feat(data-masking): add Data Masking utility (Erase, Encrypt/Decrypt, Logging integration)

[nicolastarzia]

Issue number: #1257
Closes #1257

Summary

Changes

Adds a new AWS.Lambda.Powertools.DataMasking utility that protects sensitive data (PII, credentials, financial records) before it is logged, stored, or forwarded — helping meet GDPR/HIPAA/PCI-DSS requirements. Ported from the Powertools for Python/TypeScript design.

Delivered in three phases:

• Erase (irreversible masking). DataMasking.Erase(...) masks fields in place while keeping the surrounding payload readable. Overloads for string and JsonNode (AOT-safe), object (annotated), and object + JsonTypeInfo (AOT-safe via source generator). MaskingOptions supports a fixed mask (default *****), length-preserving mask, and regex + replacement.
• Encrypt / Decrypt (reversible). Pluggable IDataMaskingProvider; default AwsEncryptionSdkProvider performs AWS KMS envelope encryption via the AWS Encryption SDK for .NET, with encryption-context binding/validation and single- or multi-key keyrings. EncryptAsync/DecryptAsync support whole-payload and field-level operations.
• Logging integration. EraseToNode(...) returns a JsonNode ready for structured logging, so users can Logger.LogInformation(masker.EraseToNode(json, fields)) without coupling the Data Masking and Logging packages.

Field selection uses simple dotted paths (for example address.street). Also includes a runnable example under examples/DataMasking and unit tests.

User experience

Before: .NET customers hand-roll masking/encryption logic, which is inconsistent across teams and easy to get wrong (especially field-level encryption that preserves structure, and KMS envelope encryption with data-key handling).

After: a single, consistent utility:

var masker = new DataMasking();
var masked = masker.Erase(json, new[] { "customer.ssn", "payment.creditCard" });

var secure = new DataMasking(new AwsEncryptionSdkProvider(KMS_KEY_ARN));
var encrypted = await secure.EncryptAsync(json, new[] { "customer.ssn" },
    encryptionContext: new() { ["tenantId"] = "acme-corp" });
var decrypted = await secure.DecryptAsync(encrypted, new[] { "customer.ssn" },
    encryptionContext: new() { ["tenantId"] = "acme-corp" });

Logger.LogInformation(masker.EraseToNode(json, new[] { "customer.ssn" }));

Checklist

• Meets tenets criteria
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented
• PR title follows conventional commit semantics

Testing

• 25 unit tests pass on net10.0 (13 Erase + 8 Encrypt/Decrypt + 4 EraseToNode). Library builds clean multi-targeting net8.0;net10.0.
• The AwsEncryptionSdkProvider itself is not unit-tested as it requires live AWS KMS credentials; the DataMasking Encrypt/Decrypt orchestration is tested against a reversible in-memory fake provider.

Open design questions for maintainers

Since this is a new public utility, a few choices would benefit from your input:

1. Field paths: Phase 1 uses simple dotted paths over JsonNode. Full JMESPath support (the repo already ships AWS.Lambda.Powertools.JMESPath, which currently only extracts, not sets) is deferred — extend JMESPath or keep an internal setter?
2. Async shape: the AWS Encryption SDK API is synchronous; IDataMaskingProvider exposes EncryptAsync/DecryptAsync for future-proofing (the default provider wraps sync calls). Keep async or expose sync?
3. AOT: the AwsEncryptionSdkProvider depends on the SDK's Dafny runtime (reflection) and is annotated [RequiresDynamicCode]/[RequiresUnreferencedCode]; Erase/EraseToNode remain AOT-safe.
4. Is phasing acceptable, or do you prefer a different split?

Is this a breaking change?

No. This adds a new package; no existing library code or public API is modified.

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud