DataProtectionPolicy Class
Creates a data protection policy for CloudWatch Logs log groups.
Example
ts
import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';
const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
logGroupName: 'auditDestinationForCDK',
});
const bucket = new s3.Bucket(this, 'audit-bucket');
const s3Destination = new firehose.S3Bucket(bucket);
const deliveryStream = new firehose.DeliveryStream(this, 'Delivery Stream', {
destination: s3Destination,
});
const dataProtectionPolicy = new logs.DataProtectionPolicy({
name: 'data protection policy',
description: 'policy description',
identifiers: [
logs.DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
new logs.DataIdentifier('EmailAddress'), // forward compatibility for new managed data identifiers
new logs.CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}')], // custom data identifier
logGroupAuditDestination: logGroupDestination,
s3BucketAuditDestination: bucket,
deliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
});
new logs.LogGroup(this, 'LogGroupLambda', {
logGroupName: 'cdkIntegLogGroup',
dataProtectionPolicy: dataProtectionPolicy,
});
python
import aws_cdk.aws_kinesisfirehose as firehose
log_group_destination = logs.LogGroup(self, "LogGroupLambdaAudit",
log_group_name="auditDestinationForCDK"
)
bucket = s3.Bucket(self, "audit-bucket")
s3_destination = firehose.S3Bucket(bucket)
delivery_stream = firehose.DeliveryStream(self, "Delivery Stream",
destination=s3_destination
)
data_protection_policy = logs.DataProtectionPolicy(
name="data protection policy",
description="policy description",
identifiers=[logs.DataIdentifier.DRIVERSLICENSE_US, # managed data identifier
logs.DataIdentifier("EmailAddress"), # forward compatibility for new managed data identifiers
logs.CustomDataIdentifier("EmployeeId", "EmployeeId-\\d{9}")
], # custom data identifier
log_group_audit_destination=log_group_destination,
s3_bucket_audit_destination=bucket,
delivery_stream_name_audit_destination=delivery_stream.delivery_stream_name
)
logs.LogGroup(self, "LogGroupLambda",
log_group_name="cdkIntegLogGroup",
data_protection_policy=data_protection_policy
)
java
import software.amazon.awscdk.services.kinesisfirehose.*;
LogGroup logGroupDestination = LogGroup.Builder.create(this, "LogGroupLambdaAudit")
.logGroupName("auditDestinationForCDK")
.build();
Bucket bucket = new Bucket(this, "audit-bucket");
S3Bucket s3Destination = new S3Bucket(bucket);
DeliveryStream deliveryStream = DeliveryStream.Builder.create(this, "Delivery Stream")
.destination(s3Destination)
.build();
DataProtectionPolicy dataProtectionPolicy = DataProtectionPolicy.Builder.create()
.name("data protection policy")
.description("policy description")
.identifiers(List.of(DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
new DataIdentifier("EmailAddress"), // forward compatibility for new managed data identifiers
new CustomDataIdentifier("EmployeeId", "EmployeeId-\\d{9}"))) // custom data identifier
.logGroupAuditDestination(logGroupDestination)
.s3BucketAuditDestination(bucket)
.deliveryStreamNameAuditDestination(deliveryStream.getDeliveryStreamName())
.build();
LogGroup.Builder.create(this, "LogGroupLambda")
.logGroupName("cdkIntegLogGroup")
.dataProtectionPolicy(dataProtectionPolicy)
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
using Amazon.CDK.AWS.KinesisFirehose;
var logGroupDestination = new LogGroup(this, "LogGroupLambdaAudit", new LogGroupProps {
LogGroupName = "auditDestinationForCDK"
});
var bucket = new Bucket(this, "audit-bucket");
var s3Destination = new S3Bucket(bucket);
var deliveryStream = new DeliveryStream(this, "Delivery Stream", new DeliveryStreamProps {
Destination = s3Destination
});
var dataProtectionPolicy = new DataProtectionPolicy(new DataProtectionPolicyProps {
Name = "data protection policy",
Description = "policy description",
Identifiers = new [] { DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
new DataIdentifier("EmailAddress"), // forward compatibility for new managed data identifiers
new CustomDataIdentifier("EmployeeId", "EmployeeId-\\d{9}") }, // custom data identifier
LogGroupAuditDestination = logGroupDestination,
S3BucketAuditDestination = bucket,
DeliveryStreamNameAuditDestination = deliveryStream.DeliveryStreamName
});
new LogGroup(this, "LogGroupLambda", new LogGroupProps {
LogGroupName = "cdkIntegLogGroup",
DataProtectionPolicy = dataProtectionPolicy
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
import "github.com/aws/aws-cdk-go/awscdk"
logGroupDestination := logs.NewLogGroup(this, jsii.String("LogGroupLambdaAudit"), &LogGroupProps{
LogGroupName: jsii.String("auditDestinationForCDK"),
})
bucket := s3.NewBucket(this, jsii.String("audit-bucket"))
s3Destination := firehose.NewS3Bucket(bucket)
deliveryStream := firehose.NewDeliveryStream(this, jsii.String("Delivery Stream"), &DeliveryStreamProps{
Destination: s3Destination,
})
dataProtectionPolicy := logs.NewDataProtectionPolicy(&DataProtectionPolicyProps{
Name: jsii.String("data protection policy"),
Description: jsii.String("policy description"),
Identifiers: []DataIdentifier{
logs.DataIdentifier_DRIVERSLICENSE_US(),
// managed data identifier
logs.NewDataIdentifier(jsii.String("EmailAddress")),
// forward compatibility for new managed data identifiers
logs.NewCustomDataIdentifier(jsii.String("EmployeeId"), jsii.String("EmployeeId-\\d{9}")),
},
// custom data identifier
LogGroupAuditDestination: logGroupDestination,
S3BucketAuditDestination: bucket,
DeliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
})
logs.NewLogGroup(this, jsii.String("LogGroupLambda"), &LogGroupProps{
LogGroupName: jsii.String("cdkIntegLogGroup"),
DataProtectionPolicy: dataProtectionPolicy,
})
Initializer
ts
new DataProtectionPolicy(props: DataProtectionPolicyProps)
python
DataProtectionPolicy(props: DataProtectionPolicyProps)
java
new DataProtectionPolicy(DataProtectionPolicyProps props)
csharp
new DataProtectionPolicy(DataProtectionPolicyProps props)
go
NewDataProtectionPolicy(Props DataProtectionPolicyProps)