Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(custom-resources): log statement exposes pre-signed url information #31320

Closed
1 task
Endlessio opened this issue Sep 4, 2024 · 3 comments · Fixed by #31322
Closed
1 task

(custom-resources): log statement exposes pre-signed url information #31320

Endlessio opened this issue Sep 4, 2024 · 3 comments · Fixed by #31322
Labels
@aws-cdk/custom-resources Related to AWS CDK Custom Resources bug This issue is a bug. p1

Comments

@Endlessio
Copy link

Endlessio commented Sep 4, 2024 •
edited
Loading

Describe the bug

summary:

Previously, this ticket, reference id, D122668413, discussed the issue: Throttling CDK constructs logs S3 pre-signed Urls, according to the ticket, upgrade cdk to a newer version (version > 2.132.0) can fix the issue.

actions:

we successfully upgrade to ^2.132.0, and we see some pre-signed url is removed, but some are not for the same deployment

issue:

aws ticket:

V1507107822

Regression Issue

  • Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

no more pre-signed url written to log

Current Behavior

we successfully upgrade to ^2.132.0, and we see some pre-signed url is removed, but some are not for the same deployment

Reproduction Steps

deploy the stack and check log in the cloudwatch with

fields @timestamp, @message, @log, @logStream | filter @message like /(?i)X-Amz-Algorithm.*X-Amz-Credential.*Signature/ and @message not like /fields @timestamp, @message, @log, @logStream/

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.132.0

Framework Version

No response

Node.js Version

NA

OS

macos

Language

TypeScript

Language Version

No response

Other information

No response
@Endlessio Endlessio added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Sep 4, 2024
@github-actions github-actions bot added the @aws-cdk/custom-resources Related to AWS CDK Custom Resources label Sep 4, 2024
@GavinZZ
Copy link
Contributor

GavinZZ commented Sep 4, 2024

I can reproduce this and it seems that we're using cfnRequest instead of sanitizedRequest at this line of code https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/framework.ts#L41.

@GavinZZ GavinZZ added p1 and removed needs-triage This issue or PR still needs to be triaged. labels Sep 4, 2024
@GavinZZ GavinZZ mentioned this issue Sep 4, 2024
Merged
1 task
@mergify mergify bot closed this as completed in #31322 Sep 5, 2024
@mergify mergify bot closed this as completed in b5e4496 Sep 5, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 5, 2024

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

1 similar comment
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 5, 2024

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 5, 2024
pahud pushed a commit to pahud/aws-cdk that referenced this issue Sep 9, 2024
@GavinZZ @pahud
fix(custom-resources): remove presigned url from cloudwatch logs (aws…
92cbdbc 
…#31322)

### Issue # (if applicable)

Closes aws#31320

### Reason for this change

Presigned url is still logged despite a previous PR to fix it. aws#29406

### Description of changes

Verified that the `events:` no longer display the response url.

### Description of how you validated changes

Re-run all failed integration tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
xazhao pushed a commit to xazhao/aws-cdk that referenced this issue Sep 12, 2024
@GavinZZ @xazhao
fix(custom-resources): remove presigned url from cloudwatch logs (aws…
ba756e2 
…#31322)

### Issue # (if applicable)

Closes aws#31320

### Reason for this change

Presigned url is still logged despite a previous PR to fix it. aws#29406

### Description of changes

Verified that the `events:` no longer display the response url.

### Description of how you validated changes

Re-run all failed integration tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
GavinZZ added a commit that referenced this issue Sep 12, 2024
@GavinZZ
fix(custom-resources): remove presigned url from cloudwatch logs (#31322
d00f09a 
)

### Issue # (if applicable)

Closes #31320

### Reason for this change

Presigned url is still logged despite a previous PR to fix it. #29406

### Description of changes

Verified that the `events:` no longer display the response url.

### Description of how you validated changes

Re-run all failed integration tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
@aws-cdk/custom-resources Related to AWS CDK Custom Resources bug This issue is a bug. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(custom-resources): remove presigned url from cloudwatch logs aws/aws-cdk
2 participants
@GavinZZ @Endlessio