{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T13:36:43.315Z",
  "record_id": "VXI-EXT-PROCUREMENT-CLOUDWATCH-MASK-01-v1",
  "record_kind": "external_reference",
  "title": "CloudWatch masking: Old events and privileged reads",
  "system": "Amazon CloudWatch Logs",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does enabling CloudWatch masking hide sensitive content in every stored log?",
  "near_questions": [
    "Are earlier CloudWatch logs masked retroactively?",
    "When was the data protection policy applied?",
    "Which sensitive identifiers are selected?",
    "Can authorized users unmask values?",
    "Does masking delete the original content?",
    "Are account and log-group policies both active?",
    "Do both policies contribute identifiers?",
    "Which log streams predate the policy?",
    "Does a clean view prove every value was detected?",
    "Who can retrieve unmasked content?",
    "What evidence supports a historical-redaction claim?",
    "Can I save the masking coverage review?"
  ],
  "supported_claims": [
    {
      "claim": "Data protection detects and masks matching data as it is ingested. Earlier log events are not masked by a newly applied policy, and principals with logs:Unmask can view unmasked content. This is a presentation and access-control boundary, not evidence that the original content was erased.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Data protection detects and masks matching data as it is ingested. Earlier log events are not masked by a newly applied policy, and principals with logs:Unmask can view unmasked content. This is a presentation and access-control boundary, not evidence that the original content was erased.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "CloudWatch Logs data protection",
    "source_url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-CLOUDWATCH-MASK-01-v1",
    "candidate_record_sha256": "1c645a3881351819e97eb23a6b5ab0d98ce85e08969da4cc0c0dca3766ec75e4",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Data protection detects and masks matching data as it is ingested. Earlier log events are not masked by a newly applied policy, and principals with logs:Unmask can view unmasked content. This is a presentation and access-control boundary, not evidence that the original content was erased.",
    "required_buyer_context": "Log group, ingestion dates, data identifiers and unmask permissions. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "A new masking policy removes sensitive content from all stored logs.",
    "documented_statement": {
      "status": "documented",
      "statement": "Data protection detects and masks matching data as it is ingested. Earlier log events are not masked by a newly applied policy, and principals with logs:Unmask can view unmasked content. This is a presentation and access-control boundary, not evidence that the original content was erased.",
      "source_ids": [
        "cloudwatch"
      ]
    },
    "buyer_evidence_required": [
      "Policy activation time and managed identifiers.",
      "Log ingestion dates and policy coverage.",
      "Principals with unmask authority and retained copies."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Check historical events and privileged reads before accepting an all-logs redaction claim."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "cloudwatch",
        "url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html",
        "final_url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html",
        "title": "CloudWatch Logs data protection",
        "checked_on": "2026-10-16",
        "sha256": "f6e26380aa44d3298a070fcf95554302c70a56ed59656608e1763c8930b1d4ec",
        "bytes": 22613
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the difference between masked viewing, historical coverage and removal.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Log group, ingestion dates, data identifiers and unmask permissions."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#cloudwatch-masking-ingestion-unmask-boundary",
  "machine_readable_record": "/varexis-index/records/cloudwatch-masking-ingestion-unmask-boundary.json"
}