AWS Lambda Powertools data masking security fix: throws DataMaskingError to prevent sensitive data leakage

Vulnerability Overview This version (v3.35.0) introduces significant security improvements to the data masking functionality. Previously, if an error occurred while applying masking rules, a warning might be issued and the original value returned unchanged. This behavior could lead callers to continue logging or storing data even when masking had failed. Now, data masking raises a exception when the masking provider fails, the masking path is invalid, or the regular expression cannot be compiled. Impact Scope Data Masking Failure: Previously, data masking failures might not have correctly halted processing, potentially resulting in the leakage of sensitive data. Existing Code Compatibility: Existing code must be updated to catch the exception; otherwise, it may continue processing unmasked data. Remediation 1. Exception Throwing: The exception is thrown when data masking fails, ensuring that callers handle the error correctly. 2. Code Example: 3. Missing Field Handling: Missing fields continue to follow the existing setting. By default, missing fields raise a ; when explicitly disabled, data masking issues a warning and proceeds. Other Improvements Faster Parser Imports: Optimized the import of to reduce cold start times. Additional Fixes and Improvements: Including fixes for metrics, feature flags, event handlers, parameters, streams, data classes, data masking, Python 3.9 library automation, commercial layer visibility, partition load balancers, null metadata fields, Redis persistence, type hints, idempotency, documentation updates, and maintenance tasks. Contributors This release was made possible by the following contributors: @Aditya0, @amin-farjadi, @dreamorosi, @ErezMizrahi, @leandrodamascena, @manshahH, @MohammedAlkindi, @TanbirRamim, @vishwakt, @claude, @emirzahi, and @ericbn.

Goal Reached Thanks to every supporter — we hit 100%!

AWS Lambda Powertools data masking security fix: throws DataMaskingError to prevent sensitive data leakage

More from this source