Abstract: The technology disclosed relates to an introspector that scans an organization's accounts on cloud storage services and detects resources on the cloud storage services configured to store the organization's data, and identifies the detected resources in a resource list. The technology disclosed further includes an inline proxy that controls manipulation of the detected resources based on the resource list.

Abstract: The technology disclosed proposes a metadata-based solution to prevent malicious data egress resulting from resource-level transactions. In advance of the data egress requests, the technology disclosed crawls an organization's accounts on different cloud storage services and makes a resource list of different cloud-based resources configured under the organization's accounts. The resource list is then stored in a metadata store. When an inline proxy receives a resource-level transaction that is requesting to move a cloud-based resource outside the organization's account, the proxy looks up the metadata store and determines whether the resource-level transaction is attempting to manipulate any of the cloud-based resources listed in the resource list. If so, then the proxy blocks the resource-level transaction.