Resource: awsCloudwatchLogDataProtectionPolicy

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const awsCloudwatchLogGroupExample =
  new aws.cloudwatchLogGroup.CloudwatchLogGroup(this, "example", {
    name: "example",
  });
const awsS3BucketExample = new aws.s3Bucket.S3Bucket(this, "example_1", {
  bucket: "example",
});
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsS3BucketExample.overrideLogicalId("example");
const awsCloudwatchLogDataProtectionPolicyExample =
  new aws.cloudwatchLogDataProtectionPolicy.CloudwatchLogDataProtectionPolicy(
    this,
    "example_2",
    {
      logGroupName: awsCloudwatchLogGroupExample.name,
      policyDocument:
        '${jsonencode({\n    Name    = "Example"\n    Version = "2021-06-01"\n\n    Statement = [\n      {\n        Sid            = "Audit"\n        DataIdentifier = ["arn:aws:dataprotection::aws:data-identifier/EmailAddress"]\n        Operation = {\n          Audit = {\n            FindingsDestination = {\n              S3 = {\n                Bucket = aws_s3_bucket.example.bucket\n              }\n            }\n          }\n        }\n      },\n      {\n        Sid            = "Redact"\n        DataIdentifier = ["arn:aws:dataprotection::aws:data-identifier/EmailAddress"]\n        Operation = {\n          Deidentify = {\n            MaskConfig = {}\n          }\n        }\n      }\n    ]\n  })}',
    }
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsCloudwatchLogDataProtectionPolicyExample.overrideLogicalId("example");

$ terraform import aws_cloudwatch_log_data_protection_policy.example my-log-group