Skip to content

composer: stop logging user_workloads_secret data in debug logs#18171

Open
naruto-lgtm wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
naruto-lgtm:composer-secret-log-redact
Open

composer: stop logging user_workloads_secret data in debug logs#18171
naruto-lgtm wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
naruto-lgtm:composer-secret-log-redact

Conversation

@naruto-lgtm

@naruto-lgtm naruto-lgtm commented Jul 4, 2026

Copy link
Copy Markdown

Repro: apply a change to google_composer_user_workloads_secret.data with TF_LOG=DEBUG; the base64 secret values show up in the provider log.

Cause: the update path marshals the whole composer.UserWorkloadsSecret (including the data map, which the schema marks Sensitive: true) and logs it, and both create and update also log the marshaled API response. The SDK redacts data from plan/state, but log.Printf bypasses that redaction.

Fix: drop the marshaled bodies from those DEBUG lines and log only the resource id, so the secret material never reaches the logs.

Release Note Template for Downstream PRs (will be copied)

composer: fixed `google_composer_user_workloads_secret` writing the secret `data` values into provider debug logs

@modular-magician modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Jul 4, 2026
@github-actions github-actions Bot requested a review from roaks3 July 4, 2026 16:02
@github-actions

github-actions Bot commented Jul 4, 2026

Copy link
Copy Markdown

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@roaks3, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

@roaks3 roaks3 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks! Just waiting on checks

@modular-magician modular-magician added service/composer and removed awaiting-approval Pull requests that need reviewer's approval to run presubmit tests labels Jul 7, 2026
@modular-magician

modular-magician commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit f48b3bf:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository Diff Link Changes
google provider View Diff 1 file changed, 7 insertions(+), 8 deletions(-)
google-beta provider View Diff 1 file changed, 7 insertions(+), 8 deletions(-)

Test report

Analytics

Total Tests Passed Skipped Affected
40 39 1 0
Affected Service Packages
  • composer

Learn how VCR tests work


Step 1: Replaying Mode

🟢 All tests passed in Replaying mode! No Recording was needed.

View the replaying VCR build log

@naruto-lgtm VCR tests complete for f48b3bf!

@roaks3 roaks3 enabled auto-merge July 7, 2026 20:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants