C データエンジニアリング — 会員360度ビューのPIIガバナンス（列レベルセキュリティ(Data Catalog Policy Tag) × 動的データマスキング(EMAIL_MASK) × 行レベルセキュリティ(ROW ACCESS POLICY) × PIIなしgold層マート分離 × dbt grantsによるIAMコード管理 × 消去要求(個人情報保護法/GDPR)連携 × Data Access監査ログ+想定外アクセス検知）（MOps 会員360度ビュー Bad→Good）

📋 コピー# infra/pii_governance.tf
# 修正①: PIIタキソノミー・ポリシータグを定義し、ソーステーブルの列に機械的に紐付ける
resource "google_data_catalog_taxonomy" "pii" {
  project                 = var.project_id
  region                  = "asia-northeast1"
  display_name            = "member-pii-taxonomy"
  description              = "会員PII分類（氏名・メール・電話番号・住所）"
  activated_policy_types  = ["FINE_GRAINED_ACCESS_CONTROL"]
}

resource "google_data_catalog_policy_tag" "pii_restricted" {
  taxonomy     = google_data_catalog_taxonomy.pii.id
  display_name = "PII_Restricted"
  description  = "個人を直接特定できる情報。CS/マーケティング権限保持者のみ生値を閲覧可能"
}

# 修正①: ポリシータグへの閲覧権限をグループ単位で最小権限付与
resource "google_data_catalog_policy_tag_iam_member" "cs_reader" {
  policy_tag = google_data_catalog_policy_tag.pii_restricted.name
  role       = "roles/datacatalog.categoryFineGrainedReader"
  member     = "group:cs-agents@example.com"
}
resource "google_data_catalog_policy_tag_iam_member" "marketing_reader" {
  policy_tag = google_data_catalog_policy_tag.pii_restricted.name
  role       = "roles/datacatalog.categoryFineGrainedReader"
  member     = "group:marketing-analysts@example.com"
}

# 修正②: ポリシータグに動的データマスキングを紐付け、権限のない閲覧者にはマスク済み値を返す
resource "google_bigquery_datapolicy_data_policy" "email_mask" {
  provider         = google-beta
  project          = var.project_id
  location         = "asia-northeast1"
  data_policy_id   = "email-mask-policy"
  policy_tag       = google_data_catalog_policy_tag.pii_restricted.name
  data_policy_type = "DATA_MASKING_POLICY"
  data_masking_policy {
    predefined_expression = "EMAIL_MASK"   # 例: yamada.taro@example.com → a***@***.com
  }
}
resource "google_bigquery_datapolicy_data_policy" "default_mask" {
  provider         = google-beta
  project          = var.project_id
  location         = "asia-northeast1"
  data_policy_id   = "default-mask-policy"
  policy_tag       = google_data_catalog_policy_tag.pii_restricted.name
  data_policy_type = "DATA_MASKING_POLICY"
  data_masking_policy {
    predefined_expression = "DEFAULT_MASKING_VALUE"  # 電話番号・住所・氏名はNULL相当でマスク
  }
}

# 修正①: ソーステーブルのスキーマにポリシータグを組み込む（schemas/stg_member_profile.json 抜粋）
# {
#   "name": "email", "type": "STRING",
#   "policyTags": { "names": ["${google_data_catalog_policy_tag.pii_restricted.name}"] }
# }

# 修正⑦: BigQueryへのData Read監査ログを有効化
resource "google_project_iam_audit_config" "bigquery_data_access" {
  project = var.project_id
  service = "bigquery.googleapis.com"
  audit_log_config { log_type = "DATA_READ" }
}

# 修正⑦: PIIマートへの想定外アクセスを検知するログベースメトリクス + アラート
resource "google_logging_metric" "pii_mart_unexpected_access" {
  project = var.project_id
  name    = "pii-mart-unexpected-access"
  filter  = <<-EOT
    resource.type="bigquery_dataset"
    protoPayload.resourceName:"tables/mart_member_360_restricted"
    protoPayload.authenticationInfo.principalEmail!~"cs-agents@example\\.com|marketing-analysts@example\\.com|dbt-runner@"
  EOT
  metric_descriptor { metric_kind = "DELTA" value_type = "INT64" }
}

resource "google_monitoring_alert_policy" "pii_access_alert" {
  project      = var.project_id
  display_name = "PIIマート想定外アクセス検知"
  combiner     = "OR"
  conditions {
    display_name = "想定外principalによるアクセス発生"
    condition_threshold {
      filter          = "metric.type=\"logging.googleapis.com/user/${google_logging_metric.pii_mart_unexpected_access.name}\""
      comparison      = "COMPARISON_GT"
      threshold_value = 0
      duration        = "0s"
    }
  }
  notification_channels = [var.slack_notification_channel_id]
}