composer: stop logging user_workloads_secret data in debug logs#18171
composer: stop logging user_workloads_secret data in debug logs#18171naruto-lgtm wants to merge 1 commit into
Conversation
|
Googlers: For automatic test runs see go/terraform-auto-test-runs. @roaks3, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look. You can help make sure that review is quick by doing a self-review and by running impacted tests locally. |
roaks3
left a comment
There was a problem hiding this comment.
LGTM, thanks! Just waiting on checks
|
Hi there, I'm the Modular magician. I've detected the following information about your changes for commit f48b3bf: Diff reportYour PR generated the following diffs in downstream repositories:
Test reportAnalytics
Affected Service Packages
Step 1: Replaying Mode 🟢 All tests passed in Replaying mode! No Recording was needed. View the replaying VCR build log @naruto-lgtm VCR tests complete for f48b3bf! |
Repro: apply a change to
google_composer_user_workloads_secret.datawithTF_LOG=DEBUG; the base64 secret values show up in the provider log.Cause: the update path marshals the whole
composer.UserWorkloadsSecret(including thedatamap, which the schema marksSensitive: true) and logs it, and both create and update also log the marshaled API response. The SDK redactsdatafrom plan/state, butlog.Printfbypasses that redaction.Fix: drop the marshaled bodies from those DEBUG lines and log only the resource id, so the secret material never reaches the logs.
Release Note Template for Downstream PRs (will be copied)