PII Masking
The “PII Masking” Odigos Action can be used to mask PII data from span attribute values.
Use Cases
Security
- By default, OpenTelemetry should not record PII (Personally Identifiable Information) or sensitive data such as passwords, api tokens, etc. However, if the data is accidentally added to the telemetry signals, or if a manual instrumentation recorded it into an attribute, this action can be used to mask such data.
Legal and Compliance
- Ensure compliance with legal and privacy.
- Payment Card Industry (PCI) Data Security Standards prohibit logging certain things or storing them unencrypted.
Mechanism
This action processes a list of PII categories to be masked from the traces. Each PII category is linked to a regex that will be applied to all span attribute values. Any portion of the span attribute values that match the regex will be replaced with ****
, while the rest of the attribute value will remain unchanged.
Basic Example
The basic example below shows how to configure the Pii Masking action to mask Visa and MasterCard credit card numbers from span attribute values.
Create a file named piimasking.yaml
with the following content:
apiVersion: actions.odigos.io/v1alpha1
kind: PiiMasking
metadata:
name: piimasking
namespace: odigos-system
spec:
actionName: "PII Masking"
piiCategories:
- CREDIT_CARD
signals:
- TRACES
Apply the action to the cluster:
kubectl apply -f piimasking.yaml
Full Action Options
The full list of options available for the “PiiMasking” action are:
-
piiCategories
(required): An array of strings representing the PII Category you want to mask.The available PII categories are:
-
CREDIT_CARD
- mask Visa and MasterCard credit card numbersCan’t find the PII category you need? Please Contact us and we will add it for you
-
-
signals
(required): An array with the signals that the processor will act on (TRACES
). -
actionName
(optional): Allows you to attach a meaningful name to the action for convenience. Odigos does not use or assume any meaning from this field. -
notes
(optional): A free-form text field that allows you to attach notes to the action for convenience. Odigos does not use or assume any meaning from this field. -
disabled
(optional): A boolean field that allows you to disable the action. When set totrue
, the action will not be executed. The default value isfalse
.
Notes
- This action masks span attribute values by replacing only the sensitive portions with
****
, while leaving the rest of the value intact. - The regex used for masking are predefined for each PII category and cannot be configured.
- Currently, only trace signals are supported.
- All span attribute values in every span will be examined and masked accordingly.