DlpPolicy

Proto: dlp_policy.proto

Package: security.policy.gloo.solo.io

Types:

• DLPPolicyReport

• DLPPolicyReport.WorkspacesEntry

• DLPPolicySpec

• DLPPolicySpec.Config

• DLPPolicyStatus

• DlpAction

• DlpCustomAction

• DlpKeyValueAction

• DLPPolicySpec.Config.Sanitize

• DlpAction.PredefinedAction

DLPPolicyReport link

DLPPolicyReport.WorkspacesEntry link

DLPPolicySpec link

Use a DLPPolicy (data loss prevention policy) to prevent sensitive data from being exposed. Gloo Gateway completes a series of regex replacements on the body or headers of responses that it processes. DLPPolicies are applied at the Route level.

DLPPolicySpec.Config link

Whether actions apply to responses, access logs, or both. If empty, masking is enabled for responses bodies only.

DLPPolicyStatus link

The status of the DLPPolicy.

DlpAction link

A single DLP action to mask sensitive data. You can apply preconfigured actions, create custom actions, and write key-value (header) actions. These actions can also be shadowed. A shadowed action is recorded in the statistics and debug logs, but is not committed in the response body.

To use a predefined action, set the predefinedAction to one of the predefined actions.

  - predefinedAction: VISA
  

To create a custom action, specify the configuration in the customAction field. The default enum value is custom, so that can be left empty.

  - customAction:
name: test
regexActions:
- regex: "hello"
- regex: "world"
maskChar: Y
percent: 60
  

To create a key-value action, specify the configuration in the keyValueAction field. The default enum value is custom, so that can be left empty.

  - keyValueAction:
keysToMask:
- x-my-header-01
maskChar: _
name: kv-action-1
percent: 100
  

DlpCustomAction link

A custom action that you define to apply to the response body.

The list of regex strings are applied in order. For instance, if the response body contains hello world, and you define the following custom action:

  customAction:
name: test
regexActions:
- regex: "hello"
- regex: "world"
maskChar: Y
percent: 60
  

The result is masked in this way: YYYlo YYYld

If mask_char and percent are not defined, the result is masked in this way: XXXXo XXXXd

DlpKeyValueAction link

A key-value action to apply to response headers.

DLPPolicySpec.Config.Sanitize link

DlpAction.PredefinedAction link

The following pre-defined actions map to subgroup 1 of the listed regex patterns:

SSN:

• ‘(?:^|\D)([0-9]{9})(?:\D|$)’
• ‘(?:^|\D)([0-9]{3}-[0-9]{2}-[0-9]{4})(?:\D|$)’
• ‘(?:^|\D)([0-9]{3}\ [0-9]{2}\ [0-9]{4})(?:\D|$)’

MASTERCARD:

• ‘(?:^|\D)(5[1-5][0-9]{2}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4})(?:\D|$)’

VISA:

• ‘(?:^|\D)(4[0-9]{3}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4})(?:\D|$)’

AMEX:

• ‘(?:^|\D)((?:34|37)[0-9]{2}(?:\ |-|)[0-9]{6}(?:\ |-|)[0-9]{5})(?:\D|$)’

DISCOVER:

• ‘(?:^|\D)(6011(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4})(?:\D|$)’

JCB:

• ‘(?:^|\D)(3[0-9]{3}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4}(?:\ |-|)[0-9]{4})(?:\D|$)’
• ‘(?:^|\D)((?:2131|1800)[0-9]{11})(?:\D|$)’

DINERS_CLUB:

• ‘(?:^|\D)(30[0-5][0-9](?:\ |-|)[0-9]{6}(?:\ |-|)[0-9]{4})(?:\D|$)’
• ‘(?:^|\D)((?:36|38)[0-9]{2}(?:\ |-|)[0-9]{6}(?:\ |-|)[0-9]{4})(?:\D|$)’

CREDIT_CARD_TRACKERS:

• ‘([1-9][0-9]{2}-[0-9]{2}-[0-9]{4}^\d)’
• ‘(?:^|\D)(%?[Bb]\d{13,19}^[-/.\w\s]{2,26}^[0-9][0-9][01][0-9][0-9]{3})’
• ‘(?:^|\D)(;\d{13,19}=(?:\d{3}|)(?:\d{4}|=))’

ALL_CREDIT_CARDS:

• (All credit card related regexes from above)