2.170.0

interface DataProtectionPolicyProps

LanguageType name
.NETAmazon.CDK.AWS.Logs.DataProtectionPolicyProps
Gogithub.com/aws/aws-cdk-go/awscdk/v2/awslogs#DataProtectionPolicyProps
Javasoftware.amazon.awscdk.services.logs.DataProtectionPolicyProps
Pythonaws_cdk.aws_logs.DataProtectionPolicyProps
TypeScript (source)aws-cdk-lib » aws_logs » DataProtectionPolicyProps

Properties for creating a data protection policy.

Example

import * as kinesisfirehose from '@aws-cdk/aws-kinesisfirehose-alpha';
import * as destinations from '@aws-cdk/aws-kinesisfirehose-destinations-alpha';

const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
  logGroupName: 'auditDestinationForCDK',
});

const bucket = new s3.Bucket(this, 'audit-bucket');
const s3Destination = new destinations.S3Bucket(bucket);

const deliveryStream = new kinesisfirehose.DeliveryStream(this, 'Delivery Stream', {
  destination: s3Destination,
});

const dataProtectionPolicy = new logs.DataProtectionPolicy({
  name: 'data protection policy',
  description: 'policy description',
  identifiers: [
    logs.DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
    new logs.DataIdentifier('EmailAddress'), // forward compatibility for new managed data identifiers
    new logs.CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}')], // custom data identifier
  logGroupAuditDestination: logGroupDestination,
  s3BucketAuditDestination: bucket,
  deliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
});

new logs.LogGroup(this, 'LogGroupLambda', {
  logGroupName: 'cdkIntegLogGroup',
  dataProtectionPolicy: dataProtectionPolicy,
});

Properties

NameTypeDescription
identifiersDataIdentifier[]List of data protection identifiers.
deliveryStreamNameAuditDestination?stringAmazon Kinesis Data Firehose delivery stream to send audit findings to.
description?stringDescription of the data protection policy.
logGroupAuditDestination?ILogGroupCloudWatch Logs log group to send audit findings to.
name?stringName of the data protection policy.
s3BucketAuditDestination?IBucketS3 bucket to send audit findings to.

identifiers

Type: DataIdentifier[]

List of data protection identifiers.

Managed data identifiers must be in the following list: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-managed-data-identifiers.html Custom data identifiers must have a valid regex defined: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.html#custom-data-identifiers-constraints

deliveryStreamNameAuditDestination?

Type: string (optional, default: no firehose delivery stream audit destination)

Amazon Kinesis Data Firehose delivery stream to send audit findings to.

The delivery stream must already exist.

description?

Type: string (optional, default: 'cdk generated data protection policy')

Description of the data protection policy.

logGroupAuditDestination?

Type: ILogGroup (optional, default: no CloudWatch Logs audit destination)

CloudWatch Logs log group to send audit findings to.

The log group must already exist prior to creating the data protection policy.

name?

Type: string (optional, default: 'data-protection-policy-cdk')

Name of the data protection policy.

s3BucketAuditDestination?

Type: IBucket (optional, default: no S3 bucket audit destination)

S3 bucket to send audit findings to.

The bucket must already exist.

← PreviousNext →