builder: don't log requests/responses by default

[lbajolet-hashicorp]

The logs of the Azure builder are very verbose by default, as they log the contents of every request/response to/from the Azure APIs.

For regular debugging of a template, this is not necessary, as just looking at the errors returned by the calls will generally give enough information to proceed with fixing the template.

These logs may be relevant when attempting to debug the plugin itself however, so we add one extra environment variable to allow the plugin to print them out, PACKER_AZURE_DEBUG_LOGS.
If it is defined, and non empty, the requests and responses will be dumped to stderr, otherwise, they are silent.

[nywilken]

I think the approach is sound and I see why we want to keep and not just get rid of them. Where should this information be documented?

[lbajolet-hashicorp]

I think the approach is sound and I see why we want to keep and not just get rid of them. Where should this information be documented?

That's a good question. This is probably something we should detail in the main README for the plugin.
Or we could leave it undocumented and only share about it if needed; I'm not sure this is the kind of capability we want to make every user aware of because of the risk of dumping that traffic on stderr.
What do you think?

[nywilken]

Or we could leave it undocumented and only share about it if needed; I'm not sure this is the kind of capability we want to make every user aware of because of the risk of dumping that traffic on stderr.

I don't think leaving it undocumented helps the situation. I would rather inform users of the potential risk as opposed to having say I didn't know that was possible. In this case, I think the right thing to do is add a section to the integration README for Troubleshooting.

In this section, we can explain the use of PACKER_LOG and PACKER_AZURE_DEBUG_LOG for gaining greater visibility into the API calls made by the plugin.

Setting PACKER_AZURE_DEBUG_LOG will enable logging of all HTTP requests made to Azure API endpoints to stdout, which may contain sensitive information such as passwords or access keys as raw text. As a security precaution, Azure debug logging is not available by default. Users wishing to enable such granular logging are encouraged to do so on an as-needed basis and only on trusted hosts.

[lbajolet-hashicorp]

@nywilken good call; I like the Troubleshooting section idea.

I've just pushed docs update for this, when you have time please let me know what you think about it.

[nywilken]

Small changes to the text but otherwise good to go.