CloudWatch Logsのカスタムデータ保護ポリシーをCDKで実装する

import { CustomDataIdentifier, DataIdentifier, DataProtectionPolicy, LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
import * as cdk from 'aws-cdk-lib/core';
import { Construct } from 'constructs';

export class LogStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const dataProtectionPolicy = new DataProtectionPolicy({
      name: 'dataProtectionPolicy',
      identifiers: [
        DataIdentifier.EMAILADDRESS,
        DataIdentifier.IPADDRESS,
        DataIdentifier.NAME,
        new CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}'),
        new CustomDataIdentifier('CustomCreditCardNumber', '\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\\b'),
        new CustomDataIdentifier('JapanesePhoneNumber', '\\b0\\d{1,4}[-\\s]?\\d{1,4}[-\\s]?\\d{4}\\b'),
        new CustomDataIdentifier('JapaneseMyNumber', '\\b[0-9]{4}[-\\s]?[0-9]{4}[-\\s]?[0-9]{4}\\b'),
        new CustomDataIdentifier('JapanesePostalCode', '\\b[0-9]{3}[-]?[0-9]{4}\\b'),
        new CustomDataIdentifier('JwtToken', '\\beyJ[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+\\b'),
        new CustomDataIdentifier('JapaneseDriversLicense', '\\b[0-9]{12}\\b'),
        new CustomDataIdentifier('InternalProjectCode', '\\bPRJ-[A-Z]{3}-\\d{4}\\b'),
        new CustomDataIdentifier('ApiToken', '\\btoken_[A-Za-z0-9]{32}\\b'),
        new CustomDataIdentifier('SecretKeyPattern', '\\bsecret_[A-Za-z0-9_\\-]{16,}\\b'),
      ],
    });

    new LogGroup(this, 'LogGroup', {
      logGroupName: "sampleLogGroup",
      retention: RetentionDays.ONE_WEEK,
      dataProtectionPolicy,
    });
  }
}