Skip to content

Conversation

Wadimz
Copy link

@Wadimz Wadimz commented Mar 21, 2025

Changes introduce new patterns to cover AWS credentials output that comes from AWS assume role mechanism. These are typically json that includes accessKeyId, secretAccessKey and Token data.

Sample json with key suffixes covered:

{"ansible_ec2_iam_security_credentials_instance_profiles_accesskeyid": "ASIAU5QBETVVXEXAMPLE",
"ansible_ec2_iam_security_credentials_instance_profiles_secretaccesskey": "/lD8T9bXuZUW/F/8MutOB1vDXK2uG/gNHUe/d8bG",
"ansible_ec2_iam_security_credentials_instance_profiles_token":"Z1XKqTnKIHd7eLJhBZb9QWVcG0Rj3f8z1uYgO4Xm6vNiD5F7cM9pA"}

Sample escaped json covered:

{\"AccessKeyId\" : \"ASIAU5QBETVVXEXAMPLE\", \"SecretAccessKey\" : \"/lD8T9bXuZUW/F/8MutOB1vDXK2uG/gNHUe/d8bG\",\"Token\" : \"Z1XKqTnKIHd7eLJhBZb9QWVcG0Rj3f8z1uYgO4Xm6vNiD5F7cM9pA\"}

Testing done

  • unit tests
  • applied plugin configuration to local jenkins
jenkins = Jenkins.getInstance()
def logFileFilterConfig = jenkins.getDescriptor("com.tsystems.sbs.LogFileFilterConfig")

logFileFilterConfig.setRegexpPairs([
        regexpMaskForKeyEndingWith("accesskeyid"),
        regexpMaskForKeyEndingWith("secretaccesskey"),
        regexpMaskForKeyEndingWith("token"),
        regexpMaskForEscapedKey("AccessKeyId"),
        regexpMaskForEscapedKey("SecretAccessKey"),
        regexpMaskForEscapedKey("Token")
])

and verified in the pipeline
image

  • Added new regex patterns for AWS key masking to cover credentials that can be printed by aws assume role credentials provider.
  • Updated .gitignore to include IntelliJ IDEA files (that not required as a part of project)
  • Removed IntelliJ IDEA files from the project
  • Cleaned up unused imports

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests - that demonstrates feature works or fixes the issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant