CloudWatch log group contains no secrets in its log events

# Apply a CloudWatch Logs data protection policy to mask secrets
resource "aws_cloudwatch_log_group" "log_group" {
  name = "<example_resource_name>"

  # Critical: Masks detected credentials so secrets aren't visible and the check passes
  data_protection_policy = jsonencode({
    Statement = [
      {
        DataIdentifier = [
          "arn:aws:dataprotection::aws:data-identifier/Credentials"
        ]
        Operation = { Audit = { FindingsDestination = {} } }
      },
      {
        DataIdentifier = [
          "arn:aws:dataprotection::aws:data-identifier/Credentials"
        ]
        Operation = { Deidentify = { MaskConfig = {} } }
      }
    ]
  })
}

# CloudFormation: apply data protection policy to mask secrets in a log group
Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: <example_resource_name>
      # Critical: Enables masking of detected credentials at egress so secrets aren't exposed
      DataProtectionPolicy: |
        {"Statement":[{"DataIdentifier":["arn:aws:dataprotection::aws:data-identifier/Credentials"],"Operation":{"Audit":{"FindingsDestination":{}}}},{"DataIdentifier":["arn:aws:dataprotection::aws:data-identifier/Credentials"],"Operation":{"Deidentify":{"MaskConfig":{}}}}]}