Redact S3 credentials from logs by jerome079 · Pull Request #10811 · apache/cloudstack

jerome079 · 2025-05-04T18:26:42Z

Description

This PR addresses a security issue where S3 credentials used for Secondary Storage were being logged in plain text in CloudStack logs (access.log and management-server.log). Even when debug logging is enabled, secret credentials such as accessKey and secretKey should never appear in logs.

Fix details:

Redacts the accessKey and secretKey from the S3TO object before logging DownloadCommand in NfsSecondaryStorageResource.java.
Adds a unit test in NfsSecondaryStorageResourceTest.java to verify that credentials are redacted.

Steps to reproduce the issue:

Deploy CloudStack 4.20.0.0 with KVM and Ceph RGW S3 as Secondary Storage.
Create a Secondary Storage using S3 credentials.
Observe logs in /var/log/cloudstack/management/access.log or management-server.log — credentials will be printed.

Fixes: #10339

Types of changes

Bug fix (non-breaking change which fixes an issue)
test (unit or integration test code)

Bug Severity

Major

How Has This Been Tested?

Added a unit test that mocks S3TO and verifies that setAccessKey("***REDACTED***") and setSecretKey("***REDACTED***") are called during executeRequest.

boring-cyborg · 2025-05-04T18:26:47Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

DaanHoogland · 2025-05-05T08:09:44Z

+            DataStoreTO store = safeCmd.getDataStore();
+            if (store instanceof S3TO) {
+                ((S3TO) store).setAccessKey("***REDACTED***");
+                ((S3TO) store).setSecretKey("***REDACTED***");
+            }
+            logger.debug(LogUtils.logGsonWithoutException("Executing command %s [%s].", safeCmd.getClass().getSimpleName(), safeCmd));


code looks good, but it seems this should be in LogUtils. There is other obfuscation code also scattered across the code base, so definately not a 👎 but a mere suggestion.

…udstack/storage/resource/NfsSecondaryStorageResourceTest.java

DaanHoogland · 2025-07-10T10:28:21Z

@blueorangutan LLpackage

blueorangutan · 2025-07-10T10:30:02Z

@DaanHoogland a [LL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2025-07-10T10:35:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 3.91%. Comparing base (8e4fe1c) to head (ff6a437).
⚠️ Report is 944 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (8e4fe1c) and HEAD (ff6a437). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (8e4fe1c) HEAD (ff6a437)

unittests 1 0

Additional details and impacted files

@@              Coverage Diff              @@
##               main   #10811       +/-   ##
=============================================
- Coverage     16.57%    3.91%   -12.67%     
=============================================
  Files          5745      415     -5330     
  Lines        510847    33793   -477054     
  Branches      62140     6078    -56062     
=============================================
- Hits          84696     1322    -83374     
+ Misses       416677    32313   -384364     
+ Partials       9474      158     -9316

Flag	Coverage Δ
uitests	`3.91% <ø> (ø)`
unittests	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2025-07-10T10:43:59Z

Packaging result [LL]: ✖️ el7 ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 6219

DaanHoogland · 2025-07-13T18:22:03Z

@blueorangutan package

blueorangutan · 2025-07-13T18:24:04Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-07-13T18:52:41Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 14149

DaanHoogland · 2025-07-14T11:06:23Z

@jerome079 can you have a look at this PR?

20:43:58 [ERROR] /jenkins/workspace/acs-centos8-pkg-builder/dist/rpmbuild/BUILD/cloudstack-4.21.0.0-SNAPSHOT/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java:299: Line has trailing spaces. [RegexpSingleline]

github-actions · 2025-09-11T16:03:31Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

rajujith · 2026-01-12T07:36:07Z

@jerome079 can you resolve the conflicts and retarget the PR to the 4.22 branch?

DaanHoogland · 2026-01-12T07:50:11Z

@jerome079 can you resolve the conflicts and retarget the PR to the 4.22 branch?

@jerome079 @rajujith , I think if any retargeting for this one is done it should be for 4.20 (20.3 release)

sureshanaparti · 2026-02-13T05:24:52Z

Hi @jerome079 is this PR ready for review? can you check the build errors, and outstanding comments. thanks.

nvazquez · 2026-08-12T16:24:59Z

Hi @jerome079 can you please address the conflicts?

boring-cyborg Bot added component:secondary-storage component:ssvm labels May 4, 2025

DaanHoogland reviewed May 5, 2025

View reviewed changes

sureshanaparti added this to the 4.20.2 milestone Jun 5, 2025

fixing s3 credentials leak

a43d34c

DaanHoogland force-pushed the fix/s3-credential-log-leak branch from 0dedb70 to a43d34c Compare July 10, 2025 10:27

DaanHoogland reviewed Jul 10, 2025

View reviewed changes

Comment thread ...er/src/test/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResourceTest.java Outdated

Update services/secondary-storage/server/src/test/java/org/apache/clo…

ff6a437

…udstack/storage/resource/NfsSecondaryStorageResourceTest.java

github-actions Bot added the status:has-conflicts label Sep 11, 2025

weizhouapache modified the milestones: 4.20.2, 4.22.0 Sep 11, 2025

harikrishna-patnala modified the milestones: 4.22.0, 4.22.1 Nov 12, 2025

rajujith added this to Apache CloudStack 4.22.1 Jan 5, 2026

sureshanaparti moved this to In Progress in Apache CloudStack 4.22.1 Jan 7, 2026

sureshanaparti added the status:waiting-for-author label Apr 24, 2026

sureshanaparti removed this from Apache CloudStack 4.22.1 Apr 24, 2026

sureshanaparti modified the milestones: 4.22.1, 4.23.0 Apr 24, 2026

weizhouapache modified the milestones: 4.23.0, 4.24.0 Jun 29, 2026

DaanHoogland added this to CloudStack Testing Aug 31, 2026

github-project-automation Bot moved this to Backlog in CloudStack Testing Aug 31, 2026

DaanHoogland moved this from Backlog to conflict/waiting for author in CloudStack Testing Aug 31, 2026

nvazquez modified the milestones: 24.0, 25.0 Oct 27, 2026

Conversation

jerome079 commented May 4, 2025

Description

Types of changes

Bug Severity

How Has This Been Tested?

Uh oh!

boring-cyborg Bot commented May 4, 2025

Uh oh!

DaanHoogland May 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DaanHoogland commented Jul 10, 2025

Uh oh!

blueorangutan commented Jul 10, 2025

Uh oh!

codecov Bot commented Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Jul 10, 2025

Uh oh!

DaanHoogland commented Jul 13, 2025

Uh oh!

blueorangutan commented Jul 13, 2025

Uh oh!

blueorangutan commented Jul 13, 2025

Uh oh!

DaanHoogland commented Jul 14, 2025

Uh oh!

github-actions Bot commented Sep 11, 2025

Uh oh!

rajujith commented Jan 12, 2026

Uh oh!

DaanHoogland commented Jan 12, 2026

Uh oh!

sureshanaparti commented Feb 13, 2026

Uh oh!

nvazquez commented Aug 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

codecov Bot commented Jul 10, 2025 •

edited

Loading