Skip to content

AWS CloudWatch Logs: reject unknown managed data identifiers in data protection policies #1702

Open
Open
AWS CloudWatch Logs: reject unknown managed data identifiers in data protection policies#1702
Labels
P3Low priorityaws-parityAWS real-cloud parity gapbugSomething isn't working

Description

@NitinKumar004
NitinKumar004
opened on Oct 23, 2026

PutDataProtectionPolicy and PutAccountPolicy (DATA_PROTECTION_POLICY) accept any managed identifier ARN. Only EmailAddress, IpAddress, AwsSecretKey and CreditCardNumber actually mask, and an unknown or misspelled identifier is silently ignored. Real AWS rejects unknown identifiers with InvalidParameterException.

Goal: validate DataIdentifier ARNs against the published managed identifier list, and add masking for more of the common identifiers.

Where: providers/aws/cloudwatchlogs/dataprotection. Follow-up from #1700.

Activity

  1. NitinKumar004
    added
    bugSomething isn't working
    aws-parityAWS real-cloud parity gap
    P3Low priority
    on Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P3Low priorityaws-parityAWS real-cloud parity gapbugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions