hashicorp / hashicorp/terraform-plugin-log
Proposal: Fine-grained field masking
- Dominant language
- Go
- Stars
- 23
- Forks
- 11
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 1
Description
### terraform-plugin-log version
```
v0.7.0
```
### Use cases
I'm looking to mask only parts of a field, rather than the whole field, in log output. For example, when logging AWS API requests, the `Authorization ` field looks like the folllowing:
> Authorization: AWS4-HMAC-SHA256 Credential=AKIA5PX2H2S3BEXAMPLE/20221205/us-west-2/sso/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-target, Signature=17736c976abda4c0cc3e91c0dd1a8b9aa7c2f34e21fde9dd5f32c35bbaadc0de
In this example, I would like to mask the Access Key portion of `Credential`, except for the last four characters, as well as the `Signature`. Something like
> Authorization: AWS4-HMAC-SHA256 Credential=****************MPLE/20221205/us-west-2/sso/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-target, Signature=\*\*\*\*\*\*\*
### Proposal
I propose adding a hook either for all fields or a specific field that could parse the field content and mask as appropriate. In the example above, it would involve parsing the [AWS Signature v4 header](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html) for specific values and masking those.
Contributor guide
Research direction
No implementation files, tests, or entry points are named. Start by locating the existing field-masking and logging APIs, then examine how an AWS Signature V4 Authorization header could be parsed so the Access Key and Signature are masked while the requested suffix and other header content remain visible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- observability-sre, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100