Automated PII redaction for Amazon RDS for PostgreSQL audit logs
Database Blog
This article demonstrates how to deploy a serverless pipeline that automatically redacts PII from Amazon RDS for PostgreSQL audit logs and stores them irreversibly in Amazon S3 for compliance.
- Permanently removes SSNs, credit cards, emails, names, and 30+ PII types from audit logs before archiving
- Uses AWS Step Functions, Amazon Comprehend, and CloudFormation for automated redaction pipeline
- Stores redacted logs in S3 and makes them queryable through Amazon Athena
- Provides irreversible redaction unlike CloudWatch Logs Data Protection's reversible masking
- Includes validation queries to confirm no PII patterns remain in archived logs
- Deployable via single CloudFormation template with three deployment options
- Estimated cost: $73/month at low activity, $161/month at high activity
The solution enables organizations to meet GDPR, HIPAA, and PCI-DSS compliance requirements by creating permanent, auditor-safe archives of database audit logs with all sensitive data irreversibly removed.
The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.
Related articles
2026
2026
2026
2026
The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.