Describe the bug

summary:

Previously, this ticket, reference id, D122668413, discussed the issue: Throttling CDK constructs logs S3 pre-signed Urls, according to the ticket, upgrade cdk to a newer version (version > 2.132.0) can fix the issue.

actions:

we successfully upgrade to ^2.132.0, and we see some pre-signed url is removed, but some are not for the same deployment

issue:

• after connecting with cdk team, team identified the root cause: "we using cfnRequest instead of sanitizedRequest at this line of code https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/framework.ts#L41"
• start this issue to track the process

aws ticket:

V1507107822

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

no more pre-signed url written to log

Current Behavior

we successfully upgrade to ^2.132.0, and we see some pre-signed url is removed, but some are not for the same deployment

Reproduction Steps

deploy the stack and check log in the cloudwatch with

fields @timestamp, @message, @log, @logStream | filter @message like /(?i)X-Amz-Algorithm.*X-Amz-Credential.*Signature/ and @message not like /fields @timestamp, @message, @log, @logStream/

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.132.0

Framework Version

No response

Node.js Version

NA

OS

macos

Language

TypeScript

Language Version

No response

Other information

No response