When submitting GitHub issues, it's asked that we provide debug logs with the ticket. Does anyone know what are good fields/data to redact from the log?

For example, the output will include requests to AWS'S STS service which provides auth data. I imagine that would be good to remove, yeah? Should usernames, account ID's, user arns, etc be removed too?


First of all, when submitting them, they have a GPG key to hide your secrets from the entire internet. Definitely do that.

Second, when I had to do it I paged through the whole thing. Some of the things I hid:

  • Netblock information. Mostly transferring to different subnets. If some data leaks, targeted attackers will have an unexpectedly hard time mapping our inside network once they get a way to probe it.
  • Exact names. This took some work, but some judicious sed work replaced all the chicago-bind with dns01 and such. Bind for DNS isn't a bad guess, but mongodb vs cassandra is more useful for figuring out a targeted attack.
  • AWS account numbers.. These are part of the ARN and are quite sed-able.
  • Actual secrets. Some Terraform resources require things like passwords and access-keys. You may be surprised how much of that is in there if you've never looked at a debug dump before.

It's a lot of work, some of it manual.

  • Oh man, simplest solution being to just encrypt the log itself! Thanks! – Nathaniel Schweinberg Mar 9 '18 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.