<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud DLP — API Reference

## AWS Macie CLI

```bash
# Enable Macie
aws macie2 enable-macie

# Create classification job
aws macie2 create-classification-job --job-type ONE_TIME \
  --s3-job-definition '{"bucketDefinitions":[{"accountId":"ACCT","buckets":["BUCKET"]}]}' \
  --name "scan-name"

# List classification jobs
aws macie2 list-classification-jobs

# Get job details
aws macie2 describe-classification-job --job-id JOB_ID

# List findings
aws macie2 list-findings --finding-criteria '{"criterion":{"severity.description":{"eq":["High"]}}}'

# Get findings
aws macie2 get-findings --finding-ids FINDING_ID

# Get bucket statistics
aws macie2 get-bucket-statistics

# Manage custom data identifiers
aws macie2 create-custom-data-identifier --name "employee-id" --regex "EMP-\\d{6}"
aws macie2 list-custom-data-identifiers
```

## GCP DLP API CLI

```bash
# Inspect text content
gcloud dlp inspect-content --content "TEXT" --info-types INFO_TYPE --min-likelihood LIKELY

# Create inspection job
gcloud dlp jobs create --project PROJECT --inspect-config '{}' --storage-config '{}'

# List jobs
gcloud dlp jobs list --project PROJECT

# De-identify text
gcloud dlp text deidentify --content "TEXT" --info-types TYPE --deidentify-config '{}'

# List info types
gcloud dlp info-types list

# Create stored info type (custom pattern)
gcloud dlp stored-info-types create --project PROJECT --display-name "Custom" --regex-pattern "PATTERN"
```

## Azure Purview CLI

```bash
# Register data source
az purview data-source create --account-name PURVIEW --data-source-name NAME --kind AzureStorage

# Create scan
az purview scan create --account-name PURVIEW --data-source-name NAME --scan-name SCAN

# Run scan
az purview scan run --account-name PURVIEW --data-source-name NAME --scan-name SCAN

# List classifications
az purview classification-rule list --account-name PURVIEW

# Create custom classification
az purview classification-rule create --account-name PURVIEW --name RULE --kind Custom --pattern "REGEX"
```

## Common Info Types

| Type | Provider | Description |
|------|----------|-------------|
| US_SOCIAL_SECURITY_NUMBER | GCP/AWS | SSN |
| CREDIT_CARD_NUMBER | GCP/AWS | Credit card |
| EMAIL_ADDRESS | GCP/AWS | Email |
| PHONE_NUMBER | GCP/AWS | Phone |
| AWS_CREDENTIALS | GCP | AWS access keys |
| PERSON_NAME | GCP/AWS | Personal names |
| STREET_ADDRESS | GCP/AWS | Physical addresses |

## Regulatory Mapping

| Regulation | Data Types | DLP Action |
|-----------|------------|------------|
| GDPR | All PII | Classify, encrypt, alert |
| HIPAA | PHI, health data | Encrypt, restrict access |
| PCI-DSS | Card data | Encrypt, mask, alert |
| CCPA | CA resident PII | Classify, track, delete |
