Sanitize credentials from AWS client err (#2431)

Signed-off-by: Jordi Prats <jordi.prats@gmail.com>

pkg/provider/aws/secretsmanager/secretsmanager.go

@@ -460,7 +460,7 @@ func (sm *SecretsManager) Validate() (esv1beta1.ValidationResult, error) {
 	}
 	_, err := sm.sess.Config.Credentials.Get()
 	if err != nil {
-		return esv1beta1.ValidationResultError, err
+		return esv1beta1.ValidationResultError, util.SanitizeErr(err)
 	}
 	return esv1beta1.ValidationResultReady, nil
 }

pkg/provider/aws/util/errors.go

@@ -19,11 +19,16 @@ import (
 	"regexp"
 )
 
-var regexReqID = regexp.MustCompile(`request id: (\S+)`)
+var regexReqIDs = []*regexp.Regexp{
+	regexp.MustCompile(`request id: (\S+)`),
+	regexp.MustCompile(` Credential=.+`),
+}
 
-// SanitizeErr sanitizes the error string
-// because the requestID must not be included in the error.
-// otherwise the secrets keeps syncing.
+// SanitizeErr sanitizes the error string.
 func SanitizeErr(err error) error {
-	return errors.New(string(regexReqID.ReplaceAll([]byte(err.Error()), nil)))
+	msg := err.Error()
+	for _, regex := range regexReqIDs {
+		msg = string(regex.ReplaceAll([]byte(msg), nil))
+	}
+	return errors.New(msg)
 }

pkg/provider/aws/util/errors_test.go

@@ -30,6 +30,10 @@ func TestSanitize(t *testing.T) {
 			expected: "some AccessDeniedException: User: arn:aws:sts::123123123123:assumed-role/foobar is not authorized to perform: secretsmanager:GetSecretValue on resource: example\n\tstatus code: 400, ",
 		},
 		{
+			err:      errors.New("IncompleteSignature: 'something' not a valid key=value pair (missing equal-sign) in Authorization header: 'AWS4-HMAC-SHA256 Credential=You,Can Get\"Almost{Anything}Here', SignedHeaders=content-length;content-type;host;x-amz-date, Signature=42ee80d90508ee472701f8fb7014f10c0ac16b6d6ac59379f0612ca2d35d7464'"),
+			expected: "IncompleteSignature: 'something' not a valid key=value pair (missing equal-sign) in Authorization header: 'AWS4-HMAC-SHA256",
+		},
+		{
 			err:      errors.New("some generic error"),
 			expected: "some generic error",
 		},