# DataProtectionPolicyProps

Properties for creating a data protection policy.

Extends: DataProtectionPolicyProps
Used as props by: DataProtectionPolicy

- Source: [`aws-logs/lib/data-protection-policy.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts#L132)
- Type last changed: v2.235.0 · 15 Jan 2026

## Example

```ts
import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';

const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
  logGroupName: 'auditDestinationForCDK',
});

const bucket = new s3.Bucket(this, 'audit-bucket');
const s3Destination = new firehose.S3Bucket(bucket);

const deliveryStream = new firehose.DeliveryStream(this, 'Delivery Stream', {
  destination: s3Destination,
});

const dataProtectionPolicy = new logs.DataProtectionPolicy({
  name: 'data protection policy',
  description: 'policy description',
  identifiers: [
    logs.DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
    new logs.DataIdentifier('EmailAddress'), // forward compatibility for new managed data identifiers
    new logs.CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}')], // custom data identifier
  logGroupAuditDestination: logGroupDestination,
  s3BucketAuditDestination: bucket,
  deliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
});

new logs.LogGroup(this, 'LogGroupLambda', {
  logGroupName: 'cdkIntegLogGroup',
  dataProtectionPolicy: dataProtectionPolicy,
});
```

## Properties

- `deliveryStreamNameAuditDestination`: string — Amazon Data Firehose delivery stream to send audit findings to.

  **Default:** no firehose delivery stream audit destination

  The delivery stream must already exist.

- `description`: string — Description of the data protection policy.

  **Default:** 'cdk generated data protection policy'

- `identifiers`: [DataIdentifier](/cdk/api/v2/docs/aws-cdk-lib.aws_logs.DataIdentifier.html)[] (required) — List of data protection identifiers.

  Managed data identifiers must be in the following list: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-managed-data-identifiers.html
  Custom data identifiers must have a valid regex defined: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.html#custom-data-identifiers-constraints

- `logGroupAuditDestination`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — CloudWatch Logs log group to send audit findings to.

  **Default:** no CloudWatch Logs audit destination

  The log group must already exist prior to creating the data protection policy.

- `name`: string = 'data-protection-policy-cdk' — Name of the data protection policy.

- `s3BucketAuditDestination`: [IBucketRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_s3.IBucketRef.html) — S3 bucket to send audit findings to.

  **Default:** no S3 bucket audit destination

  The bucket must already exist.