Masking sensitive data in logs with CloudWatch Data Protection