is it possible to delete the logs for an "activity...
# generalw
wet-noon-14291
09/27/2022, 1:19 PMis it possible to delete the logs for an "activity"? I want a way to clean up potential secrets that might have been printed.
m
millions-furniture-75402
09/27/2022, 1:22 PMIf possible, it's probably better to rotate the secrets
👍 1
w
wet-noon-14291
09/27/2022, 1:56 PMThat can address it in this case, but in general I think it would be good to be able to delete the logs from a run.
m
millions-furniture-75402
09/27/2022, 2:14 PMThat gets complicated quickly, right? Because these "logs" are also state differences.
Deleting the last state is simple enough, but what about deleting "activity" that wasn't the last state change? What would the implications be?
The Pulumi web service is an application built on top of Pulumi's stack/state management. What does expunging it from activity involve? Ideally any trace of the secret, right? Again, what are the implications?
I don't know enough to answer these questions, but maybe a Pulumi staff member can.
millions-furniture-75402
09/27/2022, 2:17 PMThe workaround would be to destroy and remove the stack, then recreate it, but obviously that's often not a possibility.
w
wet-noon-14291
09/27/2022, 2:17 PMYeah, probably not straight forward.. but it should be possible to delete all the logs except latest, right?
m
millions-furniture-75402
09/27/2022, 2:19 PMYeah, that's a more likely implementable feature request, to be able to prune older state versions.
millions-furniture-75402
09/27/2022, 2:20 PMThis is essentially the endpoint that the Pulumi service is using https://www.pulumi.com/docs/reference/service-rest-api/#list-stack-updates
s
stocky-restaurant-98004
09/27/2022, 2:33 PMEchoing @millions-furniture-75402: Basically, once a secret is written to disk unencrypted, it should be considered compromised and therefore be rotated.
👍 1
l
little-cartoon-10569
09/27/2022, 8:05 PMAgree. Removing the logs is only Security Through Obscurity. Can't rely on that!
5 Views