New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Potential PII exposure #55

Open

ofer-haim opened this issue May 23, 2023 · 0 comments

ofer-haim commented May 23, 2023

Hello,
I see that in logstash-mixin-aws plugin, unlike secret_access_key and the session_token, the access_key_id is not masked: https://github.com/logstash-plugins/logstash-mixin-aws/blob/main/lib/logstash/plugin_mixins/aws_config/generic.rb#L18

However, in AWS documentation this is listen as a PII and it should not be exposed:
https://docs.aws.amazon.com/comprehend/latest/dg/how-pii.html#how-pii-redact

Is there a reason why this field is not masked? It means that this information is being printed to logs and to errors

Thanks in advance for your response

ofer-haim mentioned this issue

Potential PII exposure- access key id logstash-plugins/logstash-integration-aws#27

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment