Question

A developer is building a Lambda function that processes customer support tickets. Each ticket payload contains customer email addresses and phone numbers. During development, the team enabled verbose logging that writes the full payload to Amazon CloudWatch Logs to aid debugging. A security review flags that PII is being persisted in the logs. The team must continue capturing enough diagnostic information to troubleshoot failures while preventing PII exposure. What is the MOST appropriate approach?

Accepted Answer

Redact or mask PII fields (email, phone) in the application code before writing any log statements, logging only non-sensitive identifiers such as a ticket ID.

Answer

Enable server-side encryption on the CloudWatch Logs group with a KMS key so the PII in the logs is protected at rest.

Answer

Set a short retention period on the CloudWatch Logs group so the PII is automatically deleted after a few days.

Answer

Move the verbose log output to Amazon S3 with default encryption instead of CloudWatch Logs.