aws_logs.DataProtectionPolicy: policy keywords start with lower case and that's why are not visible under aws web console

[raveenplgithub]

Describe the bug

Policy created by aws cdk is not visible under "Log group custom data identifier" section. When I modify the policy manually on web console so that every keyword starts with upper case then it becomes visible.

Below code I use to create a log group with data protenction policy enabled:

        data_protection_policy = aws_logs.DataProtectionPolicy(
            name="data_protection_policy",
            identifiers=[
                aws_logs.CustomDataIdentifier(
                    "A",
                    '"A*",
                ),
                aws_logs.CustomDataIdentifier(
                    "B",
                    '"B*,
                ),
                aws_logs.CustomDataIdentifier(
                    "C",
                    '"C*',
                ),
            ],
        )
        log_group = aws_logs.LogGroup(
            self,
            "somegroupname",
            log_group_name=_resource_suffix,
            retention=retention,
            data_protection_policy=data_protection_policy,
        )

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Policy should be visible on the web console.

Current Behavior

Policy is not visible on the web console.

Reproduction Steps

See description.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.167.1

Framework Version

No response

Node.js Version

20.13.1

OS

Ubuntu

Language

Python

Language Version

No response

Other information

No response

[ashishdhingra]

Reproducible using below CDK code:

import * as cdk from 'aws-cdk-lib';
import * as logs from 'aws-cdk-lib/aws-logs';

export class CdktestStackNew extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
      logGroupName: 'auditDestinationForCDK',
    });
    
    const dataProtectionPolicy = new logs.DataProtectionPolicy({
      name: 'data_protection_policy',
      description: 'policy description',
      identifiers: [
        new logs.CustomDataIdentifier('A', '"A*'),
        new logs.CustomDataIdentifier('B', '"B*'),
        new logs.CustomDataIdentifier('C', '"C*'),
        new logs.CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}')],
      logGroupAuditDestination: logGroupDestination,
    });
    
    new logs.LogGroup(this, 'LogGroupLambda', {
      logGroupName: 'cdkIntegLogGroup',
      dataProtectionPolicy: dataProtectionPolicy,
    });
  }
}

This synthesizes into below CloudFormation template:

Resources:
  LogGroupLambdaAuditF8F47F46:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: auditDestinationForCDK
      RetentionInDays: 731
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Metadata:
      aws:cdk:path: CdktestStackNew/LogGroupLambdaAudit/Resource
  LogGroupLambdaAC756C5B:
    Type: AWS::Logs::LogGroup
    Properties:
      DataProtectionPolicy:
        name: data_protection_policy
        description: policy description
        version: "2021-06-01"
        configuration:
          customDataIdentifier:
            - name: A
              regex: '"A*'
            - name: B
              regex: '"B*'
            - name: C
              regex: '"C*'
            - name: EmployeeId
              regex: EmployeeId-\d{9}
        statement:
          - sid: audit-statement-cdk
            dataIdentifier:
              - A
              - B
              - C
              - EmployeeId
            operation:
              audit:
                findingsDestination:
                  cloudWatchLogs:
                    logGroup:
                      Ref: LogGroupLambdaAuditF8F47F46
          - sid: redact-statement-cdk
            dataIdentifier:
              - A
              - B
              - C
              - EmployeeId
            operation:
              deidentify:
                maskConfig: {}
      LogGroupName: cdkIntegLogGroup
      RetentionInDays: 731
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Metadata:
      aws:cdk:path: CdktestStackNew/LogGroupLambda/Resource
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Analytics: v2:deflate64:H4sIAAAAAAAA/zPSMzS30DNUTCwv1k1OydbNyUzSqw4uSUzO1kksL47PyU8v1qv2yU93L8ovLdBxTsuDsWtrdfLyU1L1sor1ywwt9IwM9EwUs4ozM3WLSvNKMnNT9YIgNABcSxHUYQAAAA==
    Metadata:
      aws:cdk:path: CdktestStackNew/CDKMetadata/Default
Parameters:
  BootstrapVersion:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /cdk-bootstrap/hnb659fds/version
    Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]

Deploying it using cdk deploy creates cdkIntegLogGroup with the following data protection policy:

{
  "configuration": {
    "customDataIdentifier": [
      {
        "regex": "\"A*",
        "name": "A"
      },
      {
        "regex": "\"B*",
        "name": "B"
      },
      {
        "regex": "\"C*",
        "name": "C"
      },
      {
        "regex": "EmployeeId-\\d{9}",
        "name": "EmployeeId"
      }
    ]
  },
  "name": "data_protection_policy",
  "statement": [
    {
      "dataIdentifier": [
        "A",
        "B",
        "C",
        "EmployeeId"
      ],
      "operation": {
        "audit": {
          "findingsDestination": {
            "cloudWatchLogs": {
              "logGroup": "auditDestinationForCDK"
            }
          }
        }
      },
      "sid": "audit-statement-cdk"
    },
    {
      "dataIdentifier": [
        "A",
        "B",
        "C",
        "EmployeeId"
      ],
      "operation": {
        "deidentify": {
          "maskConfig": {}
        }
      },
      "sid": "redact-statement-cdk"
    }
  ],
  "description": "policy description",
  "version": "2021-06-01"
}

If we observe the casing of the various element names, it follows Camel case. This is different from what is mentioned at Understanding data protection policies where it follows pascal case. Manually changing to use the correct casing via AWS console, makes the issue go away.

Looks like in CDK library, it uses incorrect casing here.

@raveenplgithub Thanks for the report. If possible, free to contribute PR to fix the issue.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.