I get what you're saying here, but if those [for example] logs contain personal information, and those logs are exposed (or have the possibility of being expose

I get what you're saying here, but if those [for example] logs contain personal information, and those logs are exposed (or have the possibility of being exposed) then that information should be redacted. Sure it's often not trivially simple, but it's your responsibility (AWS seems a wired example to use as well, given that any logging facilities actually provided by them offer redaction).