Added server side AWS account ID log redaction #327
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: micahhausler The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
|
/lgtm |
k8s-ci-robot
added
the
lgtm
| @@ -394,6 +394,11 @@ server: | |||
| # role to assume before querying EC2 API in order to discover metadata like EC2 private DNS Name | |||
| ec2DescribeInstancesRoleARN: arn:aws:iam::000000000000:role/DescribeInstancesRole | |||
|
|
|||
| # AWS Account IDs to scrub from server logs. (Defaults to empty list) | |||
| scrubbedAccounts: | |||
There was a problem hiding this comment.
Nit: To me "redacted" is more explicit than "scrubbed"
There was a problem hiding this comment.
I went back and forth on this, but in my mind "redacted" sounded too much like the whole log entry was omitted, and in this case I'm just redacting part of the log line.
There was a problem hiding this comment.
I like and understand "scrub" FWIW. 👍
| @@ -394,6 +394,11 @@ server: | |||
| # role to assume before querying EC2 API in order to discover metadata like EC2 private DNS Name | |||
| ec2DescribeInstancesRoleARN: arn:aws:iam::000000000000:role/DescribeInstancesRole | |||
|
|
|||
| # AWS Account IDs to scrub from server logs. (Defaults to empty list) | |||
There was a problem hiding this comment.
Do we want to give the ability to redact more than just account IDs?
There was a problem hiding this comment.
I think we could certainly add that at some point
This feature allows administrators to prevent specific account IDs from being emitted in server logs.