Google Cloud Data Loss Prevention Extension

Mask with stars

This example uses the deidentifyWithMask action to mask the specified types of text with a character specified in the policy -- here, the * character.

The following AssignMessage policy sets the request.content variable for illustration purposes. Ordinarily, you'd retrieve the request content from the client's request.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="Set-Variable">
    <DisplayName>Set Variable</DisplayName>
    <AssignTo type="response" createNew="false"/>
    <AssignVariable>
        <Name>request.content</Name>
        <Value>Visit my site at https://example.com. Or contact me at gladys@example.com.</Value>
    </AssignVariable>
</AssignMessage>

The following ExtensionCallout policy retrieves the request.content variable value and passes it to a Cloud DLP extension (here, called example-dlp). That extension has been configured to mask values based on the URL and EMAIL_ADDRESS infoTypes.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ConnectorCallout async="false" continueOnError="true" enabled="true" name="Data-Loss-Extension-Callout">
    <DisplayName>Data Loss Prevention Extension Callout</DisplayName>
    <Connector>example-dlp</Connector>
    <Action>deidentifyWithMask</Action>
    <Input><![CDATA[{
        "text" : "{request.content}",
        "mask" : "*"
    }]]></Input>
    <Output>masked.output</Output>
</ConnectorCallout>

The following AssignMessage policy retrieves the extension's output for display in the Trace tool.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="Get-DLP-Output">
    <DisplayName>Get DLP Output</DisplayName>
    <AssignTo type="response" createNew="false"/>
    <Set>
        <Payload contentType="application/json">{masked.output}</Payload>
    </Set>
</AssignMessage>

The following is an example of output from this code.

{"text":"Visit my site at ******************* Or contact me at *****************."}

Mask with name

This example uses the deidentifyWithType action to mask the specified types of text with the infotype name itself. For example, it would replace the email address gladys@example.com with EMAIL_ADDRESS.

The following AssignMessage policy sets the request.content variable for illustration purposes. Ordinarily, you'd retrieve the request content from the client's request.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="Set-Variable">
    <DisplayName>Set Variable</DisplayName>
    <AssignTo type="response" createNew="false"/>
    <AssignVariable>
        <Name>request.content</Name>
        <Value>Visit my site at https://example.com. Or contact me at gladys@example.com.</Value>
    </AssignVariable>
</AssignMessage>

The following ExtensionCallout policy retrieves the request.content variable value and passes it to a Cloud DLP extension (here, called example-dlp). That extension has been configured to mask values based on the URL and EMAIL_ADDRESS infoTypes.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ConnectorCallout async="false" continueOnError="true" enabled="true" name="Data-Loss-Extension-Callout">
    <DisplayName>Data Loss Prevention Extension Callout</DisplayName>
    <Connector>example-dlp</Connector>
    <Action>deidentifyWithType</Action>
    <Input><![CDATA[{
        "text" : "{request.content}"
    }]]></Input>
    <Output>masked.output</Output>
</ConnectorCallout>

The following AssignMessage policy retrieves the extension's output for display in the Trace tool.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="Get-DLP-Output">
    <DisplayName>Get DLP Output</DisplayName>
    <AssignTo type="response" createNew="false"/>
    <Set>
        <Payload contentType="application/json">{masked.output}</Payload>
    </Set>
</AssignMessage>

The following is an example of output from this code.

{"text":"Visit my site at [URL] Or contact me at [EMAIL_ADDRESS]."}

Syntax

<Action>deidentifyWithMask</Action>
<Input><![CDATA[{
  "text" : "text-to-deidentify",
  "mask" : "masking-character"
}]]></Input>

Example

In the following example, the input to mask is an email address stored in an input.email.address flow variable. To support this specific example, this extension must have been configured to support the EMAIL_ADDRESS infoType. For a list of infoTypes, see InfoType Detector Reference.

<Action>deidentifyWithMask</Action>
<Input><![CDATA[{
    "text" : "{input.email.address}",
    "mask" : "*"
}]]></Input>
<Output>masked.output</Output>

The output for this example would be the following:

{"text":"*****************"}

Syntax

<Action>deidentifyWithTemplate</Action>
<Input><![CDATA[{
  "text" : "text-to-deidentify"
  "templateName" : "path-to-template"
}]]></Input>

Example

In the following example, the input to de-identify is the request body carried by the request.content flow variable.

<Action>deidentifyWithTemplate</Action>
<Input><![CDATA[{
    "text" : "{request.content}"
    "templateName" : "projects/[PROJECT_ID]/deidentifyTemplates/1231258663242"
}]]></Input>

The output for this example would be the de-identified request content.

Syntax

<Action>deidentifyWithType</Action>
<Input><![CDATA[{
  "text" : "text-to-deidentify"
}]]></Input>

Example

In the following example, the input to mask is an email address stored in an input.email.address flow variable. To support this specific example, this extension must have been configured to support the EMAIL_ADDRESS infoType. For a list of infoTypes, see InfoType Detector Reference.

<Action>deidentifyWithType</Action>
<Input><![CDATA[{
    "text" : "{input.email.address}"
}]]></Input>

The output for this example would be the following:

{"text":"EMAIL_ADDRESS"}