Redact credentials in logs

[lf-]

Currently (tested on 2.0) the default hooks in Amazonka will log credentials like x-amz-security-token:

[Client Request] {
  host      = redacted.s3.us-east-1.amazonaws.com:443
  secure    = True
  method    = PUT
  target    = Nothing
  timeout   = ResponseTimeoutMicro 70000000
  redirects = 0
  path      = /test
  query     = 
  headers   = x-amz-security-token: redacted; x-amz-content-sha256: redacted; x-amz-date: 20251125T014505Z; host: redacted.s3.us-east-1.amazonaws.com; expect: 100-continue; authorization: AWS4-HMAC-SHA256 Credential=redacted, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token, Signature=redacted
  body      = foo
}

It's probably preferable to not do this by default as those credentials could be abused by third parties if found in the logs.

Repro:

{-# LANGUAGE OverloadedStrings #-}
module Foo (main) where

import Control.Monad (void)
import Amazonka qualified as AWS
import Amazonka.S3 qualified as S3
import Data.Text.Encoding qualified as Text
import Data.Text qualified as Text
import Data.ByteString qualified as BS
import Data.ByteString.Builder qualified as BB

withLogging :: AWS.Env' withAuth -> AWS.Env' withAuth
withLogging env =
  env
    { AWS.logger = \_ bsb -> putStrLn (Text.unpack . Text.decodeUtf8Lenient . BS.toStrict . BB.toLazyByteString $ bsb)
    }


go :: IO ()
go = AWS.runResourceT $ do
  awsEnv <- withLogging <$> AWS.newEnv AWS.discover
  let req = S3.newPutObject "redacted" (S3.ObjectKey "test") "foo"
  void . AWS.send awsEnv $ req

main = do
  go