Quickstart: Using the command-line tool

This page shows you how to perform basic tasks in the Cloud Data Loss Prevention API using a command-line interface.

Before you begin

1. Sign in to your Google Account.

   If you don't already have one, sign up for a new account.

2. In the GCP Console, on the project selector page, select or create a GCP project.

   Note: If you don't plan to keep the resources you create in this procedure, create a new project instead of selecting an existing project. After you finish following these steps, you can delete the project, removing all resources associated with the project.

   Go to the Project selector page

3. Make sure that billing is enabled for your Google Cloud Platform project.

   Learn how to enable billing

4. Enable the DLP API.

   Enable the API

5. Set up authentication:

   1. In the GCP Console, go to the Create service account key page.

      Go to the Create Service Account Key page
   2. From the Service account list, select New service account.
   3. In the Service account name field, enter a name.

   4. From the Role list, select Project > Owner.

      Note: The Role field authorizes your service account to access resources. You can view and change this field later by using the GCP Console. If you are developing a production app, specify more granular permissions than Project > Owner. For more information, see granting roles to service accounts.
   5. Click Create. A JSON file that contains your key downloads to your computer.

6. Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the file path of the JSON file that contains your service account key. This variable only applies to your current shell session, so if you open a new session, set the variable again.

   Example: Linux or macOS

   Replace [PATH] with the file path of the JSON file that contains your service account key.

   export GOOGLE_APPLICATION_CREDENTIALS="[PATH]"

   For example:

   export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"

   Example: Windows

   Replace [PATH] with the file path of the JSON file that contains your service account key, and [FILE_NAME] with the filename.

   With PowerShell:

   $env:GOOGLE_APPLICATION_CREDENTIALS="[PATH]"

   For example:

   $env:GOOGLE_APPLICATION_CREDENTIALS="C:\Users\username\Downloads\[FILE_NAME].json"

   With command prompt:

   set GOOGLE_APPLICATION_CREDENTIALS=[PATH]

7. Download and install Node.js and NPM.

Permissions

Inspecting content requires the serviceusage.services.use permission for the project that's specified in parent. The roles/editor, roles/owner, and roles.dlp.user roles contain the required permission or you can define your own custom role.

To give your user the dlp.admin role at the project level:

Web UI

1. Open the Cloud Identity and Access Management page in the Google Cloud Platform Console.

   Open the IAM page

2. If a project hasn't already been selected, click Select a project.

3. Select your project and click Open.

4. On the Cloud Identity and Access Management page, click Add.

5. In the Add members dialog:

   • For Members type the user email: [e-mail].
   • For Roles, click Select a role and choose Cloud DLP > DLP User.

6. Click Add.

Command-line

1. To add a single binding to the project's Cloud IAM policy, type the following command. Replace [PROJECT_ID] with your project ID.

   gcloud projects add-iam-policy-binding [PROJECT_ID] --member group:[e-mail] --role roles/dlp.user

2. The command writes the updated policy to the console window:

bindings:
- members:
  - group:[e-mail]
    role: roles/dlp.user

Set up Cloud DLP CLI app

1. Clone or download a ZIP file of the Node.js DLP client library.

2. Open a command-line tool and navigate to the samples directory.

3. Install the app dependencies by running npm install while in the samples directory.

4. If you haven't done so already, create the GCLOUD_PROJECT environment variable and set it to the project ID of the Google Cloud Platform project you set up to use with Cloud DLP.

Inspect a string for sensitive information

This section shows you how to ask the service to scan sample text using the inspect string command.

1. Open a command-line tool and navigate to the samples folder of the Node.js samples repository.

2. Run the following command:

   node inspect.js string "My email address is [e-mail]."

You should receive the following output:

{
  "results":[
    {
      "findings":[
        {
          "quote":"[e-mail]",
          "infoType":"EMAIL_ADDRESS",
          "likelihood":"VERY_LIKELY",
          "location":{
            "byteRange":{
              "start":"20",
              "end":"35"
            },
            "codepointRange":{
              "start":"20",
              "end":"35"
            }
          }
        }
      ]
    }
  ]
}

Congratulations! You've sent your first request to the Cloud Data Loss Prevention API!

What's next?

• Read How-to guides to get started with inspecting text and images, as well as redacting sensitive data from text.
• Read Concepts to better understand inspection, redaction, Infotypes and likelihood.
• Take a look at the Service API Reference and the Node.js client library API Reference.