Aws::KMS::Client#encrypt logs plaintext: param

[modosc]

versions:

aws-sdk (2.1.14)
aws-sdk-rails (1.0.0)

with Aws.config.update log_level: :debug any calls to Aws::KMS::Client#encrypt are logged including the plaintext:

[Aws::KMS::Client 200 0.131191 0 retries] encrypt(key_id:"arn:aws:kms:us-west-2:12324123412324:key/1420d94d-15ea-43bd-9fe0-2792289f189b",plaintext:"asdfasdfasdf")

seems like this param should be filtered, maybe something similar to the rails config.filter_parameters implementation?

[trevorrowe]

Thank you for reporting this issue. I definitely agree these should be filtered from the default logger output. I'm going to take a look at this today and see what we can do to resolve this.

[trevorrowe]

I made a change to the SDK so that it will now filter sensitive parameters by default when logging request parameters. The default list will be auto-updated by checking the service definitions as an automated release task. You can add additional filters when constructing a log formatter.

[modosc]

thanks!