Exception handlers in the payments API dump full HTTP bodies into CloudWatch Logs, and some bodies contain cardholder data fragments. What should developers change?
Select an answer to reveal the explanation.
Short Explanation
Logs are not a lost-and-found for PAN scraps. Scrub or drop cardholder fields before anything hits CloudWatch — debugging is not a free pass to archive payment bodies.
Full Explanation
Sensitive data must be sanitized or redacted before logging or forwarding to observability sinks. Retaining or mirroring full HTTP bodies that include cardholder fragments expands PCI scope and breach impact. Indefinite retention and public buckets worsen exposure; disabling structured logging does not solve redaction needs.