Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

(custom-resources): log statement exposes pre-signed url information #31320

Closed
1 task
Endlessio opened this issue Sep 4, 2024 · 3 comments · Fixed by #31322
Closed
1 task

(custom-resources): log statement exposes pre-signed url information #31320

Endlessio opened this issue Sep 4, 2024 · 3 comments · Fixed by #31322
Labels
@aws-cdk/custom-resources Related to AWS CDK Custom Resources bug This issue is a bug. p1

Comments

@Endlessio
Copy link

Endlessio commented Sep 4, 2024 •
edited
Loading

Describe the bug

summary:

Previously, this ticket, reference id, D122668413, discussed the issue: Throttling CDK constructs logs S3 pre-signed Urls, according to the ticket, upgrade cdk to a newer version (version > 2.132.0) can fix the issue.

actions:

we successfully upgrade to ^2.132.0, and we see some pre-signed url is removed, but some are not for the same deployment

issue:

aws ticket:

V1507107822

Regression Issue

  • Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

no more pre-signed url written to log

Current Behavior

we successfully upgrade to ^2.132.0, and we see some pre-signed url is removed, but some are not for the same deployment

Reproduction Steps

deploy the stack and check log in the cloudwatch with

fields @timestamp, @message, @log, @logStream | filter @message like /(?i)X-Amz-Algorithm.*X-Amz-Credential.*Signature/ and @message not like /fields @timestamp, @message, @log, @logStream/

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.132.0

Framework Version

No response

Node.js Version

NA

OS

macos

Language

TypeScript

Language Version

No response

Other information

No response
@Endlessio Endlessio added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Sep 4, 2024
@github-actions github-actions bot added the @aws-cdk/custom-resources Related to AWS CDK Custom Resources label Sep 4, 2024
@GavinZZ
Copy link
Contributor

GavinZZ commented Sep 4, 2024

I can reproduce this and it seems that we're using cfnRequest instead of sanitizedRequest at this line of code https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/framework.ts#L41.

@GavinZZ GavinZZ added p1 and removed needs-triage This issue or PR still needs to be triaged. labels Sep 4, 2024
@GavinZZ GavinZZ mentioned this issue Sep 4, 2024
Merged
1 task
@mergify mergify bot closed this as completed in #31322 Sep 5, 2024
@mergify mergify bot closed this as completed in b5e4496 Sep 5, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 5, 2024

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

1 similar comment
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 5, 2024

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 5, 2024
pahud pushed a commit to pahud/aws-cdk that referenced this issue Sep 9, 2024
@GavinZZ @pahud
fix(custom-resources): remove presigned url from cloudwatch logs (aws…
92cbdbc 
…#31322)

### Issue # (if applicable)

Closes aws#31320

### Reason for this change

Presigned url is still logged despite a previous PR to fix it. aws#29406

### Description of changes

Verified that the `events:` no longer display the response url.

### Description of how you validated changes

Re-run all failed integration tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
xazhao pushed a commit to xazhao/aws-cdk that referenced this issue Sep 12, 2024
@GavinZZ @xazhao
fix(custom-resources): remove presigned url from cloudwatch logs (aws…
ba756e2 
…#31322)

### Issue # (if applicable)

Closes aws#31320

### Reason for this change

Presigned url is still logged despite a previous PR to fix it. aws#29406

### Description of changes

Verified that the `events:` no longer display the response url.

### Description of how you validated changes

Re-run all failed integration tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
GavinZZ added a commit that referenced this issue Sep 12, 2024
@GavinZZ
fix(custom-resources): remove presigned url from cloudwatch logs (#31322
d00f09a 
)

### Issue # (if applicable)

Closes #31320

### Reason for this change

Presigned url is still logged despite a previous PR to fix it. #29406

### Description of changes

Verified that the `events:` no longer display the response url.

### Description of how you validated changes

Re-run all failed integration tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Assignees
No one assigned
Labels
@aws-cdk/custom-resources Related to AWS CDK Custom Resources bug This issue is a bug. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(custom-resources): remove presigned url from cloudwatch logs aws/aws-cdk
2 participants
@GavinZZ @Endlessio