test(ec2): ensure that private key is not written to telemetry

packages/core/src/shared/telemetry/telemetryLogger.ts

@@ -118,4 +118,13 @@ export class TelemetryLogger {
     public queryFull(query: MetricQuery): MetricDatum[] {
         return this._metrics.filter((m) => m.MetricName === query.metricName)
     }
+
+    /**
+     * Queries telemetry for metrics with metadata containing a keyword in the key or value
+     */
+    public queryKeyword(keyword: string): MetricDatum[] {
+        return this._metrics.filter((m) =>
+            m.Metadata?.some((md) => md.Value?.includes(keyword) || md.Key?.includes(keyword))
+        )
+    }
 }

packages/core/src/test/awsService/ec2/model.test.ts

@@ -13,6 +13,9 @@ import { ToolkitError } from '../../../shared/errors'
 import { IAM } from 'aws-sdk'
 import { SshKeyPair } from '../../../awsService/ec2/sshKeyPair'
 import { DefaultIamClient } from '../../../shared/clients/iamClient'
+import { assertNotInTelemetryMetadata, createTestWorkspaceFolder } from '../../testUtil'
+import { fs } from '../../../shared'
+import path from 'path'
 
 describe('Ec2ConnectClient', function () {
     let client: Ec2ConnectionManager
@@ -144,6 +147,22 @@ describe('Ec2ConnectClient', function () {
             sinon.assert.calledWith(sendCommandStub, testSelection.instanceId, 'AWS-RunShellScript')
             sinon.restore()
         })
+
+        it('avoids writing the keys to any telemetry metrics', async function () {
+            sinon.stub(SsmClient.prototype, 'sendCommandAndWait')
+
+            const testSelection = {
+                instanceId: 'test-id',
+                region: 'test-region',
+            }
+            const keyPath = path.join((await createTestWorkspaceFolder()).uri.path, 'keys')
+            const keys = await SshKeyPair.getSshKeyPair(keyPath, 30000)
+            await client.sendSshKeyToInstance(testSelection, keys, 'test-user')
+            const privKey = await fs.readFileText(keys.getPrivateKeyPath())
+            assertNotInTelemetryMetadata(privKey)
+            sinon.restore()
+            await keys.delete()
+        })
     })
 
     describe('getRemoteUser', async function () {

packages/core/src/test/testUtil.ts

@@ -295,6 +295,13 @@ export function partialDeepCompare<T>(actual: unknown, expected: T, message?: st
     const partial = selectFrom(actual, ...keys(expected as object))
     assert.deepStrictEqual(partial, expected, message)
 }
+/**
+ * Finds all metrics whose metadata contains this keyword in their key value pairs, as part of the key OR the value.
+ * @param keyword target substring to search for
+ */
+export function assertNotInTelemetryMetadata(keyword: string): void | never {
+    return assert.ok(globals.telemetry.logger.queryKeyword(keyword).length === 0)
+}
 
 /**
  * Finds the emitted telemetry metrics with the given `name`, then checks if the metadata fields