Sensitive ingest tokens - #121
Conversation
The computed token attributes of logtail_source and logtail_errors_application authenticate data ingestion, but were not marked Sensitive, so terraform plan/apply printed them in plaintext - leaking them into CI logs and plan-bot PR comments. Mark them Sensitive: true (this propagates to the corresponding data sources, which copy the resource schemas) and mark the basic example's logtail_source_token output sensitive so plans keep working. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
API error responses were embedded verbatim in user-facing diagnostics, so a validation error echoing a submitted secret (bucket keys, database passwords) would land in plaintext in terraform output and CI logs. Include the response body in diagnostics only when the user has opted into insecure logging via TF_PROVIDER_LOGTAIL_LOG_INSECURE=1 - the same gate that already controls request/response body logging in main.go. The default message tells the user how to opt in when debugging. Also stop retrying POST requests on 5xx responses: the create may have succeeded server-side before the error response, and retrying it would silently create a duplicate resource. 429s are still retried. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Follow-up: complete duplicate-create protection via
|
Summary
Three related hardening fixes around secret handling and API error behavior.
1. Mark ingest tokens as
SensitiveThe computed
tokenattributes onlogtail_sourceandlogtail_errors_applicationauthenticate data ingestion into the team's account, but were not markedSensitive. Terraform printed them in plaintext in everyplan/apply— leaking them into CI logs, plan-bot PR comments (Atlantis, Spacelift, etc.), and terminal scrollback. Anyone reading those logs can inject arbitrary data into the sources.The equivalent
logtail_collector.secretwas alreadySensitive: true, so this closes an inconsistency rather than changing a design decision. The corresponding data sources pick the flag up automatically (they build their schemas by copying the resource schemas). The newjs_tag_tokenstays non-sensitive, since it is a public browser-side token by design.2. Gate API response bodies out of error diagnostics
API error responses were embedded verbatim in user-facing diagnostics (
diag.Errorf("POST ... returned %d: %s", ..., body)). If a validation error echoes submitted fields — requests carrysecret_access_key, databasepassword, connectionpassword— the secret lands in plaintext in terraform output and CI logs. Notably, this path was not covered by the existingTF_PROVIDER_LOGTAIL_LOG_INSECUREgate, which only controls debug logging.Error diagnostics now include the response body only when
TF_PROVIDER_LOGTAIL_LOG_INSECURE=1is set — reusing the same opt-in that already governs request/response body logging inmain.go, so there is a single, deterministic switch for "may print API payloads". The default error message tells the user how to opt in when debugging.3. Stop retrying POSTs on 5xx
The retry policy retried POST requests on server errors. A create that succeeded server-side before the error response (e.g. a gateway timeout) would be retried and silently create a duplicate resource. POSTs now retry only on 429 rate limits; GET/PATCH/DELETE keep the default retry policy.
Other changes
examples/outputs.tf—logtail_source_tokenoutput markedsensitive = true(required by Terraform ≥0.14 once the attribute is sensitive; the E2Eoutput -jsonverification still sees the value, so CI checks keep working)docs/— regenerated viamake genMakefile—VERSIONbumped to10.15.12(next patch afterv10.15.11)TestResourceMetricPatchErrorPropagatesnow opts into the gate viat.Setenvto keep verifying body propagationImpact on users
No resource changes or replacements — only display and error-handling behavior:
token = (sensitive value)instead of the plaintext token; users outputting these tokens directly needsensitive = trueon their outputs (Terraform reports this with a clear error)TF_PROVIDER_LOGTAIL_LOG_INSECURE=1to restore it when debuggingTesting
go test -timeout 10m ./...passes (acceptance-style provider tests + new unit tests)make genproduces a clean diff (checked by thecheck_docsCI job)🤖 Generated with Claude Code