A failed ETL row currently appears in an error log.
Keep a correlation identifier for investigation without exposing email or phone values.
Which audit-log approach is most appropriate?
Redact sensitive fields before logging and retain only a correlation ID, hash, and safe error metadata.
Detailed explanation
Anyone with log access could see the personal data.
Anyone with log access could see the personal data.
Evidence and reproducibility are lost.
Evidence and reproducibility are lost.
Investigation context remains while raw PII is not copied to logs.
Investigation context remains while raw PII is not copied to logs.
Short exposure still violates protection and audit needs.
Short exposure still violates protection and audit needs.
Check official documentation
Compare the following points with the official documentation.
AWS CloudWatch Logs data protection、Macie、data maskingの公式説明を確認する。
What to confirm
短期削除と、ログ生成時点でPIIを出さない保護の違いを説明できる。
Key points
- Log redaction
- PII
- Data protection
- Correlation ID
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Minimum information
Keep error codes, versions, and safe identifiers rather than the source row.
Secondary leakage
Inspect log shipping, notifications, backups, and stack traces for raw values.