terratest icon indicating copy to clipboard operation
terratest copied to clipboard

`teststructure.SaveEc2KeyPair` exposes the private key in the log output

Open RothAndrew opened this issue 2 years ago • 3 comments

teststructure.SaveEc2KeyPair exposes the private key in the log output when it logs the marshaled JSON data. This creates a security risk to my project since it is open source and has its pipeline logs exposed publicly. Even though the key pair and the instance that it is attached to only exist for a few minutes it is still a risk.

Suggested Fixes:

  • Implement a function such as logger.Use() that would let me switch to the logger.Discard logger while I run the function call, then switch back.
  • Update the function definition to let the user specify which logger to use
  • Just remove logger.Logf(t, "Marshalled JSON: %s", string(bytes)) from save_test_data.go::SaveTestData()

Visual aids (this is a key pair that has since been deleted) Screen Shot 2022-05-31 at 12 21 46 PM

RothAndrew avatar May 31 '22 19:05 RothAndrew

More possible suggestions:

  • Implement different log levels such as DEBUG, TRACE, ERROR, WARNING, etc, and only log that data if the log level is set to debug+
  • Modify the function definition to add a parameter discardLogs which switches to logger.Discard.Logf() if the value is true
  • Add a new function that adds discardLogs param and deprecate the old one for backward compatibility

RothAndrew avatar May 31 '22 19:05 RothAndrew

Happy to submit a PR for this if any of these suggestions gains traction.

RothAndrew avatar May 31 '22 19:05 RothAndrew

Hi, can be a good improvement for logs printing, any PRs are welcome

denis256 avatar Jun 02 '22 18:06 denis256