<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-dlp
description: >-
  Implement Data Loss Prevention controls across AWS Macie, Azure Purview, and GCP DLP
  to detect, classify, and protect sensitive data in cloud storage and transit.
domain: cybersecurity
subdomain: cloud-security
tags:
  - dlp
  - data-classification
  - macie
  - purview
  - gcp-dlp
  - pii
  - gdpr
  - data-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Implementing Cloud DLP

## Overview

Cloud Data Loss Prevention identifies and protects sensitive data — PII, financial
records, health data, credentials — across storage services and data flows. This skill
covers deploying DLP controls using AWS Macie, Azure Purview, and GCP DLP API for
automated data discovery, classification, de-identification, and monitoring.

Mode: `[MODE: PRIVACY]` — Data protection and regulatory compliance.

## Prerequisites

- AWS Macie, Azure Purview, or GCP DLP API enabled
- Storage read permissions for scanning targets
- Python 3.10+ with cloud SDKs
- Understanding of data classification requirements (GDPR, HIPAA, PCI-DSS)

## Key Concepts

### AWS Macie — Sensitive Data Discovery

```bash
# Enable Macie
aws macie2 enable-macie

# Create classification job for S3 buckets
aws macie2 create-classification-job --job-type ONE_TIME \
  --s3-job-definition '{
    "bucketDefinitions": [{
      "accountId": "ACCOUNT_ID",
      "buckets": ["sensitive-data-bucket"]
    }]
  }' \
  --name "pii-scan-$(date +%Y%m%d)"

# List findings
aws macie2 list-findings --finding-criteria '{
  "criterion": {
    "severity.description": {"eq": ["High", "Critical"]}
  }
}'

# Get finding details
aws macie2 get-findings --finding-ids FINDING_ID

# Get sensitive data statistics
aws macie2 get-bucket-statistics
```

### GCP DLP API

```bash
# Inspect content for sensitive data
gcloud dlp inspect-content --content "My SSN is 123-45-6789" \
  --info-types "US_SOCIAL_SECURITY_NUMBER,CREDIT_CARD_NUMBER,EMAIL_ADDRESS" \
  --min-likelihood LIKELY

# Create inspection job for Cloud Storage
gcloud dlp jobs create --project PROJECT_ID \
  --inspect-config '{"infoTypes":[{"name":"US_SOCIAL_SECURITY_NUMBER"},{"name":"CREDIT_CARD_NUMBER"}],"minLikelihood":"LIKELY"}' \
  --storage-config '{"cloudStorageOptions":{"fileSet":{"url":"gs://BUCKET/**"}}}'

# De-identify data
gcloud dlp text deidentify --content "Call me at 555-123-4567" \
  --info-types "PHONE_NUMBER" \
  --deidentify-config '{"infoTypeTransformations":{"transformations":[{"primitiveTransformation":{"replaceConfig":{"newValue":{"stringValue":"[REDACTED]"}}}}]}}'
```

### Azure Purview

```bash
# Create scan for storage account
az purview scan create --account-name PURVIEW --data-source-name STORAGE \
  --scan-name "sensitive-scan" --scan-rule-set-name "SystemDefault"

# Run scan
az purview scan run --account-name PURVIEW --data-source-name STORAGE --scan-name "sensitive-scan"

# List classifications
az purview classification-rule list --account-name PURVIEW
```

### Data Classification Taxonomy

| Category | Examples | Regulations |
|----------|----------|-------------|
| PII | SSN, DOB, Address, Phone | GDPR Art. 4, CCPA |
| Financial | Credit card, Bank account | PCI-DSS, SOX |
| Health | Diagnosis, Prescription, Insurance | HIPAA, HITECH |
| Credentials | API keys, Passwords, Tokens | All frameworks |
| Legal | Attorney-client, Court records | Varies |

### Custom DLP Patterns

```python
# Custom regex patterns for DLP scanning
CUSTOM_PATTERNS = {
    "internal_employee_id": r"EMP-\d{6}",
    "internal_project_code": r"PRJ-[A-Z]{3}-\d{4}",
    "customer_account": r"ACCT-\d{10}",
}
```

## Workflow

### Step 1: Discovery — Identify Data Stores

```bash
node scripts/agent.js --provider aws --action discover --output /tmp/data_stores.json
```

### Step 2: Classification — Scan for Sensitive Data

```bash
node scripts/agent.js --provider aws --action scan --bucket sensitive-bucket --output /tmp/dlp_scan.json
```

### Step 3: Protection — Apply DLP Policies

Configure automated remediation: encryption, access restriction, alerting.

### Step 4: Monitor

```bash
node scripts/agent.js --provider aws --action monitor --output /tmp/dlp_findings.json
```

## Detection

```yaml
title: Cloud Dlp Detection
id: f74c8993-f4f6-499d-b212-6346133e2e4c
status: experimental
description: Detects suspicious activity related to implementing cloud dlp techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1048
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```

## Verification

- [ ] DLP scanning enabled on all sensitive data stores
- [ ] PII detection rules configured for relevant regulations
- [ ] Custom patterns added for organization-specific data
- [ ] Automated alerting on high-severity findings
- [ ] Data classification labels applied to discovered data
- [ ] De-identification available for non-production environments
- [ ] DLP findings integrated with SIEM/incident workflow
- [ ] Regular scan schedule configured (weekly minimum)

## References

- [AWS Macie User Guide](https://docs.aws.amazon.com/macie/latest/user/)
- [GCP DLP API Documentation](https://cloud.google.com/dlp/docs)
- [Azure Purview Documentation](https://learn.microsoft.com/en-us/azure/purview/)
- [GDPR Article 4 — Personal Data Definition](https://gdpr-info.eu/art-4-gdpr/)
- [PCI-DSS Requirement 3 — Protect Stored Data](https://www.pcisecuritystandards.org/)
