<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-dlp-policies
description: >-
  Implement data loss prevention policies across AWS, Azure, and GCP to detect,
  classify, and protect sensitive data including PII, PHI, and financial records
  in cloud storage, databases, and data pipelines.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - dlp
  - macie
  - purview
  - data-classification
  - pii-detection
  - data-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Implementing Cloud DLP Policies

## Overview

Cloud Data Loss Prevention (DLP) identifies and protects sensitive data across cloud
services. This skill covers deploying AWS Macie for S3 classification, Azure Purview
for Microsoft ecosystem data governance, and GCP DLP API for content inspection. Each
platform offers native DLP that integrates with access controls, encryption, and
alerting to prevent unauthorized data exposure.

Mode: `[MODE: BLUE]` with `[MODE: PRIVACY]` layer — Data protection and compliance.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, `gcloud` CLI configured | Required |
| AWS | `macie2:*` permissions, S3 bucket access |
| Azure | Purview account, `Information Protection Administrator` role |
| GCP | DLP API enabled, `roles/dlp.admin` |
| Python 3.10+ with `boto3`, `google-cloud-dlp` | Required |

## Key Concepts

### AWS Macie — S3 Data Classification

```bash
# Enable Macie
aws macie2 enable-macie

# Create classification job for all S3 buckets
aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --name "full-s3-scan-$(date +%Y%m%d)" \
  --s3-job-definition '{
    "bucketDefinitions": [{
      "accountId": "'$(aws sts get-caller-identity --query Account --output text)'",
      "buckets": ["'$BUCKET_NAME'"]
    }]
  }'

# List findings (sensitive data detections)
aws macie2 list-findings --finding-criteria '{
  "criterion": {
    "severity.description": {"eq": ["High","Critical"]}
  }
}'

# Get finding details
aws macie2 get-finding-statistics --group-by "type"
```

### GCP DLP API — Content Inspection

```bash
# Inspect a Cloud Storage bucket for PII
gcloud dlp inspect-content \
  --project=$PROJECT_ID \
  --content="SSN: 123-45-6789, email: user@example.com" \
  --info-types="US_SOCIAL_SECURITY_NUMBER,EMAIL_ADDRESS" \
  --min-likelihood=LIKELY

# Create inspection job for GCS
gcloud dlp jobs create \
  --project=$PROJECT_ID \
  --display-name="gcs-pii-scan" \
  --inspect-config='{"infoTypes":[{"name":"US_SOCIAL_SECURITY_NUMBER"},{"name":"CREDIT_CARD_NUMBER"},{"name":"EMAIL_ADDRESS"}],"minLikelihood":"LIKELY"}' \
  --storage-config='{"cloudStorageOptions":{"fileSet":{"url":"gs://'$BUCKET_NAME'/**"}}}'

# List DLP job results
gcloud dlp jobs list --project=$PROJECT_ID --filter="state=DONE"
```

### Azure Purview — Data Classification

```bash
# Create Purview account
az purview account create --name $PURVIEW_ACCOUNT --resource-group $RG --location $LOCATION

# Register data source
az purview data-source create \
  --account-name $PURVIEW_ACCOUNT \
  --name "azure-storage-source" \
  --kind AzureStorage \
  --endpoint "https://${STORAGE_ACCOUNT}.blob.core.windows.net"

# Trigger scan
az purview scan create \
  --account-name $PURVIEW_ACCOUNT \
  --data-source-name "azure-storage-source" \
  --name "pii-scan-$(date +%Y%m%d)" \
  --scan-ruleset-type System \
  --scan-ruleset-name AzureStorage
```

## Workflow

### Step 1: Inventory Data Stores

```bash
# AWS — list all S3 buckets and RDS instances
aws s3api list-buckets --query 'Buckets[].Name' --output text
aws rds describe-db-instances --query 'DBInstances[].{ID:DBInstanceIdentifier,Engine:Engine}'

# GCP — list storage buckets and BigQuery datasets
gsutil ls
bq ls --project_id $PROJECT_ID
```

### Step 2: Configure DLP Scanning

```bash
# AWS — create Macie custom data identifier for internal IDs
aws macie2 create-custom-data-identifier \
  --name "InternalEmployeeID" \
  --regex "EMP-[0-9]{6}" \
  --description "Internal employee ID format"
```

### Step 3: Run Agent Script

```bash
node scripts/agent.js --provider aws --output /tmp/dlp_report.json
```

## Detection

```yaml
title: Cloud Dlp Policies Detection
id: 986d9565-e466-44d0-96ea-49172524fce5
status: experimental
description: Detects suspicious activity related to implementing cloud dlp policies techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1048
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Dlp Policies Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1048 |

## Verification

- [ ] Macie/Purview/DLP API enabled on all data stores with sensitive data
- [ ] Custom data identifiers created for organization-specific patterns
- [ ] Classification jobs scheduled on recurring basis
- [ ] High-severity findings trigger automated alerts
- [ ] DLP findings integrated into SIEM for correlation
- [ ] Remediation workflow defined for exposed sensitive data
- [ ] Encryption enforced on all stores containing classified data

## References

- [AWS Macie Documentation](https://docs.aws.amazon.com/macie/)
- [GCP Cloud DLP Documentation](https://cloud.google.com/dlp/docs)
- [Azure Purview Data Governance](https://learn.microsoft.com/en-us/azure/purview/)
- [NIST SP 800-122 — PII Confidentiality](https://csrc.nist.gov/publications/detail/sp/800-122/final)
