#码力全开·技术π对#如何确保在GCP上部署的应用程序符合GDPR合规性要求？

# 使用Google Cloud KMS进行数据加密的示例
from google.cloud import kms_v1

def encrypt_data(project_id, location_id, key_ring_id, crypto_key_id, plaintext):
    client = kms_v1.KeyManagementServiceClient()
    name = client.crypto_key_path(project_id, location_id, key_ring_id, crypto_key_id)
    
    response = client.encrypt(
        request={'name': name, 'plaintext': plaintext}
    )
    return response.ciphertext

# 自动分类敏感数据
def classify_data(content):
    from google.cloud import dlp_v2
    dlp = dlp_v2.DlpServiceClient()
    
    item = {"value": content}
    inspect_config = {
        "info_types": [
            {"name": "PERSON_NAME"},
            {"name": "CREDIT_CARD_NUMBER"},
            {"name": "EU_PHONE_NUMBER"}
        ],
        "min_likelihood": dlp_v2.Likelihood.POSSIBLE
    }
    
    response = dlp.inspect_content(
        request={"parent": "projects/my-project", "item": item, "inspect_config": inspect_config}
    )
    return response.result.findings

# Terraform配置示例：符合GDPR的最小权限原则
resource "google_project_iam_binding" "gdpr_data_processor" {
  project = "my-gdpr-project"
  role    = "roles/cloudsql.client"

  members = [
    "serviceAccount:data-processor@my-gdpr-project.iam.gserviceaccount.com",
  ]
  
  condition {
    title       = "gdpr_access_time_restriction"
    description = "Only allow access during business hours CET"
    expression  = <<EOT
    (request.time.getHours("CET") >= 8 && request.time.getHours("CET") < 18)
    EOT
  }
}

resource "google_organization_iam_audit_config" "gdpr_audit_logs" {
  org_id  = "123456789"
  service = "allServices"
  
  audit_log_config {
    log_type = "ADMIN_READ"
  }
  audit_log_config {
    log_type = "DATA_WRITE"
  }
  audit_log_config {
    log_type = "DATA_READ"
  }
}

// 实现数据访问请求(DSAR)处理的Cloud Function
public class DsarHandler implements HttpFunction {
    private static final Firestore db = FirestoreClient.getFirestore();
    
    @Override
    public void service(HttpRequest request, HttpResponse response) throws Exception {
        switch (request.getMethod()) {
            case "GET":
                handleAccessRequest(request, response);
                break;
            case "DELETE":
                handleDeletionRequest(request, response);
                break;
            default:
                response.setStatusCode(405);
        }
    }

    private void handleAccessRequest(HttpRequest request, HttpResponse response) {
        String userId = request.getQueryParameters().get("userId").get(0);
        
        // 验证请求者身份
        if (!verifyRequestIdentity(request, userId)) {
            response.setStatusCode(403);
            return;
        }

        // 收集所有相关数据
        Map<String, Object> userData = new HashMap<>();
        userData.putAll(getCloudSqlData(userId));
        userData.putAll(getFirestoreData(userId));
        userData.putAll(getStorageData(userId));

        // 生成可下载的报告
        String reportId = UUID.randomUUID().toString();
        storeTemporaryReport(reportId, userData);

        // 返回报告访问链接（30天后自动删除）
        response.getWriter().write(
            "{\"reportUrl\":\"" + generateSignedUrl(reportId) + "\"}"
        );
    }

    private void handleDeletionRequest(HttpRequest request, HttpResponse response) {
        String userId = request.getQueryParameters().get("userId").get(0);
        
        // 标记数据删除而非物理删除
        TransactionOptions options = TransactionOptions.Builder.withXg(true);
        db.runTransaction(transaction -> {
            DocumentReference userDoc = db.collection("users").document(userId);
            transaction.update(userDoc, "deleted", true);
            transaction.update(userDoc, "deletionTimestamp", FieldValue.serverTimestamp());
            return null;
        }, options);

        // 安排后续数据清理
        PubsubMessage message = PubsubMessage.newBuilder()
            .setData(ByteString.copyFromUtf8(userId))
            .build();
        Publisher publisher = Publisher.newBuilder(
            TopicName.of("my-project", "gdpr-deletion-queue")).build();
        publisher.publish(message);

        response.getWriter().write("{\"status\":\"deletion_initiated\"}");
    }
}

-- BigQuery表设计：数据处理活动日志
CREATE TABLE `gdpr_audit.data_processing_logs` (
  `log_id` STRING NOT NULL,
  `event_timestamp` TIMESTAMP NOT NULL,
  `operation_type` STRING NOT NULL, -- READ/WRITE/DELETE/EXPORT
  `data_subject_id` STRING NOT NULL,
  `data_categories` ARRAY<STRING> NOT NULL,
  `processor_id` STRING NOT NULL,
  `purpose` STRING NOT NULL,
  `legal_basis` STRING NOT NULL, -- CONSIMENT/CONTRACT/LEGAL_OBLIGATION
  `source_ip` STRING,
  `user_agent` STRING,
  `additional_metadata` JSON
)
PARTITION BY DATE(event_timestamp)
OPTIONS (
  require_partition_filter = true,
  partition_expiration_days = 365
);

-- 视图：数据跨境传输记录
CREATE VIEW `gdpr_audit.cross_border_transfers` AS
SELECT 
  log_id,
  event_timestamp,
  data_subject_id,
  JSON_EXTRACT_SCALAR(additional_metadata, '$.destination_country') as destination_country,
  JSON_EXTRACT(additional_metadata, '$.safeguards') as safeguards
FROM 
  `gdpr_audit.data_processing_logs`
WHERE 
  JSON_EXTRACT_SCALAR(additional_metadata, '$.is_cross_border') = 'true'

# 使用gcloud命令确保数据存储在特定区域
gcloud compute instances create gdpr-compliant-vm \
  --zone=europe-west1-b \
  --service-account=gdpr-processor@my-project.iam.gserviceaccount.com \
  --no-address \
  --machine-type=e2-medium \
  --image-family=debian-11 \
  --image-project=debian-cloud \
  --scopes=cloud-platform \
  --tags=gdpr-eu-data

# 使用Google Cloud DLP API扫描存储中的敏感数据
def monitor_gdpr_compliance(project_id):
    from google.cloud import dlp_v2
    from google.cloud import storage
    
    dlp = dlp_v2.DlpServiceClient()
    storage_client = storage.Client(project=project_id)
    
    # 扫描所有存储分区
    for bucket in storage_client.list_buckets():
        inspect_config = {
            "info_types": [
                {"name": "EU_GENERAL_DATA_PROTECTION_REGULATION"}
            ],
            "min_likelihood": dlp_v2.Likelihood.POSSIBLE,
            "rule_set": [
                {
                    "info_types": [{"name": "EMAIL_ADDRESS"}],
                    "rules": [
                        {
                            "exclusion_rule": {
                                "regex": {"pattern": ".*@my-company\\.com"},
                                "matching_type": "MATCHING_TYPE_FULL_MATCH"
                            }
                        }
                    ]
                }
            ]
        }
        
        # 创建长期运行的检查作业
        job = {
            "inspect_config": inspect_config,
            "storage_config": {
                "cloud_storage_options": {
                    "file_set": {"url": f"gs://{bucket.name}/*"},
                    "sample_method": "RANDOM_START",
                    "bytes_limit_per_file": 100000
                }
            },
            "actions": [
                {
                    "publish_findings_to_stackdriver": {}
                }
            ]
        }
        
        dlp.create_dlp_job(
            parent=f"projects/{project_id}/locations/global",
            inspect_job=job
        )

// 基于Cloud Workflows的DPA生成器
function generateDPA(vendorInfo) {
  const template = `DATA PROCESSING AGREEMENT
    
Between:
${vendorInfo.companyName}, located at ${vendorInfo.address} ("Processor")
and
[Your Company Name], located at [Your Address] ("Controller")

1. Subject Matter: ${vendorInfo.serviceDescription}
2. Duration: ${new Date().toISOString().split('T')[0]} to ${vendorInfo.endDate}
3. Nature and Purpose: ${vendorInfo.processingPurposes}
4. Data Types: ${vendorInfo.dataCategories.join(', ')}
5. Sub-processors: ${vendorInfo.subProcessors ? 'See Annex 1' : 'None'}
  
Security Measures:
- Encryption: ${vendorInfo.encryption ? 'Enabled' : 'Disabled'}
- Access Control: ${vendorInfo.accessControl ? 'Role-based' : 'Not specified'}
- Audit Logs: ${vendorInfo.auditLogs ? 'Retained for 1 year' : 'Not enabled'}`;
  
  return template;
}

exports.generateDPA = (req, res) => {
  if (req.method !== 'POST') {
    res.status(405).send('Method Not Allowed');
    return;
  }
  
  try {
    const dpa = generateDPA(req.body);
    res.status(200).send(dpa);
  } catch (error) {
    console.error('DPA generation failed:', error);
    res.status(500).send('Internal Server Error');
  }
};

# BigQuery SQL：GDPR合规状态报告
WITH 
data_flows AS (
  SELECT
    COUNT(DISTINCT data_subject_id) as subjects,
    data_categories,
    legal_basis,
    DATE_TRUNC(event_timestamp, MONTH) as month
  FROM `gdpr_audit.data_processing_logs`
  GROUP BY 2, 3, 4
),
breaches AS (
  SELECT
    severity,
    DATE_TRUNC(detection_time, MONTH) as month,
    COUNT(*) as incidents
  FROM `gdpr_monitoring.security_incidents`
  GROUP BY 1, 2
)

SELECT
  df.month,
  df.subjects,
  ARRAY_TO_STRING(df.data_categories, ', ') as categories,
  df.legal_basis,
  COALESCE(b.incidents, 0) as security_incidents,
  CASE
    WHEN b.incidents > 3 THEN 'NON-COMPLIANT'
    WHEN df.legal_basis = 'CONSENT' AND df.subjects < 1000 THEN 'REVIEW NEEDED'
    ELSE 'COMPLIANT'
  END as status
FROM data_flows df
LEFT JOIN breaches b ON df.month = b.month AND b.severity = 'HIGH'
ORDER BY df.month DESC

def handle_data_breach(incident):
    from google.cloud import securitycenter_v1
    from google.cloud import pubsub_v1
    
    # 1. 记录安全事件
    client = securitycenter_v1.SecurityCenterClient()
    finding = {
        "parent": "organizations/123456789/sources/123456789",
        "finding_id": incident['id'],
        "finding": {
            "state": "ACTIVE",
            "category": "DATA_BREACH",
            "event_time": {"seconds": int(time.time())},
            "severity": "HIGH",
            "source_properties": {
                "data_type": {"string_value": incident['data_type']},
                "records_exposed": {"int_value": incident['record_count']},
                "contained": {"bool_value": False}
            }
        }
    }
    client.create_finding(request={"parent": finding['parent'], "finding_id": finding['finding_id'], "finding": finding['finding']})
    
    # 2. 通知DPO
    publisher = pubsub_v1.PublisherClient()
    topic_path = publisher.topic_path('my-project', 'dpo-notifications')
    publisher.publish(topic_path, data=json.dumps(incident).encode('utf-8'))
    
    # 3. 72小时倒计时监控
    schedule_deadline_notification(incident['detection_time'])
    
    # 4. 自动遏制措施
    if 'source_ip' in incident:
        block_ip_address(incident['source_ip'])
    
    return {"status": "incident_registered"}

# Cloud Function部署描述符（GDPR事件响应）
name: projects/my-project/locations/europe-west1/functions/gdpr-remediation
entry_point: handleRemediation
runtime: nodejs14
event_trigger:
  event_type: google.pubsub.topic.publish
  resource: projects/my-project/topics/gdpr-incidents
environment_variables:
  DPO_EMAIL: dpo@my-company.com
  MAX_RESPONSE_TIME: 72h
available_memory_mb: 256
timeout: 540s
service_account_email: gdpr-responder@my-project.iam.gserviceaccount.com

package main

import (
	"cloud.google.com/go/pubsub"
	"context"
	"log"
	
	dlp "cloud.google.com/go/dlp/apiv2"
	"google.golang.org/api/iterator"
)

func monitorCompliance(ctx context.Context) error {
	// 检查未加密的敏感数据
	dlpClient, err := dlp.NewClient(ctx)
	if err != nil {
		return err
	}
	defer dlpClient.Close()

	// 扫描BigQuery数据集
	req := &dlp.CreateDlpJobRequest{
		Parent: "projects/my-project",
		Job: &dlp.CreateDlpJobRequest_InspectJob{
			InspectJob: &dlp.InspectJobConfig{
				InspectConfig: &dlp.InspectConfig{
					InfoTypes: []*dlp.InfoType{
						{Name: "PERSON_NAME"},
						{Name: "EU_PHONE_NUMBER"},
					},
				},
				StorageConfig: &dlp.StorageConfig{
					Type: &dlp.StorageConfig_BigQueryOptions{
						BigQueryOptions: &dlp.BigQueryOptions{
							TableReference: &dlp.BigQueryTable{
								ProjectId: "my-project",
								DatasetId: "customer_data",
								TableId:   "*",
							},
						},
					},
				},
				Actions: []*dlp.Action{
					{
						Action: &dlp.Action_PublishToPubsub{
							PublishToPubsub: &dlp.Action_PublishToPubSub{
								Topic: "projects/my-project/topics/gdpr-violations",
							},
						},
					},
				},
			},
		},
	}

	_, err = dlpClient.CreateDlpJob(ctx, req)
	return err
}

def calculate_compliance_score(project_id):
    from google.cloud import recommender_v1
    from google.cloud import securitycenter_v1
    
    # 获取安全建议
    recommender_client = recommender_v1.RecommenderClient()
    recommendations = recommender_client.list_recommendations(
        parent=f"projects/{project_id}/locations/global/recommenders/google.iam.policy.Recommender"
    )
    
    # 获取当前安全标记
    sc_client = securitycenter_v1.SecurityCenterClient()
    findings = sc_client.list_findings(
        parent=f"projects/{project_id}/sources/-"
    )
    
    # 计算评分
    score = 100
    score -= len(list(recommendations)) * 5
    for finding in findings:
        if finding.finding.severity == "CRITICAL":
            score -= 10
        elif finding.finding.severity == "HIGH":
            score -= 5
    
    # 确保分数在0-100范围内
    return max(0, min(100, score))