From 42e666f4926fd91a0d8de250c27b46d33c6850de Mon Sep 17 00:00:00 2001
From: Akshaay <89546672+Akshaay1@users.noreply.github.com>
Date: Mon, 2 Nov 2026 07:01:43 +0000
Subject: [PATCH 1/4] util-http: add X-Amz-Signature, X-Amz-Credential,
 X-Amz-Security-Token to PARAMS_TO_REDACT

PARAMS_TO_REDACT only covered AWSAccessKeyId, Signature, sig, and
X-Goog-Signature. The semantic conventions url attribute registry also
lists X-Amz-Signature, X-Amz-Credential, and X-Amz-Security-Token for
redaction, so an S3 SigV4 presigned URL fetched through an instrumented
client exported its signature, credential scope, and (for temporary
credentials) the full STS session token verbatim in url.full/http.url.

Fixes #5279

Assisted-by: Claude Sonnet 5
---
 .../src/opentelemetry/util/http/__init__.py   | 10 ++++-
 .../tests/test_redact_query_parameters.py     | 37 +++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py b/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
index ac9d97610d3..ef9a16414e7 100644
--- a/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
+++ b/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
@@ -56,7 +56,15 @@
     HTTP_SERVER_NAME,
 }
 
-PARAMS_TO_REDACT = ["AWSAccessKeyId", "Signature", "sig", "X-Goog-Signature"]
+PARAMS_TO_REDACT = [
+    "AWSAccessKeyId",
+    "Signature",
+    "sig",
+    "X-Goog-Signature",
+    "X-Amz-Signature",
+    "X-Amz-Credential",
+    "X-Amz-Security-Token",
+]
 
 
 class ExcludeList:
diff --git a/util/opentelemetry-util-http/tests/test_redact_query_parameters.py b/util/opentelemetry-util-http/tests/test_redact_query_parameters.py
index 84e47741890..97a4d435500 100644
--- a/util/opentelemetry-util-http/tests/test_redact_query_parameters.py
+++ b/util/opentelemetry-util-http/tests/test_redact_query_parameters.py
@@ -75,3 +75,40 @@ def test_signature_with_url_encoding(self):
             redact_query_parameters(url),
             "https://service.com?Signature=REDACTED",
         )
+
+    def test_redact_amz_signature(self):
+        url = "https://bucket.s3.amazonaws.com/obj?X-Amz-Signature=abc123"
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Signature=REDACTED",
+        )
+
+    def test_redact_amz_credential(self):
+        url = (
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Credential="
+            "AKIAEXAMPLE%2F20261101%2Fus-east-1%2Fs3%2Faws4_request"
+        )
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Credential=REDACTED",
+        )
+
+    def test_redact_amz_security_token(self):
+        url = "https://bucket.s3.amazonaws.com/obj?X-Amz-Security-Token=FwoGZXIvYXdzEXAMPLETOKEN"
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Security-Token=REDACTED",
+        )
+
+    def test_redact_sigv4_presigned_url(self):
+        url = (
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Algorithm=AWS4-HMAC-SHA256"
+            "&X-Amz-Credential=AKIAEXAMPLE%2F20261101%2Fus-east-1%2Fs3%2Faws4_request"
+            "&X-Amz-Security-Token=FwoGZXIvYXdzEXAMPLETOKEN&X-Amz-Signature=abc123"
+        )
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Algorithm=AWS4-HMAC-SHA256"
+            "&X-Amz-Credential=REDACTED"
+            "&X-Amz-Security-Token=REDACTED&X-Amz-Signature=REDACTED",
+        )

From 2ca7de855cc6792ecaa85a6fdc52c1e6e28d2bd2 Mon Sep 17 00:00:00 2001
From: Akshaay <89546672+Akshaay1@users.noreply.github.com>
Date: Mon, 2 Nov 2026 07:02:22 +0000
Subject: [PATCH 2/4] util-http: add towncrier changelog fragment for #5280

Assisted-by: Claude Sonnet 5
---
 .changelog/5280.fixed | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .changelog/5280.fixed

diff --git a/.changelog/5280.fixed b/.changelog/5280.fixed
new file mode 100644
index 00000000000..4a40a17eb75
--- /dev/null
+++ b/.changelog/5280.fixed
@@ -0,0 +1 @@
+opentelemetry-util-http: redact `X-Amz-Signature`, `X-Amz-Credential`, and `X-Amz-Security-Token` query parameters

From 4e669dcc1a2121aa01f4813359276c2f14ef5e5f Mon Sep 17 00:00:00 2001
From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Date: Thu, 5 Nov 2026 16:44:40 +0100
Subject: [PATCH 3/4] Update .changelog/5280.fixed

---
 .changelog/5280.fixed | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changelog/5280.fixed b/.changelog/5280.fixed
index 4a40a17eb75..751340f7b06 100644
--- a/.changelog/5280.fixed
+++ b/.changelog/5280.fixed
@@ -1 +1 @@
-opentelemetry-util-http: redact `X-Amz-Signature`, `X-Amz-Credential`, and `X-Amz-Security-Token` query parameters
+`opentelemetry-util-http`: redact `X-Amz-Signature`, `X-Amz-Credential`, and `X-Amz-Security-Token` query parameters

From 36017e6adf22c2108264ac6b7352166375bcc124 Mon Sep 17 00:00:00 2001
From: Akshaay <89546672+Akshaay1@users.noreply.github.com>
Date: Thu, 5 Nov 2026 22:19:41 +0530
Subject: [PATCH 4/4] util-http: credit #5279 reporter as co-author

The reproduction, test URLs and proposed fix for this change come from
issue #5279.

Co-authored-by: preetsaini2004 <91930460+preetsaini2004@users.noreply.github.com>