Copyright	(c) 2013-2023 Brendan Hay
License	Mozilla Public License, v. 2.0.
Maintainer	Brendan Hay
Stability	auto-generated
Portability	non-portable (GHC extensions)
Safe Haskell	Safe-Inferred
Language	Haskell2010

Amazonka.CloudWatchLogs.PutDataProtectionPolicy

Contents

Creating a Request
Request Lenses
Destructuring the Response
Response Lenses

Description

Creates a data protection policy for the specified log group. A data protection policy can help safeguard sensitive data that's ingested by the log group by auditing and masking the sensitive log data.

Sensitive data is detected and masked when it is ingested into the log group. When you set a data protection policy, log events ingested into the log group before that time are not masked.

By default, when a user views a log event that includes masked data, the sensitive data is replaced by asterisks. A user who has the logs:Unmask permission can use a GetLogEvents or FilterLogEvents operation with the unmask parameter set to true to view the unmasked log events. Users with the logs:Unmask can also view unmasked data in the CloudWatch Logs console by running a CloudWatch Logs Insights query with the unmask query command.

For more information, including a list of types of data that can be audited and masked, see Protect sensitive log data with masking.

Synopsis

data PutDataProtectionPolicy = PutDataProtectionPolicy' {
- logGroupIdentifier :: Text
- policyDocument :: Text
}
newPutDataProtectionPolicy :: Text -> Text -> PutDataProtectionPolicy
putDataProtectionPolicy_logGroupIdentifier :: Lens' PutDataProtectionPolicy Text
putDataProtectionPolicy_policyDocument :: Lens' PutDataProtectionPolicy Text
data PutDataProtectionPolicyResponse = PutDataProtectionPolicyResponse' {
- lastUpdatedTime :: Maybe Natural
- logGroupIdentifier :: Maybe Text
- policyDocument :: Maybe Text
- httpStatus :: Int
}
newPutDataProtectionPolicyResponse :: Int -> PutDataProtectionPolicyResponse
putDataProtectionPolicyResponse_lastUpdatedTime :: Lens' PutDataProtectionPolicyResponse (Maybe Natural)
putDataProtectionPolicyResponse_logGroupIdentifier :: Lens' PutDataProtectionPolicyResponse (Maybe Text)
putDataProtectionPolicyResponse_policyDocument :: Lens' PutDataProtectionPolicyResponse (Maybe Text)
putDataProtectionPolicyResponse_httpStatus :: Lens' PutDataProtectionPolicyResponse Int

Creating a Request

data PutDataProtectionPolicy Source #

See: newPutDataProtectionPolicy smart constructor.

Constructors

PutDataProtectionPolicy'

Fields

logGroupIdentifier :: Text
Specify either the log group name or log group ARN.
policyDocument :: Text
Specify the data protection policy, in JSON.
This policy must include two JSON blocks:
- The first block must include both a DataIdentifer array and an Operation property with an Audit action. The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.
  The Operation property with an Audit action is required to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally use that FindingsDestination object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Kinesis Data Firehose streams, and S3 buckets, they must already exist.
- The second block must include both a DataIdentifer array and an Operation property with an Deidentify action. The DataIdentifer array must exactly match the DataIdentifer array in the first block of the policy.
  The Operation property with the Deidentify action is what actually masks the data, and it must contain the "MaskConfig": {} object. The "MaskConfig": {} object must be empty.
For an example data protection policy, see the Examples section on this page.
The contents of two DataIdentifer arrays must match exactly.

Instances

Instances details

ToJSON PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods toJSON :: PutDataProtectionPolicy -> Value # toEncoding :: PutDataProtectionPolicy -> Encoding # toJSONList :: [PutDataProtectionPolicy] -> Value # toEncodingList :: [PutDataProtectionPolicy] -> Encoding #
ToHeaders PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods toHeaders :: PutDataProtectionPolicy -> [Header] #
ToPath PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods toPath :: PutDataProtectionPolicy -> ByteString #
ToQuery PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods toQuery :: PutDataProtectionPolicy -> QueryString #
AWSRequest PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Associated Types type AWSResponse PutDataProtectionPolicy # Methods request :: (Service -> Service) -> PutDataProtectionPolicy -> Request PutDataProtectionPolicy # response :: MonadResource m => (ByteStringLazy -> IO ByteStringLazy) -> Service -> Proxy PutDataProtectionPolicy -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse PutDataProtectionPolicy))) #
Generic PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Associated Types type Rep PutDataProtectionPolicy :: Type -> Type # Methods from :: PutDataProtectionPolicy -> Rep PutDataProtectionPolicy x # to :: Rep PutDataProtectionPolicy x -> PutDataProtectionPolicy #
Read PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods readsPrec :: Int -> ReadS PutDataProtectionPolicy # readList :: ReadS [PutDataProtectionPolicy] # readPrec :: ReadPrec PutDataProtectionPolicy # readListPrec :: ReadPrec [PutDataProtectionPolicy] #
Show PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods showsPrec :: Int -> PutDataProtectionPolicy -> ShowS # show :: PutDataProtectionPolicy -> String # showList :: [PutDataProtectionPolicy] -> ShowS #
NFData PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods rnf :: PutDataProtectionPolicy -> () #
Eq PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods (==) :: PutDataProtectionPolicy -> PutDataProtectionPolicy -> Bool # (/=) :: PutDataProtectionPolicy -> PutDataProtectionPolicy -> Bool #
Hashable PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods hashWithSalt :: Int -> PutDataProtectionPolicy -> Int # hash :: PutDataProtectionPolicy -> Int #
type AWSResponse PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy type AWSResponse PutDataProtectionPolicy = PutDataProtectionPolicyResponse
type Rep PutDataProtectionPolicy Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy type Rep PutDataProtectionPolicy = D1 ('MetaData "PutDataProtectionPolicy" "Amazonka.CloudWatchLogs.PutDataProtectionPolicy" "amazonka-cloudwatch-logs-2.0-6gvDalNFsfE8djZ4aTfA4V" 'False) (C1 ('MetaCons "PutDataProtectionPolicy'" 'PrefixI 'True) (S1 ('MetaSel ('Just "logGroupIdentifier") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :*: S1 ('MetaSel ('Just "policyDocument") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))

newPutDataProtectionPolicy Source #

Arguments

:: Text	`PutDataProtectionPolicy`
-> Text	`PutDataProtectionPolicy`
-> PutDataProtectionPolicy

Create a value of PutDataProtectionPolicy with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

PutDataProtectionPolicy, putDataProtectionPolicy_logGroupIdentifier - Specify either the log group name or log group ARN.

PutDataProtectionPolicy, putDataProtectionPolicy_policyDocument - Specify the data protection policy, in JSON.

This policy must include two JSON blocks:

The first block must include both a DataIdentifer array and an Operation property with an Audit action. The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.
The Operation property with an Audit action is required to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally use that FindingsDestination object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Kinesis Data Firehose streams, and S3 buckets, they must already exist.
The second block must include both a DataIdentifer array and an Operation property with an Deidentify action. The DataIdentifer array must exactly match the DataIdentifer array in the first block of the policy.
The Operation property with the Deidentify action is what actually masks the data, and it must contain the "MaskConfig": {} object. The "MaskConfig": {} object must be empty.

For an example data protection policy, see the Examples section on this page.

The contents of two DataIdentifer arrays must match exactly.

Request Lenses

putDataProtectionPolicy_logGroupIdentifier :: Lens' PutDataProtectionPolicy Text Source #

Specify either the log group name or log group ARN.

putDataProtectionPolicy_policyDocument :: Lens' PutDataProtectionPolicy Text Source #

Specify the data protection policy, in JSON.

This policy must include two JSON blocks:

The first block must include both a DataIdentifer array and an Operation property with an Audit action. The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.
The Operation property with an Audit action is required to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally use that FindingsDestination object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Kinesis Data Firehose streams, and S3 buckets, they must already exist.
The second block must include both a DataIdentifer array and an Operation property with an Deidentify action. The DataIdentifer array must exactly match the DataIdentifer array in the first block of the policy.
The Operation property with the Deidentify action is what actually masks the data, and it must contain the "MaskConfig": {} object. The "MaskConfig": {} object must be empty.

For an example data protection policy, see the Examples section on this page.

The contents of two DataIdentifer arrays must match exactly.

Destructuring the Response

data PutDataProtectionPolicyResponse Source #

See: newPutDataProtectionPolicyResponse smart constructor.

Constructors

PutDataProtectionPolicyResponse'
Fields lastUpdatedTime :: Maybe Natural The date and time that this policy was most recently updated. logGroupIdentifier :: Maybe Text The log group name or ARN that you specified in your request. policyDocument :: Maybe Text The data protection policy used for this log group. httpStatus :: Int The response's http status code.

Instances

Instances details

Generic PutDataProtectionPolicyResponse Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Associated Types type Rep PutDataProtectionPolicyResponse :: Type -> Type # Methods from :: PutDataProtectionPolicyResponse -> Rep PutDataProtectionPolicyResponse x # to :: Rep PutDataProtectionPolicyResponse x -> PutDataProtectionPolicyResponse #
Read PutDataProtectionPolicyResponse Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods readsPrec :: Int -> ReadS PutDataProtectionPolicyResponse # readList :: ReadS [PutDataProtectionPolicyResponse] # readPrec :: ReadPrec PutDataProtectionPolicyResponse # readListPrec :: ReadPrec [PutDataProtectionPolicyResponse] #
Show PutDataProtectionPolicyResponse Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods showsPrec :: Int -> PutDataProtectionPolicyResponse -> ShowS # show :: PutDataProtectionPolicyResponse -> String # showList :: [PutDataProtectionPolicyResponse] -> ShowS #
NFData PutDataProtectionPolicyResponse Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods rnf :: PutDataProtectionPolicyResponse -> () #
Eq PutDataProtectionPolicyResponse Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy Methods (==) :: PutDataProtectionPolicyResponse -> PutDataProtectionPolicyResponse -> Bool # (/=) :: PutDataProtectionPolicyResponse -> PutDataProtectionPolicyResponse -> Bool #
type Rep PutDataProtectionPolicyResponse Source #
Instance details Defined in Amazonka.CloudWatchLogs.PutDataProtectionPolicy type Rep PutDataProtectionPolicyResponse = D1 ('MetaData "PutDataProtectionPolicyResponse" "Amazonka.CloudWatchLogs.PutDataProtectionPolicy" "amazonka-cloudwatch-logs-2.0-6gvDalNFsfE8djZ4aTfA4V" 'False) (C1 ('MetaCons "PutDataProtectionPolicyResponse'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "lastUpdatedTime") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Natural)) :: S1 ('MetaSel ('Just "logGroupIdentifier") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))) :: (S1 ('MetaSel ('Just "policyDocument") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int))))

newPutDataProtectionPolicyResponse Source #

Arguments

:: Int	`$sel:httpStatus:PutDataProtectionPolicyResponse'`
-> PutDataProtectionPolicyResponse

Create a value of PutDataProtectionPolicyResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

PutDataProtectionPolicyResponse, putDataProtectionPolicyResponse_lastUpdatedTime - The date and time that this policy was most recently updated.

PutDataProtectionPolicy, putDataProtectionPolicyResponse_logGroupIdentifier - The log group name or ARN that you specified in your request.

PutDataProtectionPolicy, putDataProtectionPolicyResponse_policyDocument - The data protection policy used for this log group.

$sel:httpStatus:PutDataProtectionPolicyResponse', putDataProtectionPolicyResponse_httpStatus - The response's http status code.

Response Lenses

putDataProtectionPolicyResponse_lastUpdatedTime :: Lens' PutDataProtectionPolicyResponse (Maybe Natural) Source #

The date and time that this policy was most recently updated.

putDataProtectionPolicyResponse_logGroupIdentifier :: Lens' PutDataProtectionPolicyResponse (Maybe Text) Source #

The log group name or ARN that you specified in your request.

putDataProtectionPolicyResponse_policyDocument :: Lens' PutDataProtectionPolicyResponse (Maybe Text) Source #

The data protection policy used for this log group.

putDataProtectionPolicyResponse_httpStatus :: Lens' PutDataProtectionPolicyResponse Int Source #

The response's http status code.