Package: secure-logger
Secure LoggerA Python decorator to generate redacted and nicely formatted log
entries. Works on all callables: class, class methods, Python module
functions. Recursively redacts Python dictionary key values based on a
customizable list of case-insensitive keys. Prevents your sensitive
application data like cloud provider key-pairs from leaking into your
application logs.Installationpipinstallsecure-loggerUsageAs a decoratorfromsecure_logger.decoratorsimportsecure_loggerimportlogginglogging.getLogger(__name__)logging.basicConfig(level=logging.INFO)classFoo(object):@secure_logger(log_level='INFO')defbar(self,dict_data,list_data):pass# call your method, passing some sensitive datadict_data={"not_a_sensitive_key":"you-can-see-me","aws-access-key-id":"i-am-hidden","aws-secret-access-key":"so-am-i",}list_data=["foo","bar"]foo=Foo()foo.bar(dict_data=dict_data,list_data=list_data)Log output:INFO:secure_logger: __main__.bar() ['<__main__.Foo object at 0x103474ac0>'] keyword args: {"dict_data": {"not_a_sensitive_key": "you-can-see-me","aws-access-key-id": "*** -- secure_logger() -- ***","aws-secret-access-key": "*** -- secure_logger() -- ***"},"list_data": ["foo","bar"]As library functionsfromsecure_logger.masked_dictimportmasked_dict,masked_dict2strdict_data={'not_a_sensitive_key':'you-can-see-me','aws-access-key_id':conf.AWS_ACCESS_KEY_ID,'aws-secret-access-key':conf.AWS_SECRET_ACCESS_KEY}print(masked_dict2str(dict_data))Output:{"not_a_sensitive_key":"you-can-see-me","aws-access-key-id":"*** -- secure_logger() -- ***","aws-secret-access-key":"*** -- secure_logger() -- ***"}Configurationsecure_logger accepts optional parameters which you can configure as either bash environment variables or with a .env file placed in the root of your projectSECURE_LOGGER_SENSITIVE_KEYS: a Python list of dictionary keys. Not case sensitive.SECURE_LOGGER_REDACTION_MESSAGE: a string value that will replace the sensitive key valuesSECURE_LOGGER_INDENTATION: number of characters to indent JSON string output when logging outputSECURE_LOGGER_LOG_LEVEL: the level at which secure_logger generates log entries. One of: 'CRITICAL', 'FATAL', 'ERROR', 'WARN', 'WARNING', 'INFO', 'DEBUG'Additionally, you can override individual invocations of the decorator with custom parameters:classMyClass():@secure_logger(log_level='DEBUG',sensitive_keys=["password","apikey","crown_jewels"],message="*** -- TOP SECRET -- ***",indent=4)defanother_function(self,password:str,apikey:str,crown_jewels:List(dict)):passConfiguration DefaultsSECURE_LOGGER_REDACTION_MESSAGE="*** -- secure_logger() -- ***"SECURE_LOGGER_INDENTATION=4SECURE_LOGGER_SENSITIVE_KEYS=["password","token","client_id","client_secret","Authorization","secret","access_key_id","secret_access_key","access-key-id","secret-access-key","aws_access_key_id","aws_secret_access_key","aws-access-key-id","aws-secret-access-key",]SECURE_LOGGER_LOG_LEVEL='DEBUG'ContributingPull requests are welcomed and encouraged!This project uses an automatedPull RequestCI/CD process.This project conforms to12-Factor Methodology.This project usesSemantic Versioningwhich requires that git commit messages follow strict (but easy to learn) formatting rules.Contact:Lawrence McDaniel.