Skip to content

Commit ed3962a

Browse files
kchgkchg
authored
feat(logs): support DataProtectionPolicy in LogGroup construct (#23402)
Sensitive data protection for CloudWatch Logs was launched at re:Invent 2022. This feature will enable that property under DataProtectionPolicy as a JSON object in the LogGroup construct. Use case: A data protection policy can help safeguard sensitive data that's ingested by the log group by auditing and masking the sensitive log data. When a user who does not have permission to view masked data views a log event that includes masked data, the sensitive data is replaced by asterisks. closes #23399 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Construct Runtime Dependencies: * [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 8ef0ba2 commit ed3962a

14 files changed

+1213
-1
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/LogGroupIntegDefaultTestDeployAssertA9999A13.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "LogGroupIntegDefaultTestDeployAssertA9999A13.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/LogGroupIntegDefaultTestDeployAssertA9999A13.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/aws-cdk-log-group-integ.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"cadd724ef1cce56f77546968b304b105422abec3535dfa2a9c10aca7f84f9811": {
5+
"source": {
6+
"path": "aws-cdk-log-group-integ.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "cadd724ef1cce56f77546968b304b105422abec3535dfa2a9c10aca7f84f9811.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/aws-cdk-log-group-integ.template.json

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
{
2+
"Resources": {
3+
"LogGroupLambdaAuditF8F47F46": {
4+
"Type": "AWS::Logs::LogGroup",
5+
"Properties": {
6+
"RetentionInDays": 731
7+
},
8+
"UpdateReplacePolicy": "Retain",
9+
"DeletionPolicy": "Retain"
10+
},
11+
"auditbucketidE6660EBD": {
12+
"Type": "AWS::S3::Bucket",
13+
"UpdateReplacePolicy": "Retain",
14+
"DeletionPolicy": "Retain"
15+
},
16+
"LogGroupLambdaAC756C5B": {
17+
"Type": "AWS::Logs::LogGroup",
18+
"Properties": {
19+
"DataProtectionPolicy": {
20+
"name": "policy-name",
21+
"description": "policy description",
22+
"version": "2021-06-01",
23+
"statement": [
24+
{
25+
"sid": "audit-statement-cdk",
26+
"dataIdentifier": [
27+
{
28+
"Fn::Join": [
29+
"",
30+
[
31+
"arn:",
32+
{
33+
"Ref": "AWS::Partition"
34+
},
35+
":dataprotection::aws:data-identifier/DriversLicense-US"
36+
]
37+
]
38+
},
39+
{
40+
"Fn::Join": [
41+
"",
42+
[
43+
"arn:",
44+
{
45+
"Ref": "AWS::Partition"
46+
},
47+
":dataprotection::aws:data-identifier/EmailAddress"
48+
]
49+
]
50+
}
51+
],
52+
"operation": {
53+
"audit": {
54+
"findingsDestination": {
55+
"cloudWatchLogs": {
56+
"logGroup": {
57+
"Ref": "LogGroupLambdaAuditF8F47F46"
58+
}
59+
},
60+
"s3": {
61+
"bucket": {
62+
"Ref": "auditbucketidE6660EBD"
63+
}
64+
}
65+
}
66+
}
67+
}
68+
},
69+
{
70+
"sid": "redact-statement-cdk",
71+
"dataIdentifier": [
72+
{
73+
"Fn::Join": [
74+
"",
75+
[
76+
"arn:",
77+
{
78+
"Ref": "AWS::Partition"
79+
},
80+
":dataprotection::aws:data-identifier/DriversLicense-US"
81+
]
82+
]
83+
},
84+
{
85+
"Fn::Join": [
86+
"",
87+
[
88+
"arn:",
89+
{
90+
"Ref": "AWS::Partition"
91+
},
92+
":dataprotection::aws:data-identifier/EmailAddress"
93+
]
94+
]
95+
}
96+
],
97+
"operation": {
98+
"deidentify": {
99+
"maskConfig": {}
100+
}
101+
}
102+
}
103+
]
104+
},
105+
"RetentionInDays": 731
106+
},
107+
"UpdateReplacePolicy": "Retain",
108+
"DeletionPolicy": "Retain"
109+
}
110+
},
111+
"Parameters": {
112+
"BootstrapVersion": {
113+
"Type": "AWS::SSM::Parameter::Value<String>",
114+
"Default": "/cdk-bootstrap/hnb659fds/version",
115+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
116+
}
117+
},
118+
"Rules": {
119+
"CheckBootstrapVersion": {
120+
"Assertions": [
121+
{
122+
"Assert": {
123+
"Fn::Not": [
124+
{
125+
"Fn::Contains": [
126+
[
127+
"1",
128+
"2",
129+
"3",
130+
"4",
131+
"5"
132+
],
133+
{
134+
"Ref": "BootstrapVersion"
135+
}
136+
]
137+
}
138+
]
139+
},
140+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
141+
}
142+
]
143+
}
144+
}
145+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "31.0.0",
3+
"testCases": {
4+
"LogGroupInteg/DefaultTest": {
5+
"stacks": [
6+
"aws-cdk-log-group-integ"
7+
],
8+
"assertionStack": "LogGroupInteg/DefaultTest/DeployAssert",
9+
"assertionStackName": "LogGroupIntegDefaultTestDeployAssertA9999A13"
10+
}
11+
}
12+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/manifest.json

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{
2+
"version": "31.0.0",
3+
"artifacts": {
4+
"aws-cdk-log-group-integ.assets": {
5+
"type": "cdk:asset-manifest",
6+
"properties": {
7+
"file": "aws-cdk-log-group-integ.assets.json",
8+
"requiresBootstrapStackVersion": 6,
9+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
10+
}
11+
},
12+
"aws-cdk-log-group-integ": {
13+
"type": "aws:cloudformation:stack",
14+
"environment": "aws://unknown-account/unknown-region",
15+
"properties": {
16+
"templateFile": "aws-cdk-log-group-integ.template.json",
17+
"validateOnSynth": false,
18+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
19+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/cadd724ef1cce56f77546968b304b105422abec3535dfa2a9c10aca7f84f9811.json",
21+
"requiresBootstrapStackVersion": 6,
22+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
23+
"additionalDependencies": [
24+
"aws-cdk-log-group-integ.assets"
25+
],
26+
"lookupRole": {
27+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
28+
"requiresBootstrapStackVersion": 8,
29+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
30+
}
31+
},
32+
"dependencies": [
33+
"aws-cdk-log-group-integ.assets"
34+
],
35+
"metadata": {
36+
"/aws-cdk-log-group-integ/LogGroupLambdaAudit/Resource": [
37+
{
38+
"type": "aws:cdk:logicalId",
39+
"data": "LogGroupLambdaAuditF8F47F46"
40+
}
41+
],
42+
"/aws-cdk-log-group-integ/audit-bucket-id/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "auditbucketidE6660EBD"
46+
}
47+
],
48+
"/aws-cdk-log-group-integ/LogGroupLambda/Resource": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "LogGroupLambdaAC756C5B"
52+
}
53+
],
54+
"/aws-cdk-log-group-integ/BootstrapVersion": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "BootstrapVersion"
58+
}
59+
],
60+
"/aws-cdk-log-group-integ/CheckBootstrapVersion": [
61+
{
62+
"type": "aws:cdk:logicalId",
63+
"data": "CheckBootstrapVersion"
64+
}
65+
]
66+
},
67+
"displayName": "aws-cdk-log-group-integ"
68+
},
69+
"LogGroupIntegDefaultTestDeployAssertA9999A13.assets": {
70+
"type": "cdk:asset-manifest",
71+
"properties": {
72+
"file": "LogGroupIntegDefaultTestDeployAssertA9999A13.assets.json",
73+
"requiresBootstrapStackVersion": 6,
74+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
75+
}
76+
},
77+
"LogGroupIntegDefaultTestDeployAssertA9999A13": {
78+
"type": "aws:cloudformation:stack",
79+
"environment": "aws://unknown-account/unknown-region",
80+
"properties": {
81+
"templateFile": "LogGroupIntegDefaultTestDeployAssertA9999A13.template.json",
82+
"validateOnSynth": false,
83+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
84+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
85+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
86+
"requiresBootstrapStackVersion": 6,
87+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
88+
"additionalDependencies": [
89+
"LogGroupIntegDefaultTestDeployAssertA9999A13.assets"
90+
],
91+
"lookupRole": {
92+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
93+
"requiresBootstrapStackVersion": 8,
94+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
95+
}
96+
},
97+
"dependencies": [
98+
"LogGroupIntegDefaultTestDeployAssertA9999A13.assets"
99+
],
100+
"metadata": {
101+
"/LogGroupInteg/DefaultTest/DeployAssert/BootstrapVersion": [
102+
{
103+
"type": "aws:cdk:logicalId",
104+
"data": "BootstrapVersion"
105+
}
106+
],
107+
"/LogGroupInteg/DefaultTest/DeployAssert/CheckBootstrapVersion": [
108+
{
109+
"type": "aws:cdk:logicalId",
110+
"data": "CheckBootstrapVersion"
111+
}
112+
]
113+
},
114+
"displayName": "LogGroupInteg/DefaultTest/DeployAssert"
115+
},
116+
"Tree": {
117+
"type": "cdk:tree",
118+
"properties": {
119+
"file": "tree.json"
120+
}
121+
}
122+
}
123+
}

0 commit comments

Comments
 (0)