Tag managed secrets to prevent cleanup of unmanaged secrets#32
Tag managed secrets to prevent cleanup of unmanaged secrets#32paul-watkins-croud wants to merge 1 commit intomainfrom
Conversation
…nmanaged secrets The put-config cleanup was deleting independently-added secrets that shared the same Environment/App tag prefix. Now secrets created by the pipeline are tagged with ManagedBy: croudtech-bootstrap, and cleanup only targets secrets with that tag — leaving unmanaged secrets untouched. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -502,6 +520,17 @@ def remote_secret_filters(self): | |||
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
In general, to fix clear-text logging of sensitive data, you should avoid including sensitive values (or their directly identifying metadata) in log messages. If some context is needed for troubleshooting, prefer high-level descriptors (like environment or app name) or redacted/hashed versions that do not allow reconstructing or directly identifying the secret.
In this specific case, the vulnerable sink is logger.debug(f"Could not ensure ManagedBy tag on {secret_id}") in _ensure_managed_by_tag. The simplest, least intrusive fix is to stop interpolating secret_id into the log message. We can still log that something went wrong, potentially including non-sensitive context such as the exception itself (which may already be logged elsewhere) or a generic message. To keep behavior close to current functionality, we’ll change the message to drop the secret identifier and optionally log the exception with logger.debug("Could not ensure ManagedBy tag on a secret.", exc_info=True) so stack trace is available when debug logs are enabled. This avoids logging the tainted secret_id while maintaining useful diagnostics.
Concretely:
- In
croudtech_bootstrap_app/bootstrap.py, in_ensure_managed_by_tag, replace theexceptblock’s logging line to not referencesecret_id. - No new helper methods are required; we just modify the log message.
- No new imports are needed, as
loggeris already initialized andloggingis already imported.
| @@ -417,7 +417,7 @@ | ||
| Tags=[self.MANAGED_BY_TAG], | ||
| ) | ||
| except Exception: | ||
| logger.debug(f"Could not ensure ManagedBy tag on {secret_id}") | ||
| logger.debug("Could not ensure ManagedBy tag on a secret.", exc_info=True) | ||
|
|
||
| def backoff_with_custom_exception(self, func, exception, message_prefix="", max_attempts=5, base_delay=1, max_delay=10, factor=2, *args, **kwargs): | ||
| attempts = 0 |
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. 🤖 Generated with Claude Code |
2 participants
Summary
ManagedBy: croudtech-bootstraptag to secrets created/updated by the pipelinecleanup_secrets()to only delete secrets that have theManagedBytagput-configput-configrun via_ensure_managed_by_tag()Test plan
put-configagainst a test environment and verify new secrets are created with theManagedBy: croudtech-bootstraptagManagedBytag added on updateput-configrun.secret.yamland confirm it is cleaned up (since it has theManagedBytag)🤖 Generated with Claude Code