provider: Add scrubbing for sensitive data in logs

[gdavison]

When the log level is set to TRACE, the AWS Provider is logging sensitive values such as access keys.

The AWS SDKs for Go provide some scrubbing for logs, but more checks need to be added.

Determine what is leaking the sensitive values. If needed, evaluate hashicorp/terraform-plugin-sdk#1006, which will be released in terraform-plugin-sdk v2.20.0. This will require adding the option to set the HTTP transport in aws-sdk-go-base.

References

• Depends on Allow setting of HTTP Transport aws-sdk-go-base#323
• Related to provider: To support VCR-style testing, allow setting HTTP Transport in aws-sdk-go-base configuration #26028

[ewbankkit]

#26732 introduces CodeQL code scanning, which scans for Clear-text logging of sensitive information - log statements that print structures containing password fields.
We will continue to ensure that such logging is removed but this does not handle any other sensitive data.

[gdavison]

Depends on #15090 to use context.Context everywhere

[github-actions]

This functionality has been released in v4.53.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.