API Reference
    Preparing search index...

    Class DataMasking

    Orchestrates erasing, encrypting, and decrypting sensitive data.

    import { DataMasking } from '@aws-lambda-powertools/data-masking';

    const masker = new DataMasking();
    const masked = masker.erase(data, { fields: ['customer.ssn'] });
    Index
    constructor
    decrypt encrypt erase

    • Decrypt data using the configured provider. Automatically detects full-payload (string input) vs field-level (object input) format.

      Type Parameters

      • T

      Parameters

      Returns Promise<T>

      const decrypted = await masker.decrypt(encrypted, {
        fields: ['customer.ssn'],
      });

    • Encrypt data using the configured provider. With fields, encrypts specific values in place. Without fields, encrypts the entire payload.

      Type Parameters

      • T

      Parameters

      Returns Promise<string | T>

      const encrypted = await masker.encrypt(data, {
        fields: ['customer.ssn'],
        context: { tenantId: 'acme' },
      });

    • Irreversibly mask the entire payload with the default mask value: arrays element-wise preserving their length, and everything else with a single mask string.

      Type Parameters

      • T

      Parameters

      • data: T

        The data to mask; returned as-is when null or undefined

      Returns MaskedPayload<T>

    • Irreversibly mask fields in a data object. Returns a deep copy.

      The options compose three layers (see EraseOptions):

      • a top-level MaskingRule (regexPattern + maskFormat, dynamicMask, or customMask) sets the default masking strategy;
      • fields selects the paths to mask with that strategy — when omitted, a top-level rule is applied to every leaf value in the payload;
      • maskingRules provides per-field rules that take precedence over the top-level rule for the paths they name.

      Type Parameters

      • T

      Parameters

      • data: T

        The data to mask; returned as-is when null or undefined

      • options: EraseOptions

        Options for the operation, see EraseOptions

      Returns T

      // mask two fields with the same strategy, overriding one of them
      const masked = masker.erase(data, {
        fields: ['ssn', 'card'],
        dynamicMask: true,
        maskingRules: { card: { customMask: 'XXXX' } },
      });

    Settings
    Member Visibility

    On This Page
    Constructors
    Methods