Masking sensitive information in records of filtered accesses to unstructured data
Unstructured data items are stored at an object storage service. A filtering requirement to be used to generate a result set for an access request is determined. Using a transformed representation of the filtering requirement, a target set of tokens of the filtering requirement which are to be obfuscated within a log record is identified. A log record that comprises substitute tokens for the target set of tokens is generated and stored.
1. A computer-implemented method, comprising performing, at a storage service of a cloud computing environment:
obtaining an indication of: (a) a policy to be used to detect sensitive data within one or more categories of items at the storage service and (b) a masking methodology to be applied to detected examples of sensitive data;
receiving a query; and
applying the masking methodology to a particular example of sensitive data detected, using the policy, in response to receiving the query.
2. The computer-implemented method as recited in claim 1 , further comprising performing, at the storage service of the cloud computing environment:
obtaining a sensitive-strings dictionary; and
detecting, in accordance with the policy, the particular example of sensitive data based at least in part on looking up one or more tokens in the sensitive-strings dictionary.
3. The computer-implemented method as recited in claim 1 , wherein the indication of the policy is obtained via a programmatic interface from a client of the storage service.
4. The computer-implemented method as recited in claim 1 , further comprising performing, at the storage service of the cloud computing environment:
detecting, in accordance with the policy, the particular example of sensitive data based at least in part on identifying a numeric value within a range indicated by a client of the storage service.
5. The computer-implemented method as recited in claim 1 , wherein applying the masking methodology comprises replacing a first string comprising sensitive data with a substitute string.
6. The computer-implemented method as recited in claim 1 , further comprising:
storing an unstructured data object at the storage service; and
generating a response to the query, wherein said generating comprises applying one or more interpretation rules indicated in the query to the unstructured data object.
7. The computer-implemented method as recited in claim 1 , wherein the one or more categories of items include log records.
8. A system, comprising:
one or more computing devices of a storage service of a cloud computing environment;
wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
obtain an indication of: (a) a policy to be used to detect sensitive data within one or more categories of items and (b) a masking methodology to be applied to detected examples of sensitive data;
receive a query; and
apply the masking methodology to a particular example of sensitive data detected, using the policy, in response to receiving the query.
9. The system as recited in claim 8 , wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
generate a sensitive-strings dictionary; and
detect, in accordance with the policy, the particular example of sensitive data based at least in part on looking up one or more tokens in the sensitive-strings dictionary.
10. The system as recited in claim 8 , wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
detect, in accordance with the policy, the particular example of sensitive data based at least in part on identifying a literal.
11. The system as recited in claim 8 , wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
detect, in accordance with the policy, the particular example of sensitive data based at least in part on identifying a numeric value within a range indicated by a client of the storage service.
12. The system as recited in claim 8 , wherein the indication of the policy is obtained via a programmatic interface from a client of the storage service.
13. The system as recited in claim 8 , wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
store an unstructured data object the storage service; and
apply one or more interpretation rules indicated in the query to the unstructured data object.
14. The system as recited in claim 8 , wherein the one or more categories of items include log records.
15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to:
obtain an indication of: (a) a policy to be used to detect sensitive data within one or more categories of items at a storage service and (b) a masking methodology to be applied to detected examples of sensitive data;
determine that a query has been received at the storage service; and
apply the masking methodology to a particular example of sensitive data detected, using the policy, in response to reception of the query.
16. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that when executed on or across one or more processors further cause the one or more processors to:
detect, in accordance with the policy, the particular example of sensitive data based at least in part on looking up one or more tokens in a dictionary.
17. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that when executed on or across one or more processors further cause the one or more processors to:
detect, in accordance with the policy, the particular example of sensitive data based at least in part on identifying a constant.
18. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that when executed on or across one or more processors further cause the one or more processors to:
detect, in accordance with the policy, the particular example of sensitive data based at least in part on identifying a numeric value within a range indicated by a client of the storage service.
19. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the masking methodology comprises replacing a first string comprising sensitive data with a substitute string.
20. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that when executed on or across one or more processors further cause the one or more processors to:
store an unstructured data object at the storage service; and
apply one or more interpretation rules indicated in the query to the unstructured data object.