Bug: DataMasking.erase with masking_rules ignores JSON string input #8636

Expected Behaviour

DataMasking.erase() accepts a JSON string with fields=. With masking_rules=, the same JSON string input should be parsed too, and the matching fields masked.

Current Behaviour

With masking_rules=, the rule paths are evaluated against the raw string, so nothing ever matches:

• by default it raises DataMaskingFieldNotFoundError: Field or expression email not found;
• with raise_on_missing_field=False it only logs a warning and returns the string unmasked.

Code snippet

import json
from aws_lambda_powertools.utilities.data_masking import DataMasking

dm = DataMasking()
rules = {"email": {"regex_pattern": "(.)(.*)(@.*)", "mask_format": r"\1****\3"}}
data = {"email": "john@example.com"}

dm.erase(data, masking_rules=rules)              # {'email': 'j****@example.com'}
dm.erase(json.dumps(data), fields=["email"])     # works, JSON string is parsed
dm.erase(json.dumps(data), masking_rules=rules)  # DataMaskingFieldNotFoundError

Possible Solution

_apply_masking_rules (aws_lambda_powertools/utilities/data_masking/base.py) could deserialize str input with the configured json_deserializer before evaluating the paths, as the fields code path already does in _normalize_data_to_parse.

Steps to Reproduce

Run the snippet above.

Powertools for AWS Lambda (Python) version

latest (3.36.0, also on develop)

AWS Lambda function runtime

3.13

Packaging format used

PyPi

Debugging logs

aws_lambda_powertools.utilities.data_masking.exceptions.DataMaskingFieldNotFoundError: Field or expression email not found