potiuk opened a new pull request, #72176:
URL: https://github.com/apache/airflow/pull/72176
`S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` embed the
object store credentials directly in the `CREATE MULTISET TABLE ... LOCATION`
statement when the store is private and no `teradata_authorization_name` is
configured:
```python
credentials_part = f"ACCESS_ID= '{access_key}' ACCESS_KEY= '{access_secret}'"
```
`DbApiHook._run_command` logs every statement it runs, so those values were
written to the task log on each run — readable by anyone who can read that
Dag's logs.
**What changed.** Both operators now build a redacted twin of the
credentials fragment. When credentials are inline, the hook's own SQL logging
is switched off for that statement (`log_sql`, already part of `DbApiHook`) and
the redacted form is logged instead, so operators still see what ran without
the values. The `AUTHORIZATION` path is untouched and keeps normal SQL logging.
**What this does not fix.** Teradata records the statement in its own query
logs (DBQL) and monitoring views. Airflow cannot redact those. Both docstrings
now say so and point at `teradata_authorization_name`, which keeps the
credentials in the database rather than in each statement — that remains the
right configuration for a private store.
Local: 278 passed across the Teradata provider; ruff and mypy clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
