Azure / Azure/azure-cli

az mysql flexible-server create writes out password details in log

Open
#30,944 7 comments 0 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad Auto-Assign Auto-Resolve bug customer-reported MySQL Possible-Solution Security-Issue Service Attention Similar-Issue
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

When running `az mysql flexible-server create` the output fomr command writes out the password and connection string in clear text in the logs !?!?

Here is the command:
`
az mysql flexible-server create --resource-group $resourcegroup \
--name $sername \
--location $location \
--admin-user $adminusername \
--admin-password $adminpassword \
--sku-name $sku \
--version $mysqlversion \
--yes \
--tags CreatedBy=AzDO
`

Sensitive info needs to be obfuscated or masked.

### Related command

az mysql flexible-server create

### Errors

Passowrd is written in clear text

### Issue script & Debug output

`
WARNING: Checking the existence of the resource group 'qa-siteweb-rg'...
WARNING: Resource group 'qa-siteweb-rg' exists ? : True
WARNING: Detected current client IP : 4.205.192.95
WARNING: IOPS is 396 which is either your input or free(maximum) IOPS supported for your storage size and SKU.
WARNING: Creating MySQL Server 'mysqlserver-siteweb-qa' in group 'qa-siteweb-rg'...
WARNING: Your server 'mysqlserver-siteweb-qa' is using sku 'Standard_B1ms' (Paid Tier). Please refer to https://aka.ms/mysql-pricing for pricing details
WARNING: Configuring server firewall rule to accept connections from '4.205.192.95'...
WARNING: Creating MySQL database 'flexibleserverdb'...
WARNING: Make a note of your password. If you forget, you would have to reset your password with'az mysql flexible-server update -n mysqlserver-siteweb-qa -g qa-siteweb-rg -p '.
WARNING: Try using az 'mysql flexible-server connect' command to test out connection.
{

"connectionString": "mysql flexibleserverdb --host mysqlserver-siteweb-qa.mysql.database.azure.com --user sofadadmin --password=Password001$",

"databaseName": "flexibleserverdb",
"firewallName": "FirewallIPAddress_2025-3-3_20-35-46",
"host": "mysqlserver-siteweb-qa.mysql.database.azure.com",
"id": "/subscriptions/a178cc79-1caa-4263-a715-c6250800485b/resourceGroups/qa-siteweb-rg/providers/Microsoft.DBforMySQL/flexibleServers/mysqlserver-siteweb-qa",
"location": "Canada Central",

"password": "Password001$",

"resourceGroup": "qa-siteweb-rg",
"skuname": "Standard_B1ms",
"username": "sofadadmin",
"version": "8.4"
}
`

### Expected behavior

Password details should be masked

### Environment Summary

azure-cli 2.69.0

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.