Hiding AWS Credentials in Test Tracing Outputs

Kashyap C. · 2025-02-10T21:40:07.253Z

I'm setting up some tracing on my tests but I'm passing in aws_credentials as a parameter to my testing function. I'd like if the actual values of my aws credentials to not be logged. Is there a way to hide them?

Hiding AWS Credentials in Test Tracing Outputs | Arize AI Community

RunLLM
APP
·
Yes, you can hide sensitive information like AWS credentials in your tracing logs by using the `TraceConfig` class to configure masking rules. You can set the `hide_inputs` or `hide_input_messages` parameters to `True` to prevent input values or messages from being logged. This will ensure that sensitive data such as AWS credentials are not exposed in your logs. ``` from openinference.instrumentation import TraceConfig config = TraceConfig( hide_inputs=True, # Hides all input values hide_input_messages=True # Hides all input messages ) ``` Would you like more detail? Sources: - <https://github.com/arize-ai/openinference/blob/main/python/openinference-instrumentation/src/openinference/instrumentation/config.py|OpenInference Instrumentation Config> - <https://docs.arize.com/phoenix/tracing/how-to-tracing/masking-span-attributes#%3AS2%3A|Masking Span Attributes>
💡 Hint: Mention RunLLM in the thread for followups.
Kashyap C.
·
I tried TraceConfig & hide_inputs, and it didn't work.
Anthony P.
·
Sorry to hear you are having issues with this. Can I have some more details, such as which instrumentation you are using and what version? In the meantime, have you tried hide_llm_invocation_parameters=True in your TraceConfig?
Samantha Z.
·
Kashyap C. I'm going to pick this up, unless you figured it out?
✅1
Samantha Z.
·
Anthony P. I am trying that parameter and it's having no effect.
Kashyap C.
·
Thanks Sam! I did try that as well.
Samantha Z.
·
Yeah I'm wondering if we can just mask a specific key, I need to look at how to do that
Kashyap C.
·
Some more context here, we're instrumenting a test, and test has these pytest fixtures. So really we want to just hide one of those fixtures.
Samantha Z.
·
Even without that though, we should be able to mask the credentials
Samantha Z.
·
But that's a good point, I wonder if it won't work because of how it's running through the fixture

Samantha Z.

·

It looks like we should be able to use something like what's in the example above, maybe:

    Examples:
        with suppress_tracing():
            # No tracing will occur within this block
            ...

Samantha Z.
·
that will work for the s3 client, not sure if we can use it anywhere else, though
Samantha Z.
·
sadly it looks like we might be better off doing manual instrumentation with specifically defined spans, and just exclude the ones we don't want
Samantha Z.
·
maybe we can modify our @tracer.chain decorator to handle this 🤔

Samantha Z.

·

To do it with opentelemetry you'd do something like this:

from opentelemetry.exporter.otlp import OTLPExporter

from opentelemetry.sdk.trace import TracerProvider

from opentelemetry.sdk.trace.export import BatchExportSpanProcessor



# Define a custom processor to redact sensitive attributes

class RedactionProcessor:

    def __init__(self, sensitive_attributes):

        self.sensitive_attributes = sensitive_attributes



    def process_span(self, span):

        for key in self.sensitive_attributes:

            if key in span.attributes:

                span.attributes[key] = "REDACTED"

        return span



# Configure the OpenTelemetry Collector

collector = OTLPExporter(endpoint="your-monitoring-endpoint")



# Create a tracer provider and add the custom processor

provider = TracerProvider()

processor = BatchExportSpanProcessor(collector, RedactionProcessor(["credit_card", "user_password"]))

provider.add_span_processor(processor)



# Use the tracer to create spans in your application code

tracer = provider.get_tracer("your-application-name")

Which doesn't look too bad

41 comments