Redaction of sensitive attributes from spans

[Harnoor-se7en]

Hi
We are looking to redact spans attributes having sensitive fields. We want to look for sensitive data in span attributes (by a match against certain regexes or words list) and mask them upfront before exporting them to the collector.
At first glance, I thought creating a custom SpanProcessor and implementing onEnd method would be enough but it receives ReadOnlySpan as its parameter, hence this will not work.

So what should be the correct approach for this problem?

Thanks.

[dmathieu]

I think this may be easier to handle within a custom exporter which would redact the values before they are sent, and then delegate the sending approach to a parent one.

[Harnoor-se7en]

Sorry, didn't get it. Can you please point to the resource that registers a span exporter customizer through which I can wrap the parent exporter?

[dmathieu]

This is how you can configure the exporter to use OTLP GRPC: https://github.com/open-telemetry/opentelemetry-go/blob/main/example/otel-collector/main.go#L61

This is the exporter span: https://github.com/open-telemetry/opentelemetry-go/blob/main/sdk/trace/span_exporter.go#L21

The idea would be: create a custom exporter. Modify the spans value as you need, then call the parent exporter to send the data.

[Harnoor-se7en]

Thanks!

[Harnoor-se7en]

@dmathieu BTW is there an alternate solution where we can reject sensitive attributes upfront before setting them?
The above approach is fine but it's a bit expensive operation since it involves deep copy for each span.

[dmathieu]

I guess you could implement your own tracer.

[pellared]

1. Could you please elaborate why you do not want to do such kind of redaction using the collector?
2. Would it help if it would be possible to configure the instrumentation libraries to not emit attributes that can contain sensitive data? Are you able to list these attributes?

[Harnoor-se7en]

1. Redaction processor of Otel collector hasn't been released yet. And let's say there is some file(accessed via credstash/s3 url) that has all the sensitive tags/baggage keys, values, or regex which is regularly updated once every 15 days. My application loads and caches that file and whenever any attribute is set or before exporting all the attributes, I can match them against all the fields in my file and can redact those attributes at my instrumentation package level.
2. Yes, it would really be helpful if we can mask or delete before emitting. Some of the examples of sensitive keys or values can be:

authorization
amzn.mws.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}

[MrAlias]

For what it's worth, I saw this question too many times and created redact to address it more generally.

I think the selected answer is correct, in that a custom exporter will likely be the most performant. The approach redact takes for attributes is to override them with a redaction value during the span creation. This means an allocation is required when the SetAttributes method is called. Nonetheless, I wanted to include it here in the chance it might help others.