Expose key metrics to cloudwatch #355
Conversation
Vlasis-Perdikidis
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return async (event: SQSEvent) => { | ||
| console.log( | ||
| "the environment variables:", | ||
| JSON.stringify(process.env, null, 2), |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
In general, the way to fix this is to stop logging sensitive data directly. For environment variables, you should never serialize and log the entire process.env. If you need diagnostics, log only specific, non-sensitive keys (e.g., feature flags) and avoid values that may contain credentials, tokens, or personal data.
For this specific code, the minimal fix without changing functionality elsewhere is to remove (or, if absolutely necessary, severely limit) the logging of process.env. Since the handler already logs the SQSEvent and other diagnostic information, the environment dump is not essential for normal operation. The safest and simplest solution is to delete the console.log statement that prints "the environment variables:" along with JSON.stringify(process.env, null, 2). If you still want some indication of environment configuration without leaking secrets, you could replace it with a log that only records the names of environment variables or a static message stating that the handler has started; however, because we cannot reliably know which env vars are safe, the most secure approach in this snippet is to remove the environment logging entirely.
Concretely, in lambdas/upsert-letter/src/handler/upsert-handler.ts:
- Remove lines 159–162 that log
"the environment variables:"andprocess.env. - No new imports or helper methods are required.
| @@ -156,10 +156,6 @@ | ||
| export default function createUpsertLetterHandler(deps: Deps): SQSHandler { | ||
| return metricScope((metrics) => { | ||
| return async (event: SQSEvent) => { | ||
| console.log( | ||
| "the environment variables:", | ||
| JSON.stringify(process.env, null, 2), | ||
| ); | ||
| console.log("The SQSEvent:", event); | ||
| const batchItemFailures: SQSBatchItemFailure[] = []; | ||
| metrics.setNamespace("vlasis_upsertLetter"); |
1 participant
Description
Context
Type of changes
Checklist
Sensitive Information Declaration
To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.