Protect CloudWatch Logs data with masking policies

Learn how to protect sensitive information in Amazon CloudWatch Logs using data protection policies. You will start by connecting to a preconfigured EC2 instance that is already sending Nginx access log to CloudWatch, then review the log events in CloudWatch to see how sensitive fields (client IP addresses) appear by default. From there, you will create a log group–level data protection policy using AWS’s managed data identifiers (IpAddress) to automatically detect and mask IP addresses in new incoming log events.