AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Creates an account-level data protection policy or subscription filter policy that applies to all log groups or a subset of log groups in the account.
Data protection policy
A data protection policy can help safeguard sensitive data that's ingested by your log groups by auditing and masking the sensitive log data. Each account can have only one account-level data protection policy.
Sensitive data is detected and masked when it is ingested into a log group. When you set a data protection policy, log events ingested into the log groups before that time are not masked.
If you use PutAccountPolicy
to create a data protection policy for your whole
account, it applies to both existing log groups and all log groups that are created
later in this account. The account-level policy is applied to existing log groups
with eventual consistency. It might take up to 5 minutes before sensitive data in
existing log groups begins to be masked.
By default, when a user views a log event that includes masked data, the sensitive
data is replaced by asterisks. A user who has the logs:Unmask
permission can
use a GetLogEvents
or FilterLogEvents
operation with the unmask
parameter set to true
to view the unmasked
log events. Users with the logs:Unmask
can also view unmasked data in the CloudWatch
Logs console by running a CloudWatch Logs Insights query with the unmask
query
command.
For more information, including a list of types of data that can be audited and masked, see Protect sensitive log data with masking.
To use the PutAccountPolicy
operation for a data protection policy, you must
be signed on with the logs:PutDataProtectionPolicy
and logs:PutAccountPolicy
permissions.
The PutAccountPolicy
operation applies to all log groups in the account. You
can use PutDataProtectionPolicy
to create a data protection policy that applies to just one log group. If a log group
has its own data protection policy and the account also has an account-level data
protection policy, then the two policies are cumulative. Any sensitive term specified
in either policy is masked.
Subscription filter policy
A subscription filter policy sets up a real-time feed of log events from CloudWatch Logs to other Amazon Web Services services. Account-level subscription filter policies apply to both existing log groups and log groups that are created later in this account. Supported destinations are Kinesis Data Streams, Firehose, and Lambda. When log events are sent to the receiving service, they are Base64 encoded and compressed with the GZIP format.
The following destinations are supported for subscription filters:
An Kinesis Data Streams data stream in the same account as the subscription policy, for same-account delivery.
An Firehose data stream in the same account as the subscription policy, for same-account delivery.
A Lambda function in the same account as the subscription policy, for same-account delivery.
A logical destination in a different account created with PutDestination, for cross-account delivery. Kinesis Data Streams and Firehose are supported as logical destinations.
Each account can have one account-level subscription filter policy. If you are updating
an existing filter, you must specify the correct name in PolicyName
. To perform
a PutAccountPolicy
subscription filter operation for any destination except
a Lambda function, you must also have the iam:PassRole
permission.
For .NET Core this operation is only available in asynchronous form. Please refer to PutAccountPolicyAsync.
Namespace: Amazon.CloudWatchLogs
Assembly: AWSSDK.CloudWatchLogs.dll
Version: 3.x.y.z
public abstract PutAccountPolicyResponse PutAccountPolicy( PutAccountPolicyRequest request )
Container for the necessary parameters to execute the PutAccountPolicy service method.
Exception | Condition |
---|---|
InvalidParameterException | A parameter is specified incorrectly. |
LimitExceededException | You have reached the maximum number of resources that can be created. |
OperationAbortedException | Multiple concurrent requests to update the same resource were in conflict. |
ServiceUnavailableException | The service cannot complete the request. |
.NET Framework:
Supported in: 4.5, 4.0, 3.5