hashicorp / hashicorp/terraform-plugin-log

Proposal: Fine-grained field masking

Open
#113 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
23
Forks
11
Avg merge
2d 12h
Merged PRs (30d)
1

Description

### terraform-plugin-log version

```
v0.7.0
```

### Use cases

I'm looking to mask only parts of a field, rather than the whole field, in log output. For example, when logging AWS API requests, the `Authorization ` field looks like the folllowing:

> Authorization: AWS4-HMAC-SHA256 Credential=AKIA5PX2H2S3BEXAMPLE/20221205/us-west-2/sso/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-target, Signature=17736c976abda4c0cc3e91c0dd1a8b9aa7c2f34e21fde9dd5f32c35bbaadc0de

In this example, I would like to mask the Access Key portion of `Credential`, except for the last four characters, as well as the `Signature`. Something like

> Authorization: AWS4-HMAC-SHA256 Credential=****************MPLE/20221205/us-west-2/sso/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-target, Signature=\*\*\*\*\*\*\*

### Proposal

I propose adding a hook either for all fields or a specific field that could parse the field content and mask as appropriate. In the example above, it would involve parsing the [AWS Signature v4 header](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html) for specific values and masking those.

Contributor guide

Open the contributing guide

Research direction

No implementation files, tests, or entry points are named. Start by locating the existing field-masking and logging APIs, then examine how an AWS Signature V4 Authorization header could be parsed so the Access Key and Signature are masked while the requested suffix and other header content remain visible.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
observability-sre, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.