API Reference
    Preparing search index...

    Class DataMasking

    Orchestrates erasing, encrypting, and decrypting sensitive data.

    import { DataMasking } from '@aws-lambda-powertools/data-masking';

    const masker = new DataMasking();
    const masked = masker.erase(data, { fields: ['customer.ssn'] });
    Index
    constructor
    decrypt encrypt erase

    • Decrypts data using the configured provider.

      A string input is treated as a full encrypted payload; an object input is deep copied and the values at fields are decrypted in place.

      Type Parameters

      • T

      Parameters

      • data: string | T

        The encrypted payload string or an object holding encrypted fields

      • Optionaloptions: DecryptOptions

        Options for the operation, see DecryptOptions

      Returns Promise<T>

      const decrypted = await masker.decrypt(encrypted, {
        fields: ['customer.ssn'],
      });

    • Encrypts data using the configured provider.

      With fields, encrypts the matched values in place and returns a deep copy; without fields, encrypts the entire payload into a single string.

      Type Parameters

      • T

      Parameters

      Returns Promise<string | T>

      const encrypted = await masker.encrypt(data, {
        fields: ['customer.ssn'],
        context: { tenantId: 'acme' },
      });

    • Irreversibly masks the entire payload with the default mask value: arrays element-wise preserving their length, and everything else with a single mask string.

      Type Parameters

      • T

      Parameters

      • data: T

        The data to mask; returned as-is when null or undefined

      Returns MaskedPayload<T>

    • Irreversibly masks fields in a data object and returns a deep copy.

      The options compose three layers (see EraseOptions):

      • a top-level MaskingRule (regexPattern + maskFormat, dynamicMask, or customMask) sets the default masking strategy;
      • fields selects the paths to mask with that strategy — when omitted, a top-level rule is applied to every leaf value in the payload;
      • maskingRules provides per-field rules that take precedence over the top-level rule for the paths they name.

      Type Parameters

      • T

      Parameters

      • data: T

        The data to mask; returned as-is when null or undefined

      • options: EraseOptions

        Options for the operation, see EraseOptions

      Returns T

      // mask two fields with the same strategy, overriding one of them
      const masked = masker.erase(data, {
        fields: ['ssn', 'card'],
        dynamicMask: true,
        maskingRules: { card: { customMask: 'XXXX' } },
      });

    Settings
    Member Visibility

    On This Page
    Constructors
    Methods