Copyright | (c) 2013-2023 Brendan Hay |
---|---|
License | Mozilla Public License, v. 2.0. |
Maintainer | Brendan Hay |
Stability | auto-generated |
Portability | non-portable (GHC extensions) |
Safe Haskell | Safe-Inferred |
Language | Haskell2010 |
Creates a data protection policy for the specified log group. A data protection policy can help safeguard sensitive data that's ingested by the log group by auditing and masking the sensitive log data.
Sensitive data is detected and masked when it is ingested into the log group. When you set a data protection policy, log events ingested into the log group before that time are not masked.
By default, when a user views a log event that includes masked data, the
sensitive data is replaced by asterisks. A user who has the
logs:Unmask
permission can use a
GetLogEvents
or
FilterLogEvents
operation with the unmask
parameter set to true
to view the unmasked
log events. Users with the logs:Unmask
can also view unmasked data in
the CloudWatch Logs console by running a CloudWatch Logs Insights query
with the unmask
query command.
For more information, including a list of types of data that can be audited and masked, see Protect sensitive log data with masking.
Synopsis
- data PutDataProtectionPolicy = PutDataProtectionPolicy' {}
- newPutDataProtectionPolicy :: Text -> Text -> PutDataProtectionPolicy
- putDataProtectionPolicy_logGroupIdentifier :: Lens' PutDataProtectionPolicy Text
- putDataProtectionPolicy_policyDocument :: Lens' PutDataProtectionPolicy Text
- data PutDataProtectionPolicyResponse = PutDataProtectionPolicyResponse' {}
- newPutDataProtectionPolicyResponse :: Int -> PutDataProtectionPolicyResponse
- putDataProtectionPolicyResponse_lastUpdatedTime :: Lens' PutDataProtectionPolicyResponse (Maybe Natural)
- putDataProtectionPolicyResponse_logGroupIdentifier :: Lens' PutDataProtectionPolicyResponse (Maybe Text)
- putDataProtectionPolicyResponse_policyDocument :: Lens' PutDataProtectionPolicyResponse (Maybe Text)
- putDataProtectionPolicyResponse_httpStatus :: Lens' PutDataProtectionPolicyResponse Int
Creating a Request
data PutDataProtectionPolicy Source #
See: newPutDataProtectionPolicy
smart constructor.
PutDataProtectionPolicy' | |
|
Instances
newPutDataProtectionPolicy Source #
Create a value of PutDataProtectionPolicy
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
PutDataProtectionPolicy
, putDataProtectionPolicy_logGroupIdentifier
- Specify either the log group name or log group ARN.
PutDataProtectionPolicy
, putDataProtectionPolicy_policyDocument
- Specify the data protection policy, in JSON.
This policy must include two JSON blocks:
The first block must include both a
DataIdentifer
array and anOperation
property with anAudit
action. TheDataIdentifer
array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.The
Operation
property with anAudit
action is required to find the sensitive data terms. ThisAudit
action must contain aFindingsDestination
object. You can optionally use thatFindingsDestination
object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Kinesis Data Firehose streams, and S3 buckets, they must already exist.The second block must include both a
DataIdentifer
array and anOperation
property with anDeidentify
action. TheDataIdentifer
array must exactly match theDataIdentifer
array in the first block of the policy.The
Operation
property with theDeidentify
action is what actually masks the data, and it must contain the"MaskConfig": {}
object. The"MaskConfig": {}
object must be empty.
For an example data protection policy, see the Examples section on this page.
The contents of two DataIdentifer
arrays must match exactly.
Request Lenses
putDataProtectionPolicy_logGroupIdentifier :: Lens' PutDataProtectionPolicy Text Source #
Specify either the log group name or log group ARN.
putDataProtectionPolicy_policyDocument :: Lens' PutDataProtectionPolicy Text Source #
Specify the data protection policy, in JSON.
This policy must include two JSON blocks:
The first block must include both a
DataIdentifer
array and anOperation
property with anAudit
action. TheDataIdentifer
array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.The
Operation
property with anAudit
action is required to find the sensitive data terms. ThisAudit
action must contain aFindingsDestination
object. You can optionally use thatFindingsDestination
object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Kinesis Data Firehose streams, and S3 buckets, they must already exist.The second block must include both a
DataIdentifer
array and anOperation
property with anDeidentify
action. TheDataIdentifer
array must exactly match theDataIdentifer
array in the first block of the policy.The
Operation
property with theDeidentify
action is what actually masks the data, and it must contain the"MaskConfig": {}
object. The"MaskConfig": {}
object must be empty.
For an example data protection policy, see the Examples section on this page.
The contents of two DataIdentifer
arrays must match exactly.
Destructuring the Response
data PutDataProtectionPolicyResponse Source #
See: newPutDataProtectionPolicyResponse
smart constructor.
PutDataProtectionPolicyResponse' | |
|
Instances
newPutDataProtectionPolicyResponse Source #
Create a value of PutDataProtectionPolicyResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
PutDataProtectionPolicyResponse
, putDataProtectionPolicyResponse_lastUpdatedTime
- The date and time that this policy was most recently updated.
PutDataProtectionPolicy
, putDataProtectionPolicyResponse_logGroupIdentifier
- The log group name or ARN that you specified in your request.
PutDataProtectionPolicy
, putDataProtectionPolicyResponse_policyDocument
- The data protection policy used for this log group.
$sel:httpStatus:PutDataProtectionPolicyResponse'
, putDataProtectionPolicyResponse_httpStatus
- The response's http status code.
Response Lenses
putDataProtectionPolicyResponse_lastUpdatedTime :: Lens' PutDataProtectionPolicyResponse (Maybe Natural) Source #
The date and time that this policy was most recently updated.
putDataProtectionPolicyResponse_logGroupIdentifier :: Lens' PutDataProtectionPolicyResponse (Maybe Text) Source #
The log group name or ARN that you specified in your request.
putDataProtectionPolicyResponse_policyDocument :: Lens' PutDataProtectionPolicyResponse (Maybe Text) Source #
The data protection policy used for this log group.
putDataProtectionPolicyResponse_httpStatus :: Lens' PutDataProtectionPolicyResponse Int Source #
The response's http status code.