Request: redact plaintext in kms calls in debug logging

[2rs2ts]

Since kms can be used to encrypt sensitive data, leaking that data to disk is quite possible if users are not careful when enabling debug logging. It might be prudent to treat kms as a special case and make sure that plaintext is redacted before being logged.

[stealthycoin]

KMS is specifically server side encryption so it isn't going to get encrypted before being logged. Redacted possibly, but not encrypted since that would be client side encryption.

Marking this as a feature request.

[2rs2ts]

Thanks, I misspoke when I said

that plaintext is encrypted before being logged

I totally meant redacted. Thanks a bunch for the response!

[felipeochoa]

I'm using the following filter to achieve this. It redacts more than just the sensitive KMS data, but it may be a useful starting point for others:

def redact_kms_logs(record: logging.LogRecord):
    "Redact the plaintext entries in KMS log records."
    if record.levelno > logging.DEBUG:
        return 1
    if 'body' in record.msg or 'headers' in record.msg:
        if isinstance(record.args, tuple):
            record.args = ('REDACTED',) * len(record.args)
        elif isinstance(record.args, dict):
            record.args = {key: 'REDACTED' for key in record.args}
        else:
            record.args = 'REDACTED'
    return 1


logging.getLogger('botocore.parsers').addFilter(redact_kms_logs)