecommender",
  //   recommender_subtype can be
  //   "MYSQL_HIGH_NUMBER_OF_OPEN_TABLES_BEST_PRACTICE"/"POSTGRES_HIGH_TRANSACTION_ID_UTILIZATION_BEST_PRACTICE"
  string recommender_subtype = 3;
}

// Compliances associated with signals.
message RegulatoryStandard {
  // Name of industry compliance standards, such as such as CIS, PCI, and
  // OWASP.
  string standard = 1;

  // Version of the standard or benchmark, for example, 1.1.
  string version = 2;
}

// Info associated with outdated minor version.
message OutdatedMinorVersionInfo {
  // Recommended minor version of the underlying database engine. Example
  // values: For MySQL, it could be "8.0.35", "5.7.25" etc. For PostgreSQL, it
  // could be "14.4", "15.5" etc.
  string recommended_minor_version = 1;
}

// Info associated with maintenance recommendation.
message MaintenanceRecommendationInfo {
  // Optional. List of recommended maintenance schedules for the database
  // resource.
  repeated ResourceMaintenanceSchedule resource_maintenance_schedules = 1
      [(google.api.field_behavior) = OPTIONAL];
}

// Represents a signal.
message Signal {
  // Type of the signal.
  SignalType signal_type = 1;

  // Status of the signal.
  SignalStatus signal_status = 2;

  // Additional information related to the signal.
  // In the case of composite signals, this field encapsulates details
  // associated with granular signals, having a signal status of "ISSUE";
  // signals with a status of "OK" are not included.
  // For granular signals, it encompasses information relevant to the signal,
  // regardless of the signal status.
  repeated AdditionalDetail additional_details = 3;

  // Severity of the issue.
  IssueSeverity issue_severity = 4;

  // Timestamp when the issue was created (when signal status is ISSUE).
  google.protobuf.Timestamp issue_create_time = 5;
}