Azure / Azure/azure-cli

Add new flag to mask secrets from '--debug' output

Open
#29,409 1 comment 0 reactions 1 assignee Claimed by @evelyn-ys View on GitHub
act-platform-engineering-squad Azure CLI Team Core customer-reported feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**

All `az` commands that support `--debug`

**Is your feature request related to a problem? Please describe.**

When creating an issue here on GitHub, the "bug" template requests for the output of `--debug`, but with a ATTENTION note, that reads:

> ⚠ ATTENTION: Make sure to remove all sensitive information, such as username, password, credential, subscription ID, etc.

The debug output is long, and _manually_ reviewing it in a text editor and changing all those information to `***` or something is a pain; I'm sure it's prohibitive enough for some people to either not include the debug output (making the investigation harder for the team), or have some personal/secret information slip through.

It's also applicable when trying to post problems in Stack Overflow or share with consultancies/third-parties/contractors for troubleshooting purposes.

**Describe the solution you'd like**

It's clear (or agreeable by a discussion) what information is personal/secret and not safe to share (tenant ID, subscription ID, resource groups name, etc.), so masking them _can_ be scripted.

I'm suggesting a new flag like `--debug-masked` to be the same as `--debug`, but, guess what, with secrets being masked!

**Describe alternatives you've considered**

Opening in a text editor and either skimming through, or by a global "Find and replace", but it's still possible to miss something.

**Additional context**

N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.