AWS Lambda: Default log_type to None

[mickeyr]

When the log_type is set to the default value of Tail, the lambda logs are returned as a header to the client. This seems to violate the principle of least suprise.

Is there a need to return the lambda logs from a request by default? Seems like that carries a fairly large risk to be the default.

[chobits]

hi @mickeyr

Could you show us the example of this return the lambda logs from a request.
(BTW, I'm trying to look into the aws plugin source code and want to do some test, if you could provide this information to us, it could expedite our progress.)

---

updated:

Do you mean X-Amz-Log-Result: LogResult in the respones of aws lambda invode? from this link

[hanshuebner]

People are surprised by different things, and it may surprise some folks that they have to configure something in the API gateway so that the headers are not forwarded. Changing the default is also not all that easy due to backwards compatibility considerations, so at this point, I don't believe that we're going to change it.

[mickeyr]

having to configure something in the api gateway is not surprising. Having insecure defaults is surprising, especially when the default is different than any other aws sdk. I'm sure any reasonable person would feel the same way.

[chobits]

I have known what is that header, we ran a aws lambda test script, it will output a header X-Amz-Log-Result, aws lambda invode will return log info if you set Tail log type in its request, like the following

By default, it will output 3 lines of the lambda box info. If the user logs some info inthe aws lambda script, it will contain this log.

For more details, see aws lambda doc: https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html

[mickeyr]

It’s a handy setting for debugging, but if someone logs something sensitive, either in purpose or by accident, the default setting will leak that value in the response.

I know to turn it off, but not everyone will understand the implications of the default value.

[chobits]

Yeah, I understand your security concerns, so I'll file an internal ticket to track this. I believe this will require careful consideration.
-> internal ticket: KAG-4842