https://github.com/telia-oss/aws-lambda-log-filter-mask
An AWS Lambda function that is designed to filter logs to remove sensitive data, mask any sensitive information, and then post the resulting data to a separate log group.
https://github.com/telia-oss/aws-lambda-log-filter-mask
aws cloudwatch cloudwatch-logs filter
Last synced: 3 months ago
JSON representation
An AWS Lambda function that is designed to filter logs to remove sensitive data, mask any sensitive information, and then post the resulting data to a separate log group.
- Host: GitHub
- URL: https://github.com/telia-oss/aws-lambda-log-filter-mask
- Owner: telia-oss
- Created: 2023-02-28T14:21:23.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2023-03-03T09:30:43.000Z (over 2 years ago)
- Last Synced: 2025-04-20T11:55:42.038Z (6 months ago)
- Topics: aws, cloudwatch, cloudwatch-logs, filter
- Language: JavaScript
- Homepage:
- Size: 144 KB
- Stars: 1
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
An AWS Lambda function that is designed to filter logs to remove sensitive data, mask any sensitive information, and then post the resulting data to a separate log group.
## Provision the Lambda using Terraform
```
module "log-filter-mask" {
source = "github.com/telia-oss/aws-lambda-log-filter-mask?ref=v0.0.3"
source_log_group = "/aws/appsync/apis/abc"
destination_log_group = "aws/sensitive/data"
sensitive_words = "password|\"password\"|new_password|\"new_password\""
placeholder = "*****"
filter_pattern = "?password ?new_password"
}
```
## Environment variables
| Variable | Description | Example |
| --------------------- | ------------|---------------------------------------------|
| DESTINATION_LOG_GROUP | Name of AWS cloudwatch destination log group | aws/sensitive/data
| SOURCE_LOG_GROUP | Name of AWS cloudwatch source log group | aws/appsync/apis/abc
| SENSITIVE_WORDS | The sensitive words in logs to mask | password|"password"|new_password|"new_password"
| PLACEHOLDER | The value to replace the value of the senstive words with | "*****"