Hide sanitized items from logs
Configure the AI Sanitizer policy to anonymize phone numbers and keep the sanitized items out of your log policies. Use this when the logs themselves must not hold sensitive data.
Prerequisites
-
An existing AI Model.
-
An AI PII Anonymizer service image, pulled and running.
Environment variables
SANITIZER_SERVICE_HOST: The sanitizer service’s host
ai_gateway_policies:
- ref: hide-sanitized-items-from-logs
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: hide-sanitized-items-from-logs
display_name: Hide sanitized items from logs
type: ai-sanitizer
enabled: true
config:
anonymize:
- phone
port: 8080
host: !env SANITIZER_SERVICE_HOST
redact_type: synthetic
stop_on_error: true
recover_redacted: false
skip_logging_sanitized_items: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "hide-sanitized-items-from-logs",
"display_name": "Hide sanitized items from logs",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"phone"
],
"port": 8080,
"host": "'$SANITIZER_SERVICE_HOST'",
"redact_type": "synthetic",
"stop_on_error": true,
"recover_redacted": false,
"skip_logging_sanitized_items": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "hide-sanitized-items-from-logs"
display_name = "Hide sanitized items from logs"
type = "ai-sanitizer"
enabled = true
global = false
config = jsonencode({
anonymize = ["phone"]
port = 8080
host = var.sanitizer_service_host
redact_type = "synthetic"
stop_on_error = true
recover_redacted = false
skip_logging_sanitized_items = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}ai_gateway_policies:
- ref: hide-sanitized-items-from-logs
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: hide-sanitized-items-from-logs
display_name: Hide sanitized items from logs
type: ai-sanitizer
enabled: true
config:
anonymize:
- phone
port: 8080
host: !env SANITIZER_SERVICE_HOST
redact_type: synthetic
stop_on_error: true
recover_redacted: false
skip_logging_sanitized_items: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "hide-sanitized-items-from-logs",
"display_name": "Hide sanitized items from logs",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"phone"
],
"port": 8080,
"host": "'$SANITIZER_SERVICE_HOST'",
"redact_type": "synthetic",
"stop_on_error": true,
"recover_redacted": false,
"skip_logging_sanitized_items": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "hide-sanitized-items-from-logs"
display_name = "Hide sanitized items from logs"
type = "ai-sanitizer"
enabled = true
global = false
config = jsonencode({
anonymize = ["phone"]
port = 8080
host = var.sanitizer_service_host
redact_type = "synthetic"
stop_on_error = true
recover_redacted = false
skip_logging_sanitized_items = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}ai_gateway_policies:
- ref: hide-sanitized-items-from-logs
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: hide-sanitized-items-from-logs
display_name: Hide sanitized items from logs
type: ai-sanitizer
enabled: true
config:
anonymize:
- phone
port: 8080
host: !env SANITIZER_SERVICE_HOST
redact_type: synthetic
stop_on_error: true
recover_redacted: false
skip_logging_sanitized_items: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "hide-sanitized-items-from-logs",
"display_name": "Hide sanitized items from logs",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"phone"
],
"port": 8080,
"host": "'$SANITIZER_SERVICE_HOST'",
"redact_type": "synthetic",
"stop_on_error": true,
"recover_redacted": false,
"skip_logging_sanitized_items": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "hide-sanitized-items-from-logs"
display_name = "Hide sanitized items from logs"
type = "ai-sanitizer"
enabled = true
global = false
config = jsonencode({
anonymize = ["phone"]
port = 8080
host = var.sanitizer_service_host
redact_type = "synthetic"
stop_on_error = true
recover_redacted = false
skip_logging_sanitized_items = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}ai_gateway_policies:
- ref: hide-sanitized-items-from-logs
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: hide-sanitized-items-from-logs
display_name: Hide sanitized items from logs
type: ai-sanitizer
enabled: true
config:
anonymize:
- phone
port: 8080
host: !env SANITIZER_SERVICE_HOST
redact_type: synthetic
stop_on_error: true
recover_redacted: false
skip_logging_sanitized_items: true
global: trueMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "hide-sanitized-items-from-logs",
"display_name": "Hide sanitized items from logs",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"phone"
],
"port": 8080,
"host": "'$SANITIZER_SERVICE_HOST'",
"redact_type": "synthetic",
"stop_on_error": true,
"recover_redacted": false,
"skip_logging_sanitized_items": true
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "hide-sanitized-items-from-logs"
display_name = "Hide sanitized items from logs"
type = "ai-sanitizer"
enabled = true
global = true
config = jsonencode({
anonymize = ["phone"]
port = 8080
host = var.sanitizer_service_host
redact_type = "synthetic"
stop_on_error = true
recover_redacted = false
skip_logging_sanitized_items = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}After creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref hide-sanitized-items-from-logs#nameAfter creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"hide-sanitized-items-from-logs"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}After creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref hide-sanitized-items-from-logs#nameAfter creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"hide-sanitized-items-from-logs"
]
}
'After creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}After creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref hide-sanitized-items-from-logs#nameAfter creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"hide-sanitized-items-from-logs"
]
}
'After creating the policy, add hide-sanitized-items-from-logs to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "sanitizer_service_host" {
type = string
}