AWS CDK Reference

Appearance

v2.275.0

DataProtectionPolicyProps Struct ​

Properties for creating a data protection policy.

Source
aws-logs/lib/data-protection-policy.ts
Type last changed
v2.235.0 · 15 Jan 2026

Example ​

ts
import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';

const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
  logGroupName: 'auditDestinationForCDK',
});

const bucket = new s3.Bucket(this, 'audit-bucket');
const s3Destination = new firehose.S3Bucket(bucket);

const deliveryStream = new firehose.DeliveryStream(this, 'Delivery Stream', {
  destination: s3Destination,
});

const dataProtectionPolicy = new logs.DataProtectionPolicy({
  name: 'data protection policy',
  description: 'policy description',
  identifiers: [
    logs.DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
    new logs.DataIdentifier('EmailAddress'), // forward compatibility for new managed data identifiers
    new logs.CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}')], // custom data identifier
  logGroupAuditDestination: logGroupDestination,
  s3BucketAuditDestination: bucket,
  deliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
});

new logs.LogGroup(this, 'LogGroupLambda', {
  logGroupName: 'cdkIntegLogGroup',
  dataProtectionPolicy: dataProtectionPolicy,
});

Properties ​

deliveryStreamNameAuditDestinationoptionalstringdelivery_stream_name_audit_destinationoptionalstrdeliveryStreamNameAuditDestinationoptionalStringDeliveryStreamNameAuditDestinationoptionalstringDeliveryStreamNameAuditDestinationoptional*string#
Amazon Data Firehose delivery stream to send audit findings to.

Default: no firehose delivery stream audit destination

The delivery stream must already exist.

descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#
Description of the data protection policy.

Default: 'cdk generated data protection policy'

identifiersDataIdentifier[]identifierstyping.List[DataIdentifier]identifiersList<DataIdentifier>IdentifiersDataIdentifier[]Identifiers*[]DataIdentifierrequired#
List of data protection identifiers.
notes

Managed data identifiers must be in the following list: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-managed-data-identifiers.html Custom data identifiers must have a valid regex defined: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.html#custom-data-identifiers-constraints

logGroupAuditDestinationoptionalILogGroupReflog_group_audit_destinationoptionalILogGroupReflogGroupAuditDestinationoptionalILogGroupRefLogGroupAuditDestinationoptionalILogGroupRefLogGroupAuditDestinationoptionalILogGroupRef#
CloudWatch Logs log group to send audit findings to.

Default: no CloudWatch Logs audit destination

The log group must already exist prior to creating the data protection policy.

nameoptionalstringnameoptionalstrnameoptionalStringNameoptionalstringNameoptional*string= 'data-protection-policy-cdk'#
Name of the data protection policy.
s3BucketAuditDestinationoptionalIBucketRefs3_bucket_audit_destinationoptionalIBucketRefs3BucketAuditDestinationoptionalIBucketRefS3BucketAuditDestinationoptionalIBucketRefS3BucketAuditDestinationoptionalIBucketRef#
S3 bucket to send audit findings to.

Default: no S3 bucket audit destination

The bucket must already exist.