Question

A media company allows external partners to upload files to a Cloud Storage bucket. Compliance requires that any object containing sensitive data (credit card numbers, national IDs) never remain in the publicly writable ingestion bucket. Security wants an automated pipeline that inspects each newly uploaded object and moves clean files to a processing bucket while relocating files with sensitive findings to a restricted quarantine bucket for review. Which architecture best meets these requirements using Google-managed services?

Accepted Answer

Configure a Cloud Storage notification to Pub/Sub on object creation that triggers a Cloud Function which calls the Sensitive Data Protection (DLP) content.inspect API, then moves the object to the processing or quarantine bucket based on findings.

Answer

Enable Cloud Storage Object Versioning on the ingestion bucket and use a lifecycle rule to delete objects older than one day.

Answer

Schedule a daily DLP inspection job against the ingestion bucket and review the findings in the Security Command Center dashboard.

Answer

Apply a CMEK key to the ingestion bucket and grant partners only the objectCreator role so uploaded data is encrypted at rest.