aws.cloudwatch.getLogDataProtectionPolicyDocument

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = aws.cloudwatch.getLogDataProtectionPolicyDocument({
    name: "Example",
    statements: [
        {
            sid: "Audit",
            dataIdentifiers: [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
            operation: {
                audit: {
                    findingsDestination: {
                        cloudwatchLogs: {
                            logGroup: audit.name,
                        },
                        firehose: {
                            deliveryStream: auditAwsKinesisFirehoseDeliveryStream.name,
                        },
                        s3: {
                            bucket: auditAwsS3Bucket.bucket,
                        },
                    },
                },
            },
        },
        {
            sid: "Deidentify",
            dataIdentifiers: [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
            operation: {
                deidentify: {
                    maskConfig: {},
                },
            },
        },
    ],
});
const exampleLogDataProtectionPolicy = new aws.cloudwatch.LogDataProtectionPolicy("example", {
    logGroupName: exampleAwsCloudwatchLogGroup.name,
    policyDocument: example.then(example => example.json),
});

import pulumi
import pulumi_aws as aws

example = aws.cloudwatch.get_log_data_protection_policy_document(name="Example",
    statements=[
        aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementArgs(
            sid="Audit",
            data_identifiers=[
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
            operation=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationArgs(
                audit=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationAuditArgs(
                    findings_destination=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationArgs(
                        cloudwatch_logs=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogsArgs(
                            log_group=audit["name"],
                        ),
                        firehose=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehoseArgs(
                            delivery_stream=audit_aws_kinesis_firehose_delivery_stream["name"],
                        ),
                        s3=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3Args(
                            bucket=audit_aws_s3_bucket["bucket"],
                        ),
                    ),
                ),
            ),
        ),
        aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementArgs(
            sid="Deidentify",
            data_identifiers=[
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
            ],
            operation=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationArgs(
                deidentify=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyArgs(
                    mask_config=aws.cloudwatch.GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyMaskConfigArgs(),
                ),
            ),
        ),
    ])
example_log_data_protection_policy = aws.cloudwatch.LogDataProtectionPolicy("example",
    log_group_name=example_aws_cloudwatch_log_group["name"],
    policy_document=example.json)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/cloudwatch"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := cloudwatch.GetLogDataProtectionPolicyDocument(ctx, &cloudwatch.GetLogDataProtectionPolicyDocumentArgs{
			Name: "Example",
			Statements: []cloudwatch.GetLogDataProtectionPolicyDocumentStatement{
				{
					Sid: pulumi.StringRef("Audit"),
					DataIdentifiers: []string{
						"arn:aws:dataprotection::aws:data-identifier/EmailAddress",
						"arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
					},
					Operation: {
						Audit: {
							FindingsDestination: {
								CloudwatchLogs: {
									LogGroup: audit.Name,
								},
								Firehose: {
									DeliveryStream: auditAwsKinesisFirehoseDeliveryStream.Name,
								},
								S3: {
									Bucket: auditAwsS3Bucket.Bucket,
								},
							},
						},
					},
				},
				{
					Sid: pulumi.StringRef("Deidentify"),
					DataIdentifiers: []string{
						"arn:aws:dataprotection::aws:data-identifier/EmailAddress",
						"arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
					},
					Operation: {
						Deidentify: {
							MaskConfig: nil,
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = cloudwatch.NewLogDataProtectionPolicy(ctx, "example", &cloudwatch.LogDataProtectionPolicyArgs{
			LogGroupName:   pulumi.Any(exampleAwsCloudwatchLogGroup.Name),
			PolicyDocument: pulumi.String(example.Json),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = Aws.CloudWatch.GetLogDataProtectionPolicyDocument.Invoke(new()
    {
        Name = "Example",
        Statements = new[]
        {
            new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementInputArgs
            {
                Sid = "Audit",
                DataIdentifiers = new[]
                {
                    "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                    "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
                },
                Operation = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationInputArgs
                {
                    Audit = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditInputArgs
                    {
                        FindingsDestination = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationInputArgs
                        {
                            CloudwatchLogs = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogsInputArgs
                            {
                                LogGroup = audit.Name,
                            },
                            Firehose = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehoseInputArgs
                            {
                                DeliveryStream = auditAwsKinesisFirehoseDeliveryStream.Name,
                            },
                            S3 = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3InputArgs
                            {
                                Bucket = auditAwsS3Bucket.Bucket,
                            },
                        },
                    },
                },
            },
            new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementInputArgs
            {
                Sid = "Deidentify",
                DataIdentifiers = new[]
                {
                    "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                    "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
                },
                Operation = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationInputArgs
                {
                    Deidentify = new Aws.CloudWatch.Inputs.GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyInputArgs
                    {
                        MaskConfig = null,
                    },
                },
            },
        },
    });

    var exampleLogDataProtectionPolicy = new Aws.CloudWatch.LogDataProtectionPolicy("example", new()
    {
        LogGroupName = exampleAwsCloudwatchLogGroup.Name,
        PolicyDocument = example.Apply(getLogDataProtectionPolicyDocumentResult => getLogDataProtectionPolicyDocumentResult.Json),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cloudwatch.CloudwatchFunctions;
import com.pulumi.aws.cloudwatch.inputs.GetLogDataProtectionPolicyDocumentArgs;
import com.pulumi.aws.cloudwatch.LogDataProtectionPolicy;
import com.pulumi.aws.cloudwatch.LogDataProtectionPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = CloudwatchFunctions.getLogDataProtectionPolicyDocument(GetLogDataProtectionPolicyDocumentArgs.builder()
            .name("Example")
            .statements(            
                GetLogDataProtectionPolicyDocumentStatementArgs.builder()
                    .sid("Audit")
                    .dataIdentifiers(                    
                        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                        "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US")
                    .operation(GetLogDataProtectionPolicyDocumentStatementOperationArgs.builder()
                        .audit(GetLogDataProtectionPolicyDocumentStatementOperationAuditArgs.builder()
                            .findingsDestination(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationArgs.builder()
                                .cloudwatchLogs(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogsArgs.builder()
                                    .logGroup(audit.name())
                                    .build())
                                .firehose(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehoseArgs.builder()
                                    .deliveryStream(auditAwsKinesisFirehoseDeliveryStream.name())
                                    .build())
                                .s3(GetLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3Args.builder()
                                    .bucket(auditAwsS3Bucket.bucket())
                                    .build())
                                .build())
                            .build())
                        .build())
                    .build(),
                GetLogDataProtectionPolicyDocumentStatementArgs.builder()
                    .sid("Deidentify")
                    .dataIdentifiers(                    
                        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
                        "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US")
                    .operation(GetLogDataProtectionPolicyDocumentStatementOperationArgs.builder()
                        .deidentify(GetLogDataProtectionPolicyDocumentStatementOperationDeidentifyArgs.builder()
                            .maskConfig()
                            .build())
                        .build())
                    .build())
            .build());

        var exampleLogDataProtectionPolicy = new LogDataProtectionPolicy("exampleLogDataProtectionPolicy", LogDataProtectionPolicyArgs.builder()        
            .logGroupName(exampleAwsCloudwatchLogGroup.name())
            .policyDocument(example.applyValue(getLogDataProtectionPolicyDocumentResult -> getLogDataProtectionPolicyDocumentResult.json()))
            .build());

    }
}

resources:
  exampleLogDataProtectionPolicy:
    type: aws:cloudwatch:LogDataProtectionPolicy
    name: example
    properties:
      logGroupName: ${exampleAwsCloudwatchLogGroup.name}
      policyDocument: ${example.json}
variables:
  example:
    fn::invoke:
      Function: aws:cloudwatch:getLogDataProtectionPolicyDocument
      Arguments:
        name: Example
        statements:
          - sid: Audit
            dataIdentifiers:
              - arn:aws:dataprotection::aws:data-identifier/EmailAddress
              - arn:aws:dataprotection::aws:data-identifier/DriversLicense-US
            operation:
              audit:
                findingsDestination:
                  cloudwatchLogs:
                    logGroup: ${audit.name}
                  firehose:
                    deliveryStream: ${auditAwsKinesisFirehoseDeliveryStream.name}
                  s3:
                    bucket: ${auditAwsS3Bucket.bucket}
          - sid: Deidentify
            dataIdentifiers:
              - arn:aws:dataprotection::aws:data-identifier/EmailAddress
              - arn:aws:dataprotection::aws:data-identifier/DriversLicense-US
            operation:
              deidentify:
                maskConfig: {}

function getLogDataProtectionPolicyDocument(args: GetLogDataProtectionPolicyDocumentArgs, opts?: InvokeOptions): Promise<GetLogDataProtectionPolicyDocumentResult>
function getLogDataProtectionPolicyDocumentOutput(args: GetLogDataProtectionPolicyDocumentOutputArgs, opts?: InvokeOptions): Output<GetLogDataProtectionPolicyDocumentResult>

def get_log_data_protection_policy_document(description: Optional[str] = None,
                                            name: Optional[str] = None,
                                            statements: Optional[Sequence[GetLogDataProtectionPolicyDocumentStatement]] = None,
                                            version: Optional[str] = None,
                                            opts: Optional[InvokeOptions] = None) -> GetLogDataProtectionPolicyDocumentResult
def get_log_data_protection_policy_document_output(description: Optional[pulumi.Input[str]] = None,
                                            name: Optional[pulumi.Input[str]] = None,
                                            statements: Optional[pulumi.Input[Sequence[pulumi.Input[GetLogDataProtectionPolicyDocumentStatementArgs]]]] = None,
                                            version: Optional[pulumi.Input[str]] = None,
                                            opts: Optional[InvokeOptions] = None) -> Output[GetLogDataProtectionPolicyDocumentResult]

func GetLogDataProtectionPolicyDocument(ctx *Context, args *GetLogDataProtectionPolicyDocumentArgs, opts ...InvokeOption) (*GetLogDataProtectionPolicyDocumentResult, error)
func GetLogDataProtectionPolicyDocumentOutput(ctx *Context, args *GetLogDataProtectionPolicyDocumentOutputArgs, opts ...InvokeOption) GetLogDataProtectionPolicyDocumentResultOutput

public static class GetLogDataProtectionPolicyDocument 
{
    public static Task<GetLogDataProtectionPolicyDocumentResult> InvokeAsync(GetLogDataProtectionPolicyDocumentArgs args, InvokeOptions? opts = null)
    public static Output<GetLogDataProtectionPolicyDocumentResult> Invoke(GetLogDataProtectionPolicyDocumentInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetLogDataProtectionPolicyDocumentResult> getLogDataProtectionPolicyDocument(GetLogDataProtectionPolicyDocumentArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet

fn::invoke:
  function: aws:cloudwatch/getLogDataProtectionPolicyDocument:getLogDataProtectionPolicyDocument
  arguments:
    # arguments dictionary