from __future__ import annotations
from typing import Any, Dict
SUSPICIOUS_TAG_KEYS = ("secret", "token", "password", "passwd", "key", "apikey", "api_key")
def redact_tags(tags: Dict[str, str]) -> Dict[str, str]:
out: Dict[str, str] = {}
for k, v in tags.items():
lk = k.lower()
if any(s in lk for s in SUSPICIOUS_TAG_KEYS):
out[k] = "[REDACTED]"
else:
out[k] = v
return out
def shallow_redact_snapshot(snapshot: Dict[str, Any]) -> Dict[str, Any]:
# MVP: only redacts EC2 instance tags under ec2_by_region.*.instances[].tags
ec2_by_region = snapshot.get("ec2_by_region", {})
for region, blob in ec2_by_region.items():
instances = blob.get("instances", [])
for inst in instances:
tags = inst.get("tags")
if isinstance(tags, dict):
inst["tags"] = redact_tags(tags)
return snapshot
