data "aws_cloudwatch_log_data_protection_policy_document" "example" {
  name = "Example"

  statement {
    data_identifiers = ["arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US"]

    operation {

      audit {

        findings_destination {

          cloudwatch_logs {
            log_group = "aws_cloudwatch_log_group.audit.name"
          }

          firehose {
            delivery_stream = "aws_kinesis_firehose_delivery_stream.audit.name"
          }

          s3 {
            bucket = "aws_s3_bucket.audit.bucket"
          }
        }
      }
    }
    sid = "Audit"
  }

  statement {
    data_identifiers = ["arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US"]
    sid = "Deidentify"
  }
}

resource "aws_cloudwatch_log_data_protection_policy" "example" {
  log_group_name = "aws_cloudwatch_log_group.example.name"
  policy_document = data.aws_cloudwatch_log_data_protection_policy_document.example.json
}