opentelemetry-util-http: redact_url leaves the SigV4 X-Amz-* query values of presigned URLs unredacted #5284

Describe your environment

OS: Ubuntu 24.04
Python version: 3.12
Package version: opentelemetry-util-http from main at 0715515 (api and semantic-conventions from opentelemetry-python main at dc7dbaf)

What happened?

A presigned S3 URL reaches url.full with its credential, session token and signature intact. PARAMS_TO_REDACT (util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py:59) holds the SigV2 names only, so redact_url never matches the SigV4 X-Amz-* keys that S3 presigns with by default.

Steps to Reproduce

from opentelemetry.util import http
from opentelemetry.util.http import redact_url

print(http.__file__)
url = (
    "https://bucket.s3.us-east-1.amazonaws.com/report.csv"
    "?X-Amz-Credential=ASIAEXAMPLE%2F20261029%2Fus-east-1%2Fs3%2Faws4_request"
    "&X-Amz-Security-Token=session-token&X-Amz-Signature=deadbeef"
)
print(redact_url(url))

Expected Result

https://bucket.s3.us-east-1.amazonaws.com/report.csv?X-Amz-Credential=REDACTED&X-Amz-Security-Token=REDACTED&X-Amz-Signature=REDACTED

The url registry lists all three X-Amz-* keys among those that SHOULD be redacted by default.

Actual Result

$ .venv/bin/python -I repro.py
.../util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
https://bucket.s3.us-east-1.amazonaws.com/report.csv?X-Amz-Credential=ASIAEXAMPLE%2F20261029%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Security-Token=session-token&X-Amz-Signature=deadbeef
# not run: the instrumentation test suites

Additional context

This follows up #2992. #3508 implemented its list, and the registry later moved to the SigV4 names. #4944 and #4960 touch the function, not the list.

The fix is to add the three SigV4 names and keep the SigV2 ones for old presigned URLs. With that change the script prints the expected line. I can send the PR with a test in tests/test_redact_query_parameters.py.

Would you like to implement a fix?

Yes

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}