SQS source plugin logs exception messages that may contain sensitive data

[indrajababu]

The SQS source plugin logs exception messages verbatim via e.getMessage() at ERROR level. AWS SDK exceptions can contain sensitive data in their messages including SQS receipt handles, queue URLs (with AWS account IDs), and potentially IAM credentials from nested cause chains. Full stack traces are also logged at ERROR level in some code paths.

What solution would you like?

Replace e.getMessage() in LOG.error calls with a safe summary that only extracts non-sensitive metadata:

• Exception class name
• AWS error code and HTTP status code
• Request ID
• Retryable flag
• Cause chain class names (without messages)

Move full stack traces to DEBUG level only.

What alternatives have you considered?

1. Regex-based sanitization (denylist) — rejected as fragile and incomplete
2. Fixing the existing SensitiveArgumentMaskingConverter — insufficient since it only masks {} parameters, not exception messages or stack traces

Additional context

Affected files:

• SqsWorkerCommon.java (3 LOG.error calls)
• SqsWorker.java (2 LOG.error calls)
• RawSqsMessageHandler.java (1 LOG.error call with full stack trace)