A fintech app writes account numbers to CloudWatch Logs and publishes order alerts via SNS that sometimes include emails. Compliance requires automatic redaction in logs and topics with audits of detected identifiers. Which masking control should the engineer implement to protect sensitive data in transit through logs and notifications?
Select an answer to reveal the explanation.
Short Explanation
You're catching sensitive bits right where they flow. Data protection policies scan log events, mask matches, and audit what they found, while a Guardrails-backed function sanitizes notifications.
Full Explanation
CloudWatch Logs data protection policies use managed data identifiers to detect PII, credentials, and financial identifiers, mask matches in log events, and emit audit findings and metrics. For SNS, Amazon SNS message data protection policies are no longer available to new customers as of April 30, 2026, and AWS recommends a Lambda function that applies Amazon Bedrock Guardrails sensitive-information filters to redact, block, or log messages before they reach the destination topic. Together these satisfy redaction plus auditability across both channels. Using only retention plus encryption fails by concept because encryption protects confidentiality at rest and retention controls lifecycle, but neither parses payloads nor redacts identifiers before storage or delivery. Using IAM deny policies fails because IAM authorizes actions on resources and cannot inspect message bodies to transform sensitive substrings in flight. Using VPC flow and access logging fails because those logs record network and delivery metadata rather than scanning application payload content for identifiers. For the exam, remember that detection with mask, audit, or block actions is a payload-inspection capability, not an encryption or access feature, and in practice verify identifier coverage, sample findings in audit mode first, and alert on masking metrics.