Proposal: Fine-grained field masking

[gdavison]

terraform-plugin-log version

v0.7.0

Use cases

I'm looking to mask only parts of a field, rather than the whole field, in log output. For example, when logging AWS API requests, the Authorization field looks like the folllowing:

Authorization: AWS4-HMAC-SHA256 Credential=AKIA5PX2H2S3BEXAMPLE/20221205/us-west-2/sso/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-target, Signature=17736c976abda4c0cc3e91c0dd1a8b9aa7c2f34e21fde9dd5f32c35bbaadc0de

In this example, I would like to mask the Access Key portion of Credential, except for the last four characters, as well as the Signature. Something like

Authorization: AWS4-HMAC-SHA256 Credential=****************MPLE/20221205/us-west-2/sso/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-target, Signature=*******

Proposal

I propose adding a hook either for all fields or a specific field that could parse the field content and mask as appropriate. In the example above, it would involve parsing the AWS Signature v4 header for specific values and masking those.