--- title: Automated PII redaction for Amazon RDS for PostgreSQL... description: A serverless pipeline on AWS that irreversibly redacts PII (SSNs, credit cards, emails, names, and 30+ other types) from Amazon RDS for PostgreSQL pgAudit logs... canonical: https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Automated PII redaction for Amazon RDS for PostgreSQL audit logs | daily.dev og:description: A serverless pipeline on AWS that irreversibly redacts PII (SSNs, credit cards, emails, names, and 30+ other types) from Amazon RDS for PostgreSQL pgAudit logs... og:url: https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u og:image: https://api.daily.dev/og/posts/73DmnWz4U.png og:image:alt: Automated PII redaction for Amazon RDS for PostgreSQL audit logs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automated PII redaction for Amazon RDS for PostgreSQL audit logs **[AWS Database Blog](https://daily.dev/sources/aws-database-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary A serverless pipeline on AWS that irreversibly redacts PII (SSNs, credit cards, emails, names, and 30+ other types) from Amazon RDS for PostgreSQL pgAudit logs before storing them in S3 for querying via Athena. Unlike CloudWatch Logs Data Protection's reversible masking, this pipeline uses Amazon Comprehend and AWS Step Functions to permanently remove sensitive data, making the archive suitable for GDPR, HIPAA, and PCI-DSS compliance. The entire solution deploys via a single CloudFormation template with three deployment options (console, CLI, or script). Cost ranges from ~$73/month at low activity to ~$161/month at high volume, dominated by infrastructure and Comprehend usage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How is irreversible PII redaction different from CloudWatch Logs Data Protection masking? CloudWatch Logs Data Protection masking is reversible, since any IAM principal with the logs:Unmask permission can view the original data, which is insufficient for compliance frameworks requiring permanent separation of PII from audit evidence. A serverless pipeline using Step Functions, Amazon Comprehend, and Lambda creates a separate, irreversibly redacted archive in S3 where no permission or API call can recover the original values. _See how daily.dev surfaces AWS compliance patterns for teams designing audit-safe log pipelines._ ### How much does an automated PII redaction pipeline for RDS PostgreSQL audit logs cost on AWS? At low activity of about 100 log events per hour, the pipeline costs roughly $73 per month, dominated by NAT Gateway and VPC Endpoint infrastructure. At high activity of about 10,000 events per hour, Amazon Comprehend usage adds roughly $70 per month, bringing the total to about $161 per month. Costs can be reduced by lowering pipeline frequency or removing VPC Interface Endpoints in development. _Track AWS cost trade-offs like this on daily.dev before committing to a compliance architecture._ ### What PII types can Amazon Comprehend detect and redact in pgAudit logs stored in CloudWatch? The pipeline removes more than 30 types of personally identifiable information, including Social Security numbers, credit card numbers, email addresses, names, and physical addresses, from pgAudit's cleartext SQL statement logs. Pattern-detectable types like SSNs and credit cards can be verified with zero-row Athena queries, while NLP-detected types such as names and addresses require reviewing separate validation reports. _daily.dev helps engineers compare PII detection approaches when hardening audit log pipelines._ ## Similar posts on daily.dev - [Automate PostgreSQL audit log extraction and analysis with Amazon S3](https://daily.dev/posts/automate-postgresql-audit-log-extraction-and-analysis-with-amazon-s3-gr2bxekgz) · AWS Database Blog · 1 upvotes · 0 comments - [Detect and redact personally identifiable information using Amazon Bedrock Data Automation and Guardrails](https://daily.dev/posts/detect-and-redact-personally-identifiable-information-using-amazon-bedrock-data-automation-and-guard-njefbhxf6) · AWS · 1 upvotes · 0 comments - [How to Build a Serverless RAG Pipeline on AWS That Scales to Zero](https://daily.dev/posts/how-to-build-a-serverless-rag-pipeline-on-aws-that-scales-to-zero-ahy4ukgbk) · freeCodeCamp · 1 upvotes · 0 comments - [How to stream PostgreSQL changes to Amazon S3 with AWS Fargate](https://daily.dev/posts/how-to-stream-postgresql-changes-to-amazon-s3-with-aws-fargate-r9tcxtwht) · AWS Database Blog · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#postgresql](https://daily.dev/tags/postgresql), [#aws-lambda](https://daily.dev/tags/aws-lambda), [#aws-cloudformation](https://daily.dev/tags/aws-cloudformation) [View this post on daily.dev](https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Automated PII redaction for Amazon RDS for PostgreSQL audit logs","url":"https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u"},"datePublished":"2026-07-28T17:00:38.321Z","dateModified":"2026-09-14T07:51:48.903Z","description":"A serverless pipeline on AWS that irreversibly redacts PII (SSNs, credit cards, emails, names, and 30+ other types) from Amazon RDS for PostgreSQL pgAudit logs...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e3c639f3453e1897241b961017282834?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e3c639f3453e1897241b961017282834?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"AWS Database Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS Database Blog","logo":"https://media.daily.dev/image/upload/s--En-avd2a--/f_auto,q_auto/v1780213446/logos/aws-database-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aws-database-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,postgresql,aws-lambda,aws-cloudformation","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS Database Blog","item":"https://daily.dev/sources/aws-database-blog"},{"@type":"ListItem","position":3,"name":"Automated PII redaction for Amazon RDS for PostgreSQL audit logs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/automated-pii-redaction-for-amazon-rds-for-postgresql-audit-logs-73dmnwz4u#faq","mainEntity":[{"@type":"Question","name":"How is irreversible PII redaction different from CloudWatch Logs Data Protection masking?","acceptedAnswer":{"@type":"Answer","text":"CloudWatch Logs Data Protection masking is reversible, since any IAM principal with the logs:Unmask permission can view the original data, which is insufficient for compliance frameworks requiring permanent separation of PII from audit evidence. A serverless pipeline using Step Functions, Amazon Comprehend, and Lambda creates a separate, irreversibly redacted archive in S3 where no permission or API call can recover the original values. See how daily.dev surfaces AWS compliance patterns for teams designing audit-safe log pipelines."}},{"@type":"Question","name":"How much does an automated PII redaction pipeline for RDS PostgreSQL audit logs cost on AWS?","acceptedAnswer":{"@type":"Answer","text":"At low activity of about 100 log events per hour, the pipeline costs roughly $73 per month, dominated by NAT Gateway and VPC Endpoint infrastructure. At high activity of about 10,000 events per hour, Amazon Comprehend usage adds roughly $70 per month, bringing the total to about $161 per month. Costs can be reduced by lowering pipeline frequency or removing VPC Interface Endpoints in development. Track AWS cost trade-offs like this on daily.dev before committing to a compliance architecture."}},{"@type":"Question","name":"What PII types can Amazon Comprehend detect and redact in pgAudit logs stored in CloudWatch?","acceptedAnswer":{"@type":"Answer","text":"The pipeline removes more than 30 types of personally identifiable information, including Social Security numbers, credit card numbers, email addresses, names, and physical addresses, from pgAudit's cleartext SQL statement logs. Pattern-detectable types like SSNs and credit cards can be verified with zero-row Athena queries, while NLP-detected types such as names and addresses require reviewing separate validation reports. daily.dev helps engineers compare PII detection approaches when hardening audit log pipelines."}}]} ```