Data Residency Automated Compliance Drift Detection

What this solution is

This approach combines preventative policy-as-code validation in continuous integration (shifting left) with continuous detective and reactive controls using Cloud Asset Inventory feeds and event-driven automation in Google Cloud.

How it meets the requirements

• Pre-provisioning blocking: By running terraform-validator or gcloud beta terraform vet against compiled Terraform plan files (tfplan.json) in Cloud Build, the pipeline evaluates proposed infrastructure against declarative Rego or constraint framework policies (such as constraints/gcp.resourceLocations). If a resource specifies an unauthorized region, the CI/CD job fails immediately, preventing terraform apply from executing.
• Continuous drift detection & remediation: Cloud Asset Inventory feeds monitor organization-level asset creations, updates, and deletions in near real-time. Changes are streamed to Pub/Sub, which triggers a serverless Cloud Function or Cloud Run service. The service inspects the resource's geographic metadata against compliance rules and initiates remediation workflows (e.g., sending findings to Security Command Center or rolling back unapproved out-of-band changes).

Key advantages

• Shift-Left Security: Enforces organizational data boundaries during code review and pull requests, saving deployment time and preventing non-compliant resources from ever existing.
• Real-Time Event Processing: Asset feeds provide instantaneous notification of out-of-band modifications without relying on slow, batch-oriented API polling.
• Separation of Concerns: Centralizes policy governance in a version-controlled policy library while enabling decoupled, automated remediation.
• Comprehensive Visibility: Works cohesively with Assured Workloads and Resource Hierarchy Location Restrictions to enforce end-to-end data residency.