Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(logs): support data protection custom data identifiers #28553

Merged
merged 11 commits into from
Jan 19, 2024
Merged

feat(logs): support data protection custom data identifiers #28553

merged 11 commits into from
Jan 19, 2024

Conversation

kchg
Copy link
Contributor

@kchg kchg commented Jan 3, 2024

Feature

Support the newly launched custom data identifiers feature for CloudWatch Logs sensitive data protection.

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.html

Use Case

Custom data identifiers (CDIs) let you define your own custom regular expressions that can be used in your data protection policy. Using custom data identifiers, you can target business-specific personally identifiable information (PII) use cases that managed data identifiers can't provide. For example, you can use a custom data identifier to look for company-specific employee IDs. Custom data identifiers can be used in conjunction with managed data identifiers.

Solution

Users can now supply a regex field to the DataIdentifiers constructor. Supplying this field will enable the named identifier as a custom data identifier.

Closes #28430.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation aws-cdk-automation requested a review from a team January 3, 2024 02:06
@github-actions github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 labels Jan 3, 2024
@kchg kchg force-pushed the logs-cdi branch 2 times, most recently from f11b794 to 59054de Compare January 3, 2024 04:13
@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 3, 2024
lpizzinidev
lpizzinidev suggested changes Jan 3, 2024
View reviewed changes
Copy link
Contributor

@lpizzinidev lpizzinidev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks 👍
I left a couple of suggestions for changes in the implementation.

packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts Outdated
@@ -274,9 +299,9 @@ export class DataIdentifier {
public static readonly VEHICLEIDENTIFICATIONNUMBER = new DataIdentifier('VehicleIdentificationNumber');
public static readonly ZIPCODE_US = new DataIdentifier('ZipCode-US');

constructor(private readonly identifier: string) { }
constructor(public readonly name: string, public readonly regex?: string) { }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about declaring a separate CustomDataIdentifier class extending DataIdentifier instead?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, thanks for the suggestion.

packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts Outdated
/**
* Configuration of the data protection policy. Currently supports custom data identifiers
*/
readonly configuration: any;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's better to define an interface for the configuration, something like:

interface Configuration {
  customDataIdentifier?: CustomDataIdentifier[];
}

@aws-cdk-automation aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 3, 2024
lpizzinidev
lpizzinidev suggested changes Jan 4, 2024
View reviewed changes
Copy link
Contributor

@lpizzinidev lpizzinidev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the changes 👍
I left some notes for some minor adjustments.

packages/aws-cdk-lib/aws-logs/README.md Outdated Show resolved Hide resolved
packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts Outdated Show resolved Hide resolved
packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts Outdated Show resolved Hide resolved
packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts Outdated Show resolved Hide resolved
packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts Outdated Show resolved Hide resolved
kchg and others added 6 commits January 4, 2024 16:10
lpizzinidev
lpizzinidev approved these changes Jan 5, 2024
View reviewed changes
Copy link
Contributor

@lpizzinidev lpizzinidev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks 👍 (please fix the typo in the documentation)

@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 5, 2024
@kchg @lpizzinidev
Update packages/aws-cdk-lib/aws-logs/lib/data-protection-policy.ts
7571459 
Co-authored-by: Luca Pizzini <lpizzini7@gmail.com>
paulhcsun
paulhcsun requested changes Jan 19, 2024
View reviewed changes
Copy link
Contributor

@paulhcsun paulhcsun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good to me, just one merge conflict that needs to be resolved @kchg.

Thanks for reviewing @lpizzinidev!

paulhcsun
paulhcsun previously requested changes Jan 19, 2024
View reviewed changes
Copy link
Contributor

@paulhcsun paulhcsun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good to me, just one merge conflict that needs to be resolved @kchg.

Thanks for reviewing @lpizzinidev!

@mergify mergify bot dismissed paulhcsun’s stale review January 19, 2024 01:06

Pull request has been modified.

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 19, 2024
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 1054351
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify Mergify
Copy link
Contributor

mergify bot commented Jan 19, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit 1222aaa into aws:main Jan 19, 2024
10 checks passed
@github-actions github-actions bot mentioned this pull request Feb 1, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lpizzinidev lpizzinidev lpizzinidev approved these changes

@paulhcsun paulhcsun paulhcsun approved these changes

Assignees
No one assigned
Labels
beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

aws-logs: support custom data identfiers
4 participants
@kchg @aws-cdk-automation @lpizzinidev @paulhcsun