[Bug]: security issue: step ca server logs contain signed AWS IID

[liji-canva]

Steps to Reproduce

1. Add an AWS IID provisioner to step ca
2. Configure step-ca as an registration authority to a vault CA (this is our config, but I don't think it is required to reproduce the issue)
3. Using step ca certificate command to send a request to create a key and certificate from an aws ec2 instance using the AWS IID provisioner.

Your Environment

• OS - Linux
• step-ca Version - 0.28.0

Expected Behavior

The server side logs should not contain any secret, security tokens or any sensitive data.

Actual Behavior

The server side log contains something like {"certificate":"<cert_content>","duration":"1.601449404s","duration-ns":1601449404,"fields.time":"2025-05-20T06:00:03Z","issuer":"Dev Device CA","level":"info","method":"POST","msg":"","name":"ca","ott":"<ott_jwt>",...}

The <ott_jwt> is a jwt, when decoded, it contains an aws IID with signature. Which can be obtained and used to forge a cert request from none aws ec2 instances.

Additional Context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[hslatman]

Hi @liji-canva,

I don't disagree that it would be better to redact those, but since the logs are server side, them being viewed by someone unauthorized requires access to the server already, so there might be bigger security issues. Are you pushing the logs to some other location using additional tools?

[fruechel-canva]

Hey @hslatman,

Sorry about the delay I forgot to reply here. I've been working with Liji on this problem.

In our deployment, logs are sent to a centralised log store. This is likely to happen with many modern cloud deployments, for example, if you use AWS ECS it creates a CloudWatch Log group so it's not a question of server access, but of access to read those logs. In our team, we don't restrict log access as they often contain useful information, and we make sure that logs don't contain sensitive details unless explicitly configured to.