2.3.5 Data Masking and Sanitization

import re

def mask_email(email):
    parts = email.split('@')
    return parts[0][0] + '***@' + parts[1]

def mask_credit_card(cc):
    return '**** **** **** ' + cc[-4:]

def mask_log_message(message):
    # Mask emails
    message = re.sub(r'[\w.-]+@[\w.-]+', '***@***.***', message)
    # Mask credit cards
    message = re.sub(
        r'\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b',
        '**** **** **** ****', message
    )
    return message

import logging

logger = logging.getLogger()

def handler(event, context):
    # ✅ GOOD — Log only non-sensitive identifiers
    logger.info(f"Processing order: {event.get('orderId')}")
    logger.info(f"User action: {event.get('action')}")

    # ❌ BAD — KHÔNG log raw event
    # logger.info(f"Event: {event}")
    # logger.info(f"User: {event.get('email')}")