This template creates a log group that uses a data protection policy to mask email addresses, and send audit findings to CloudWatch Logs, Kinesis Data Firehose, and Amazon S3.