Cloud Dlp Laravel Package

Getting Started

Minimal Setup

1. Installation:

   composer require google/cloud-dlp
   

   Ensure your composer.json includes the package under require.

2. Authentication: Configure credentials via environment variables (recommended) or service account JSON:

   putenv('GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/service-account.json');
   

   Or use the GOOGLE_CLOUD_PROJECT environment variable for project-specific auth.

3. First Use Case: Scan a text content for sensitive data (e.g., PII):

   use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
   use Google\Cloud\Dlp\V2\InspectContentRequest;
   use Google\Cloud\Dlp\V2\ContentItem;
   
   $client = new DlpServiceClient();
   $request = (new InspectContentRequest())
       ->setItem((new ContentItem())
           ->setData('John Doe, SSN: 123-45-6789')
       )
       ->setInspectConfig((new \Google\Cloud\Dlp\V2\InspectConfig())
           ->setInfoTypes(['PERSON_NAME', 'US_SOCIAL_SECURITY_NUMBER'])
       );
   
   $response = $client->inspectContent($request);
   print_r($response->getFindings());
   

Key Entry Points

• Client Initialization: DlpServiceClient (primary entry point).
• Core Methods:
  • inspectContent(): Scan text/bytes for sensitive data.
  • redactContent(): Mask sensitive data in text/bytes.
  • deidentifyContent(): Transform data to remove PII.
  • createInspectJob(): Asynchronous scanning for large datasets.
  • getColumnDataProfile(): Analyze structured data (e.g., BigQuery tables).

Implementation Patterns

Common Workflows

1. Synchronous Scanning (Small Datasets)

$client = new DlpServiceClient();
$request = (new InspectContentRequest())
    ->setItem((new ContentItem())->setData($textData))
    ->setInspectConfig((new \Google\Cloud\Dlp\V2\InspectConfig())
        ->setInfoTypes(['CREDIT_CARD_NUMBER', 'EMAIL_ADDRESS'])
    );

$findings = $client->inspectContent($request)->getFindings();
foreach ($findings as $finding) {
    echo "Found: " . $finding->getInfoType()->getName() . "\n";
}

2. Asynchronous Processing (Large Datasets)

Use createInspectJob() for batch processing (e.g., GCS files):

$job = $client->createInspectJob((new \Google\Cloud\Dlp\V2\CreateInspectJobRequest())
    ->setParent('projects/YOUR_PROJECT')
    ->setInspectJob((new \Google\Cloud\Dlp\V2\InspectJob())
        ->setInspectConfig((new \Google\Cloud\Dlp\V2\InspectConfig())
            ->setInfoTypes(['PHONE_NUMBER'])
        )
        ->setStorageConfig((new \Google\Cloud\Dlp\V2\GcsContent())
            ->setFileUri('gs://your-bucket/file.csv')
        )
    )
);
echo "Job ID: " . $job->getName() . "\n";

3. Data Profiling (Structured Data)

Profile a BigQuery table to identify sensitive columns:

$profile = $client->getColumnDataProfile((new \Google\Cloud\Dlp\V2\GetColumnDataProfileRequest())
    ->setName('projects/YOUR_PROJECT/locations/US/columnDataProfiles/123')
);
foreach ($profile->getColumnDataProfileResult()->getColumnStats() as $stat) {
    echo "Column: " . $stat->getColumnName() . " | Sensitive: " . ($stat->getSensitive() ? 'Yes' : 'No') . "\n";
}

4. Redaction/Deidentification

Mask sensitive data in text:

$deidResponse = $client->deidentifyContent((new \Google\Cloud\Dlp\V2\DeidentifyContentRequest())
    ->setItem((new ContentItem())->setData('SSN: 123-45-6789'))
    ->setDeidentifyConfig((new \Google\Cloud\Dlp\V2\DeidentifyConfig())
        ->setInfoTypeTransformations([
            (new \Google\Cloud\Dlp\V2\InfoTypeTransformation())
                ->setInfoTypes(['US_SOCIAL_SECURITY_NUMBER'])
                ->setPrimitiveTransformation((new \Google\Cloud\Dlp\V2\PrimitiveTransformation())
                    ->setReplaceWithInfoTypeConfig((new \Google\Cloud\Dlp\V2\ReplaceWithInfoTypeConfig())
                        ->setNewInfoType('OTHER')
                    )
                )
        ])
    )
);
echo "Redacted: " . $deidResponse->getItem()->getData() . "\n";

5. Integrating with GCS/BigQuery

Use GcsContent or BigQueryTable for source data:

$gcsConfig = (new \Google\Cloud\Dlp\V2\GcsContent())
    ->setFileUri('gs://your-bucket/large-file.json');
$request = (new InspectContentRequest())
    ->setItem((new ContentItem())->setData($gcsConfig))
    ->setInspectConfig(...);

Laravel-Specific Patterns

1. Service Provider Binding: Bind the client in AppServiceProvider:

   public function register()
   {
       $this->app->singleton(DlpServiceClient::class, function () {
           return new DlpServiceClient();
       });
   }
   

2. Facade for Cleaner Syntax: Create a facade (app/Facades/Dlp.php):

   namespace App\Facades;
   
   use Illuminate\Support\Facades\Facade;
   use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
   
   class Dlp extends Facade
   {
       protected static function getFacadeAccessor()
       {
           return DlpServiceClient::class;
       }
   }
   

   Usage:

   $findings = \App\Facades\Dlp::inspectContent($request);
   

3. Job Queues for Async Tasks: Dispatch DLP jobs to queues (e.g., InspectJob creation):

   use Illuminate\Bus\Queueable;
   use Illuminate\Contracts\Queue\ShouldQueue;
   
   class DlpInspectJob implements ShouldQueue
   {
       use Queueable;
   
       public function handle()
       {
           $client = app(DlpServiceClient::class);
           $client->createInspectJob($this->request);
       }
   }
   

4. Caching Responses: Cache getColumnDataProfile results (e.g., for frequent table scans):

   $profile = Cache::remember("dlp_profile_{$tableId}", now()->addHours(1), function () use ($client, $tableId) {
       return $client->getColumnDataProfile(...);
   });
   

Gotchas and Tips

Pitfalls

1. Authentication Issues:

   • Gotcha: Using GOOGLE_APPLICATION_CREDENTIALS with incorrect permissions (e.g., missing dlp.user role).
   • Fix: Ensure the service account has:
     • roles/dlp.user for scanning.
     • roles/dlp.admin for managing jobs/profiles.
   • Tip: Use google-cloud-auth for debugging:

     use Google\Auth\Credentials\Credentials;
     $credentials = Credentials::fromStream('/path/to/key.json');
     $client = new DlpServiceClient(['credentials' => $credentials]);
     

2. Quotas and Limits:

   • Gotcha: Free tier has quotas (e.g., 100MB/day for inspectContent).
   • Fix: Use createInspectJob for large datasets or request quota increases.
   • Tip: Monitor usage via Cloud Console > DLP > Quotas.

3. gRPC vs REST:

   • Gotcha: gRPC methods (e.g., streaming) require gRPC PHP extension.
   • Fix: Install via:

     pecl install grpc
     

   • Tip: Prefer REST for simplicity unless you need streaming (e.g., real-time redaction).

4. Data Size Limits:

   • Gotcha: inspectContent has a 10MB payload limit.
   • Fix: Use createInspectJob