fix: signing params debug impl (#2562)

* fix: redact credentials when debug logging signing params

* update: CHANGELOG.next.toml

* yuki makes a good point

Author: Zelda Hessler

CHANGELOG.next.toml

@@ -86,3 +86,9 @@ message = "Fix but where an incorrect endpoint was produced for WriteGetObjectRe
 references = ["smithy-rs#781", "aws-sdk-rust#781"]
 meta = { "breaking" = false, "tada" = false, "bug" = true }
 author = "rcoh"
+
+[[aws-sdk-rust]]
+message = "Update the `std::fmt::Debug` implementation for `aws-sigv4::SigningParams` so that it will no longer print sensitive information."
+references = ["smithy-rs#2562"]
+meta = { "breaking" = false, "tada" = true, "bug" = true }
+author = "Velfi"

aws/rust-runtime/aws-sigv4/src/lib.rs

@@ -15,6 +15,7 @@
     unreachable_pub
 )]
 
+use std::fmt;
 use std::time::SystemTime;
 
 pub mod sign;
@@ -29,7 +30,6 @@ pub mod http_request;
 
 /// Parameters to use when signing.
 #[non_exhaustive]
-#[derive(Debug)]
 pub struct SigningParams<'a, S> {
     /// Access Key ID to use.
     pub(crate) access_key: &'a str,
@@ -49,6 +49,20 @@ pub struct SigningParams<'a, S> {
     pub(crate) settings: S,
 }
 
+impl<'a, S: fmt::Debug> fmt::Debug for SigningParams<'a, S> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("SigningParams")
+            .field("access_key", &"** redacted **")
+            .field("secret_key", &"** redacted **")
+            .field("security_token", &"** redacted **")
+            .field("region", &self.region)
+            .field("service_name", &self.service_name)
+            .field("time", &self.time)
+            .field("settings", &self.settings)
+            .finish()
+    }
+}
+
 impl<'a, S: Default> SigningParams<'a, S> {
     /// Returns a builder that can create new `SigningParams`.
     pub fn builder() -> signing_params::Builder<'a, S> {