A company runs an application that logs user data to an Amazon CloudWatch Logs log group. The company discovers that personal information the application has logged is visible in plain text in the…

Question

Options

• ACreate an Amazon S3 bucket. Create an export task from appropriate log groups in CloudWatch.
• BCreate a customer managed AWS KMS key. Configure the KMS key policy to allow only the
• CCreate an Amazon CloudWatch data protection policy for the application log group. Configure
• DCreate an OpenSearch domain. Create an AWS Glue workflow that runs a Detect PII transform

• A
  3% (1)
• B
  6% (2)
• C
  85% (28)
• D
  6% (2)

Explanation

CloudWatch Logs data protection provides native redaction/masking of sensitive data at ingestion and query. AWS documentation states it can "detect and protect sensitive data in logs" using data identifiers, and that authorized users can "use the unmask action to view the original data." Creating a data protection policy on the log group masks PII by default for all viewers, satisfying the requirement to redact personal information. Granting only the security team permission to invoke the unmask API operation ensures that unredacted content is restricted. Option B (KMS) encrypts at rest but does not redact fields; encryption alone does not prevent plaintext visibility to authorized readers. Options A and D add complexity and latency, move data out of CloudWatch, and do not provide default inline redaction/unmask controls in CloudWatch itself. Therefore, the CloudOps-aligned, managed solution is to use CloudWatch Logs data protection with appropriate data identifiers and unmask permissions limited to the security team.

No community discussion yet for this question.