Cloudwatch log custom data identifier not masking the data

The issue is that CloudWatch is masking the entire matched text. You need to structure it so only part of the match is masked. CloudWatch data identifiers don't have fine-grained control over partial masking.

You can possibly pre-process Before Logging. Mask the data in your application before it reaches CloudWatch:

def mask_sensitive_data(data):
    """Mask sensitive fields before logging"""
    if 'lastName' in data:
        data['lastName'] = '***'
    return data

def lambda_handler(event, context):
    test_data = {
        "ifsUuid": "123abc",
        "email": "abc@abc.org",
        "firstName": "123456789",
        "lastName": "ABC",
        "phoneNumber": "01234567899"
    }
    
    # Mask before logging
    safe_data = mask_sensitive_data(test_data.copy())
    logger.info(json.dumps(safe_data))
    
    return {'statusCode': 200}

this should result it

{"lastName": "***", "firstName": "123456789"}

Hi, thanks for the response. If I don't want pre-mask, what is the structure expected by CW to mask the data ? I'm using a regular expression which should ideally mask after it finds the text lastName.