Cloud Dlp Laravel Package

Getting Started

Minimal Setup

1. Install the package:

   composer require google/cloud-dlp
   

2. Authenticate (see Google Cloud PHP Auth Guide):

   use Google\Auth\Credentials\ServiceAccountCredentials;
   $credentials = ServiceAccountCredentials::fromStream(__DIR__.'/path/to/service-account.json');
   

3. Initialize the client (REST or gRPC):

   use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
   $dlp = new DlpServiceClient(['credentials' => $credentials]);
   

First Use Case: Scanning Text for PII

use Google\Cloud\Dlp\V2\InspectContentRequest;
use Google\Cloud\Dlp\V2\InfoType;

// Basic text inspection
$request = (new InspectContentRequest())
    ->setItem(new \Google\Cloud\Dlp\V2\ContentItem())
    ->setItem()->setMessage(new \Google\Protobuf\Internal\Message())
    ->setItem()->getMessage()->setText('User SSN: 123-45-6789');

$response = $dlp->inspectContent($request);
print_r($response->getResult()->getFindings());

Implementation Patterns

Core Workflows

1. Data Discovery & Profiling

• Profile structured data (e.g., BigQuery tables):

  use Google\Cloud\Dlp\V2\ProfileBigQueryTableRequest;
  $profileRequest = (new ProfileBigQueryTableRequest())
      ->setParent('projects/PROJECT_ID/locations/LOCATION')
      ->setBigQueryTable('PROJECT_ID:DATASET.TABLE');
  $profile = $dlp->profileBigQueryTable($profileRequest);
  

• List data profiles (for auditing):

  use Google\Cloud\Dlp\V2\ListDataProfilesRequest;
  $listRequest = (new ListDataProfilesRequest())
      ->setParent('projects/PROJECT_ID/locations/LOCATION');
  $profiles = $dlp->listDataProfiles($listRequest);
  

2. De-Identification

• Redact text (e.g., for logs or user data):

  use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
  $deidRequest = (new DeidentifyContentRequest())
      ->setItem(new \Google\Cloud\Dlp\V2\ContentItem())
      ->setItem()->setMessage(new \Google\Protobuf\Internal\Message())
      ->setItem()->getMessage()->setText('Email: user@example.com')
      ->setInfoType(new InfoType())
      ->setInfoType()->setNames(['EMAIL_ADDRESS']);
  $redacted = $dlp->deidentifyContent($deidRequest);
  

• Redact images (e.g., for privacy compliance):

  use Google\Cloud\Dlp\V2\RedactImageRequest;
  $redactImageRequest = (new RedactImageRequest())
      ->setGcsImage('gs://bucket/image.jpg')
      ->setOutputGcsImage('gs://bucket/redacted.jpg');
  $dlp->redactImage($redactImageRequest);
  

3. Automated Scanning with Inspect Jobs

• Batch scan GCS files:

  use Google\Cloud\Dlp\V2\InspectGcsContentRequest;
  $inspectJob = (new InspectGcsContentRequest())
      ->setGcsContent('gs://bucket/file.txt')
      ->setIncludeQuote(false)
      ->setInfoTypes([new InfoType(['names' => ['CREDIT_CARD']])]);
  $job = $dlp->inspectGcsContent($inspectJob);
  

• Poll for job completion:

  $jobName = $job->getJobName();
  do {
      $status = $dlp->getInspectJob($jobName);
      sleep(2);
  } while ($status->getState() === 'RUNNING');
  

4. Integration with Laravel

• Service Provider Setup:

  // config/services.php
  'dlp' => [
      'key_file' => env('GOOGLE_DLP_KEY_FILE'),
      'project_id' => env('GOOGLE_CLOUD_PROJECT'),
  ],
  
  // app/Providers/AppServiceProvider.php
  public function register()
  {
      $this->app->singleton(DlpServiceClient::class, function ($app) {
          $credentials = ServiceAccountCredentials::fromStream(
              $app['config']['services.dlp.key_file']
          );
          return new DlpServiceClient(['credentials' => $credentials]);
      });
  }
  

• Laravel Controller Usage:

  use Illuminate\Support\Facades\App;
  
  public function scanText(Request $request)
  {
      $dlp = App::make(DlpServiceClient::class);
      $request = (new InspectContentRequest())
          ->setItem(new \Google\Cloud\Dlp\V2\ContentItem())
          ->setItem()->setMessage(new \Google\Protobuf\Internal\Message())
          ->setItem()->getMessage()->setText($request->input('text'));
  
      $response = $dlp->inspectContent($request);
      return response()->json($response->getResult()->getFindings());
  }
  

Advanced Patterns

1. Custom Detectors & InfoTypes

• Use predefined detectors (e.g., PHONE_NUMBER, US_SSN):

  $infoType = new InfoType(['names' => ['US_SSN']]);
  

• Create custom detectors (via DLP console or API):

  // After creating a custom detector in GCP Console:
  $infoType = new InfoType(['customInfoTypes' => ['name' => 'projects/PROJECT_ID/locations/LOCATION/customInfoTypes/CUSTOM_TYPE']]);
  

2. Streaming with gRPC

• Enable gRPC for high-throughput operations:

  $dlp = new DlpServiceClient([
      'credentials' => $credentials,
      'grpc' => true,
  ]);
  

• Streaming inspect jobs (for large datasets):

  $stream = $dlp->inspectGcsContentStream($request);
  foreach ($stream as $result) {
      // Process findings in real-time
  }
  

3. Error Handling & Retries

• Global exception handling:

  try {
      $response = $dlp->inspectContent($request);
  } catch (ApiException $e) {
      if ($e->getStatus() === 'UNAVAILABLE') {
          // Retry logic
      }
      throw $e;
  }
  

• Use Google’s retry decorator (for production):

  use Google\ApiCore\Retry\RetrySettings;
  $retrySettings = new RetrySettings();
  $dlp = new DlpServiceClient([
      'credentials' => $credentials,
      'retrySettings' => $retrySettings,
  ]);
  

4. Logging & Monitoring

• Enable logging:

  $dlp = new DlpServiceClient([
      'credentials' => $credentials,
      'logger' => new \Monolog\Logger('dlp'),
  ]);
  

• Track quotas (avoid hitting limits):

  $quota = $dlp->getProjectQuota('projects/PROJECT_ID');
  if ($quota->getLimit() - $quota->getUsage() < 100) {
      // Alert or throttle requests
  }
  

Gotchas and Tips

Pitfalls

1. Authentication Issues:

   • Gotcha: Using GOOGLE_APPLICATION_CREDENTIALS env var may not work with the PHP client. Fix: Explicitly pass credentials via ServiceAccountCredentials::fromStream().
   • Gotcha: Default service account may lack dlp.user permissions. Fix: Grant roles/dataLossPreventionAdmin or roles/dataLossPreventionViewer to the service account.

2. Quota Limits:

   • Gotcha: Free tier has strict quotas (e.g., 100,000 rows/month for InspectContent). Fix: Use getProjectQuota() to monitor usage or implement exponential backoff.
   • Tip: Batch requests to avoid hitting row limits (e.g., scan 100 rows at a time).

3. gRPC vs REST:

   • Gotcha: gRPC requires additional setup (protobuf compiler). Fix: Use REST for simplicity unless you need streaming or low latency.
   • Tip: gRPC is ~30% faster for large payloads but adds ~1MB binary dependency.

4. InfoType Mismatches:

   • Gotcha: Custom `InfoType