mask all sensitive values

[johnsonaj]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Reference: #32164

Sensitive values can be logged when the TF_LOG=TRACE. To avoid leaking secrets of any kind, logging should mask any pattern that appears to be a secret.

[ewbankkit]

Can this be unit tested?

[johnsonaj]

go test -v ./logging/...                                                                                                                                                                                    1 ↵
=== RUN   TestMaskAWSSensitiveValues
=== PAUSE TestMaskAWSSensitiveValues
=== CONT  TestMaskAWSSensitiveValues
=== RUN   TestMaskAWSSensitiveValues/mask_simple
=== PAUSE TestMaskAWSSensitiveValues/mask_simple
=== RUN   TestMaskAWSSensitiveValues/mask_complex_json
=== PAUSE TestMaskAWSSensitiveValues/mask_complex_json
=== RUN   TestMaskAWSSensitiveValues/no_mask
=== PAUSE TestMaskAWSSensitiveValues/no_mask
=== RUN   TestMaskAWSSensitiveValues/mask_xml
=== PAUSE TestMaskAWSSensitiveValues/mask_xml
=== CONT  TestMaskAWSSensitiveValues/mask_simple
=== CONT  TestMaskAWSSensitiveValues/mask_complex_json
=== CONT  TestMaskAWSSensitiveValues/no_mask
=== CONT  TestMaskAWSSensitiveValues/mask_xml
--- PASS: TestMaskAWSSensitiveValues (0.00s)
    --- PASS: TestMaskAWSSensitiveValues/mask_simple (0.00s)
    --- PASS: TestMaskAWSSensitiveValues/mask_complex_json (0.00s)
    --- PASS: TestMaskAWSSensitiveValues/no_mask (0.00s)
    --- PASS: TestMaskAWSSensitiveValues/mask_xml (0.00s)
PASS
ok  	github.com/hashicorp/aws-sdk-go-base/v2/logging	0.862s

[johnsonaj]

@ewbankkit added unit test

[ewbankkit]

LGTM 🚀.