getLogDataProtectionPolicyDocument function

Generates a CloudWatch Log Group Data Protection Policy document in JSON format for use with the aws.cloudwatch.LogDataProtectionPolicy resource.

> For more information about data protection policies, see the Help protect sensitive log data with masking.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = aws.cloudwatch.getLogDataProtectionPolicyDocument({
    statements: [
        {
            operation: {
                audit: {
                    findingsDestination: {
                        cloudwatchLogs: {
                            logGroup: audit.name,
                        },
                        firehose: {
                            deliveryStream: auditAwsKinesisFirehoseDeliveryStream.name,
                        },
                        s3: {
                            bucket: auditAwsS3Bucket.bucket,
                        },
                    },
                },
            },
            sid: "Audit",
            dataIdentifiers: [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
        },
        {
            operation: {
                deidentify: {
                    maskConfig: {},
                },
            },
            sid: "Deidentify",
            dataIdentifiers: [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
        },
    ],
    name: "Example",
});
const exampleLogDataProtectionPolicy = new aws.cloudwatch.LogDataProtectionPolicy("example", {
    logGroupName: exampleAwsCloudwatchLogGroup.name,
    policyDocument: example.then(example => example.json),
});

import pulumi
import pulumi_aws as aws

example = aws.cloudwatch.get_log_data_protection_policy_document(statements=[
        {
            "operation": {
                "audit": {
                    "findings_destination": {
                        "cloudwatch_logs": {
                            "log_group": audit["name"],
                        },
                        "firehose": {
                            "delivery_stream": audit_aws_kinesis_firehose_delivery_stream["name"],
                        },
                        "s3": {
                            "bucket": audit_aws_s3_bucket["bucket"],
                        },
                    },
                },
            },
            "sid": "Audit",
            "data_identifiers": [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
        },
        {
            "operation": {
                "deidentify": {
                    "mask_config": {},
                },
            },
            "sid": "Deidentify",
            "data_identifiers": [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
        },
    ],
    name="Example")
example_log_data_protection_policy = aws.cloudwatch.LogDataProtectionPolicy("example",
    log_group_name=example_aws_cloudwatch_log_group["name"],
    policy_document=example.json)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var example = Aws.CloudWatch.GetLogDataProtectionPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementInputArgs
            {
                Operation = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationInputArgs
                {
                    Audit = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditInputArgs
                    {
                        FindingsDestination = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationInputArgs
                        {
                            CloudwatchLogs = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogsInputArgs
                            {
                                LogGroup = audit.Name,
                            },
                            Firehose = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehoseInputArgs
                            {
                                DeliveryStream = auditAwsKinesisFirehoseDeliveryStream.Name,
                            },
                            S3 = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3InputArgs
                            {
                                Bucket = auditAwsS3Bucket.Bucket,
                            },
                        },
                    },
                },
                Sid = "Audit",
                DataIdentifiers = new[]
                {
                    "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                    "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
                },
            },
            new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementInputArgs
            {
                Operation = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationInputArgs
                {
                    Deidentify = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyInputArgs
                    {
                        MaskConfig = null,
                    },
                },
                Sid = "Deidentify",
                DataIdentifiers = new[]
                {
                    "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                    "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
                },
            },
        },
        Name = "Example",
    });

    var exampleLogDataProtectionPolicy = new Aws.CloudWatch.LogDataProtectionPolicy("example", new()
    {
        LogGroupName = exampleAwsCloudwatchLogGroup.Name,
        PolicyDocument = example.Apply(getLogDataProtectionPolicyDocumentResult => getLogDataProtectionPolicyDocumentResult.Json),
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudwatch"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := cloudwatch.GetLogDataProtectionPolicyDocument(ctx, &cloudwatch.GetLogDataProtectionPolicyDocumentArgs{
			Statements: []cloudwatch.GetLogDataProtectionPolicyDocumentStatement{
				{
					Operation: {
						Audit: {
							FindingsDestination: {
								CloudwatchLogs: {
									LogGroup: audit.Name,
								},
								Firehose: {
									DeliveryStream: auditAwsKinesisFirehoseDeliveryStream.Name,
								},
								S3: {
									Bucket: auditAwsS3Bucket.Bucket,
								},
							},
						},
					},
					Sid: pulumi.StringRef("Audit"),
					DataIdentifiers: []string{
						"arn:aws:dataprotection::aws:data-identifier/EmailAddress",
						"arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
					},
				},
				{
					Operation: {
						Deidentify: {
							MaskConfig: {},
						},
					},
					Sid: pulumi.StringRef("Deidentify"),
					DataIdentifiers: []string{
						"arn:aws:dataprotection::aws:data-identifier/EmailAddress",
						"arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
					},
				},
			},
			Name: "Example",
		}, nil)
		if err != nil {
			return err
		}
		_, err = cloudwatch.NewLogDataProtectionPolicy(ctx, "example", &cloudwatch.LogDataProtectionPolicyArgs{
			LogGroupName:   pulumi.Any(exampleAwsCloudwatchLogGroup.Name),
			PolicyDocument: pulumi.String(example.Json),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_cloudwatch_getlogdataprotectionpolicydocument" "example" {
  statements {
    operation = {
      audit = {
        findings_destination = {
          cloudwatch_logs = {
            log_group = audit.name
          }
          firehose = {
            delivery_stream = auditAwsKinesisFirehoseDeliveryStream.name
          }
          s3 = {
            bucket = auditAwsS3Bucket.bucket
          }
        }
      }
    }
    sid              = "Audit"
    data_identifiers = ["arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US"]
  }
  statements {
    operation = {
      deidentify = {
        mask_config = {}
      }
    }
    sid              = "Deidentify"
    data_identifiers = ["arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US"]
  }
  name = "Example"
}

resource "aws_cloudwatch_logdataprotectionpolicy" "example" {
  log_group_name  = exampleAwsCloudwatchLogGroup.name
  policy_document = data.aws_cloudwatch_getlogdataprotectionpolicydocument.example.json
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cloudwatch.CloudwatchFunctions;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogsArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehoseArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3Args;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyArgs;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyMaskConfigArgs;
import com.pulumi.aws.cloudwatch.LogDataProtectionPolicy;
import com.pulumi.aws.cloudwatch.LogDataProtectionPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = CloudwatchFunctions.getLogDataProtectionPolicyDocument(GetLogDataProtectionPolicyDocumentArgs.builder()
            .statements(
                GetLogDataProtectionPolicyDocumentStatementArgs.builder()
                    .operation(GetLogDataProtectionPolicyDocumentStatementOperationArgs.builder()
                        .audit(GetLogDataProtectionPolicyDocumentStatementOperationAuditArgs.builder()
                            .findingsDestination(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationArgs.builder()
                                .cloudwatchLogs(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogsArgs.builder()
                                    .logGroup(audit.name())
                                    .build())
                                .firehose(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehoseArgs.builder()
                                    .deliveryStream(auditAwsKinesisFirehoseDeliveryStream.name())
                                    .build())
                                .s3(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3Args.builder()
                                    .bucket(auditAwsS3Bucket.bucket())
                                    .build())
                                .build())
                            .build())
                        .build())
                    .sid("Audit")
                    .dataIdentifiers(
                        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                        "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US")
                    .build(),
                GetLogDataProtectionPolicyDocumentStatementArgs.builder()
                    .operation(GetLogDataProtectionPolicyDocumentStatementOperationArgs.builder()
                        .deidentify(GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyArgs.builder()
                            .maskConfig(GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyMaskConfigArgs.builder()
                                .build())
                            .build())
                        .build())
                    .sid("Deidentify")
                    .dataIdentifiers(
                        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                        "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US")
                    .build())
            .name("Example")
            .build());

        var exampleLogDataProtectionPolicy = new LogDataProtectionPolicy("exampleLogDataProtectionPolicy", LogDataProtectionPolicyArgs.builder()
            .logGroupName(exampleAwsCloudwatchLogGroup.name())
            .policyDocument(example.json())
            .build());

    }
}

resources:
  exampleLogDataProtectionPolicy:
    type: aws:cloudwatch:LogDataProtectionPolicy
    name: example
    properties:
      logGroupName: ${exampleAwsCloudwatchLogGroup.name}
      policyDocument: ${example.json}
variables:
  example:
    fn::invoke:
      function: aws:cloudwatch:getLogDataProtectionPolicyDocument
      arguments:
        statements:
          - operation:
              audit:
                findingsDestination:
                  cloudwatchLogs:
                    logGroup: ${audit.name}
                  firehose:
                    deliveryStream: ${auditAwsKinesisFirehoseDeliveryStream.name}
                  s3:
                    bucket: ${auditAwsS3Bucket.bucket}
            sid: Audit
            dataIdentifiers:
              - arn:aws:dataprotection::aws:data-identifier/EmailAddress
              - arn:aws:dataprotection::aws:data-identifier/DriversLicense-US
          - operation:
              deidentify:
                maskConfig: {}
            sid: Deidentify
            dataIdentifiers:
              - arn:aws:dataprotection::aws:data-identifier/EmailAddress
              - arn:aws:dataprotection::aws:data-identifier/DriversLicense-US
        name: Example

args Arguments passed to this invoke. Arguments for getLogDataProtectionPolicyDocument. options Invoke options controlling this call.