rwatjen / armoutputparservstsextension Goto Github PK

Having all variables being output as secured has some important drawback: log readability and issues trace ability. Example: 'App Service '***-staging' started successfully.'

It becomes a nightmare to understand what's deployed/updated by following such logs. Especially when there's nothing secured in outputs and these outputs are used across the log.

Proposal:

1. Make ;issecret=true/false configurable with the following behavior:

• by default ;issecret has to be false
• add the "black list" variable like "Comma separated list of outputs to secure". if the variable is in this list - it will be set as ;issecret=true

2. As it's a breaking change in design/behavior release this as version 2.0.0 not to break existing users and put the change in release notes.

From my experience with ARM output most of the time output variables doesn't have any sensitive information so it doesn't make sense to secure them out. If there're variables that are sensitive - that has to be outlined explicitly by "Comma separated list of outputs to secure".

@rwatjen Please let me know what you think. If you give green-light for this - I can handle the change. Otherwise we'll have to switch to maybe our own implementation as with '***' for everything in log it becomes unreadable for people and it's a challenge to troubleshoot releases.