From d94483ca4e104906715ae8c1bda48d71605b56a7 Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Fri, 31 Jul 2026 23:15:23 -0600
Subject: [PATCH 1/6] chore: update connector quality tooling

Refresh pre-commit hooks and apply their generated maintenance updates before the connector behavior change.

Authored by Codex.
---
 .pre-commit-config.yaml | 6 +++---
 run_query.html          | 4 +---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ffb245f..704da0b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -27,13 +27,13 @@ repos:
       - id: check-json
       - id: check-yaml
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.22
+    rev: v0.16.1
     hooks:
       - id: ruff
         args: [ "--fix", "--unsafe-fixes"] # Allow unsafe fixes (ruff pretty strict about what it can fix)
       - id: ruff-format
   - repo: https://github.com/djlint/djLint
-    rev: v1.40.7
+    rev: v1.43.1
     hooks:
       - id: djlint-reformat-django
       - id: djlint-django
@@ -61,7 +61,7 @@ repos:
         exclude: "README.md"
   # Central hooks
   - repo: https://github.com/phantomcyber/dev-cicd-tools
-    rev: v2.2.3
+    rev: v2.2.8
     hooks:
       - id: build-docs
         language: python
diff --git a/run_query.html b/run_query.html
index b6f4cf6..7a23c09 100644
--- a/run_query.html
+++ b/run_query.html
@@ -26,9 +26,7 @@
   {{ title1 }}
 {% endblock %}
 {% block title2 %}{{ title2 }}{% endblock %}
-{%
-block custom_tools %}
-{% endblock %}
+{% block custom_tools %}{% endblock %}
 {% block widget_content %}
   <!-- Main Start Block -->
   <style>

From b03d31cd875b02faee2707f4b6c104452099680a Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Fri, 31 Jul 2026 23:15:37 -0600
Subject: [PATCH 2/6] fix: redact action-scoped AWS credentials

Mark temporary credentials as password input, omit them from persisted ActionResult parameters, and remove their output metadata.

References PAPP-37946, PSAAS-32390, and VULN-95113.

Authored by Codex.
---
 README.md                   |  6 ++----
 athena.json                 | 24 ++----------------------
 athena_connector.py         | 10 +++++++---
 release_notes/unreleased.md |  2 ++
 4 files changed, 13 insertions(+), 29 deletions(-)

diff --git a/README.md b/README.md
index df23cef..fdbbd75 100644
--- a/README.md
+++ b/README.md
@@ -78,7 +78,7 @@ Read only: **True**
 
 PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
 --------- | -------- | ----------- | ---- | --------
-**credentials** | optional | Assumed role credentials | string | `aws credentials` |
+**credentials** | optional | Assumed role credentials | password | `aws credentials` |
 
 #### Action Output
 
@@ -102,7 +102,6 @@ action_result.summary.num_queries | numeric | | 7 |
 action_result.message | string | | Num queries: 7 |
 summary.total_objects | numeric | | 1 |
 summary.total_objects_successful | numeric | | 1 |
-action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'TESTSJL6ZZZZZ3M7TEST', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'ZZZZZAmvLPictcVBPvjJx0d7MRezOuxiLCMZZZZZ', 'SessionToken': 'ZZZZZXIvYXdzEN///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SW9gO0ZRjEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTS+xeKi1hirKRizpJ8jjnxGQIikPRToL2v3ZZZZZZ=='} |
 
 ## action: 'run query'
 
@@ -121,7 +120,7 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
 **database** | optional | Database to run query on | string | |
 **s3_location** | required | S3 location to save results | string | |
 **encryption** | optional | Encyption scheme of S3 location | string | |
-**credentials** | optional | Assumed role credentials | string | `aws credentials` |
+**credentials** | optional | Assumed role credentials | password | `aws credentials` |
 
 #### Action Output
 
@@ -137,7 +136,6 @@ action_result.summary.num_rows | numeric | | 0 |
 action_result.message | string | | Num rows: 0 |
 summary.total_objects | numeric | | 1 |
 summary.total_objects_successful | numeric | | 1 |
-action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'TESTSJL6ZZZZZ3M7TEST', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'ZZZZZAmvLPictcVBPvjJx0d7MRezOuxiLCMZZZZZ', 'SessionToken': 'ZZZZZXIvYXdzEN///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SW9gO0ZRjEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTS+xeKi1hirKRizpJ8jjnxGQIikPRToL2v3ZZZZZZ=='} |
 
 ______________________________________________________________________
 
diff --git a/athena.json b/athena.json
index d3c141e..5074ee1 100644
--- a/athena.json
+++ b/athena.json
@@ -127,7 +127,7 @@
             "parameters": {
                 "credentials": {
                     "description": "Assumed role credentials",
-                    "data_type": "string",
+                    "data_type": "password",
                     "primary": true,
                     "contains": [
                         "aws credentials"
@@ -273,16 +273,6 @@
                     "example_values": [
                         1
                     ]
-                },
-                {
-                    "data_path": "action_result.parameter.credentials",
-                    "data_type": "string",
-                    "example_values": [
-                        "{'AccessKeyId': 'TESTSJL6ZZZZZ3M7TEST', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'ZZZZZAmvLPictcVBPvjJx0d7MRezOuxiLCMZZZZZ', 'SessionToken': 'ZZZZZXIvYXdzEN///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SW9gO0ZRjEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTS+xeKi1hirKRizpJ8jjnxGQIikPRToL2v3ZZZZZZ=='}"
-                    ],
-                    "contains": [
-                        "aws credentials"
-                    ]
                 }
             ],
             "render": {
@@ -333,7 +323,7 @@
                 },
                 "credentials": {
                     "description": "Assumed role credentials",
-                    "data_type": "string",
+                    "data_type": "password",
                     "primary": true,
                     "contains": [
                         "aws credentials"
@@ -419,16 +409,6 @@
                     "example_values": [
                         1
                     ]
-                },
-                {
-                    "data_path": "action_result.parameter.credentials",
-                    "data_type": "string",
-                    "example_values": [
-                        "{'AccessKeyId': 'TESTSJL6ZZZZZ3M7TEST', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'ZZZZZAmvLPictcVBPvjJx0d7MRezOuxiLCMZZZZZ', 'SessionToken': 'ZZZZZXIvYXdzEN///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SW9gO0ZRjEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTS+xeKi1hirKRizpJ8jjnxGQIikPRToL2v3ZZZZZZ=='}"
-                    ],
-                    "contains": [
-                        "aws credentials"
-                    ]
                 }
             ],
             "render": {
diff --git a/athena_connector.py b/athena_connector.py
index 717f302..9fb6e70 100644
--- a/athena_connector.py
+++ b/athena_connector.py
@@ -48,6 +48,10 @@ def __init__(self):
         self._session_token = None
         self._proxy = None
 
+    @staticmethod
+    def _sanitize_action_parameters(param):
+        return {key: value for key, value in param.items() if key != "credentials"}
+
     def initialize(self):
         self._state = self.load_state()
 
@@ -178,7 +182,7 @@ def _make_boto_call(self, action_result, method, **kwargs):
         return phantom.APP_SUCCESS, resp_json
 
     def _handle_test_connectivity(self, param):
-        action_result = self.add_action_result(ActionResult(dict(param)))
+        action_result = self.add_action_result(ActionResult(self._sanitize_action_parameters(param)))
 
         if not self._create_client(action_result, param):
             return action_result.get_status()
@@ -193,7 +197,7 @@ def _handle_test_connectivity(self, param):
         return action_result.set_status(phantom.APP_SUCCESS)
 
     def _handle_list_queries(self, param):
-        action_result = self.add_action_result(ActionResult(dict(param)))
+        action_result = self.add_action_result(ActionResult(self._sanitize_action_parameters(param)))
         self.save_progress(f"In action handler for: {self.get_action_identifier()}")
 
         if not self._create_client(action_result, param):
@@ -219,7 +223,7 @@ def _handle_list_queries(self, param):
 
     def _handle_run_query(self, param):
         self.save_progress(f"In action handler for: {self.get_action_identifier()}")
-        action_result = self.add_action_result(ActionResult(dict(param)))
+        action_result = self.add_action_result(ActionResult(self._sanitize_action_parameters(param)))
 
         query = param["query"].strip()
         s3 = param["s3_location"]
diff --git a/release_notes/unreleased.md b/release_notes/unreleased.md
index fbcb2fd..5b46355 100644
--- a/release_notes/unreleased.md
+++ b/release_notes/unreleased.md
@@ -1 +1,3 @@
 **Unreleased**
+
+* Prevent action-scoped AWS credentials from being retained in action results.

From 9e3387f138ef4dfb247454f58446cc47cafc39c0 Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Sun, 2 Aug 2026 00:00:36 -0600
Subject: [PATCH 3/6] fix: document redacted credentials output

Written by Codex.
---
 README.md   |  2 ++
 athena.json | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/README.md b/README.md
index fdbbd75..158d6f8 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,7 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
 DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
 --------- | ---- | -------- | --------------
 action_result.status | string | | success failed |
+action_result.parameter.credentials | password | `aws credentials` | |
 action_result.data.\*.NamedQuery.Database | string | | sampledb |
 action_result.data.\*.NamedQuery.Description | string | | Sample query to get the top 10 airports with the most number of departures since 2000 |
 action_result.data.\*.NamedQuery.Name | string | | Flights Select Query |
@@ -127,6 +128,7 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
 DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
 --------- | ---- | -------- | --------------
 action_result.status | string | | success failed |
+action_result.parameter.credentials | password | `aws credentials` | |
 action_result.parameter.database | string | | sampledb |
 action_result.parameter.encryption | string | | SSE_S3 |
 action_result.parameter.query | string | `athena query` `athena named query` | 1234abcd-12ab-ab12-ab12-123456abcdef |
diff --git a/athena.json b/athena.json
index 5074ee1..c829bea 100644
--- a/athena.json
+++ b/athena.json
@@ -144,6 +144,13 @@
                         "failed"
                     ]
                 },
+                {
+                    "data_path": "action_result.parameter.credentials",
+                    "data_type": "password",
+                    "contains": [
+                        "aws credentials"
+                    ]
+                },
                 {
                     "data_path": "action_result.data.*.NamedQuery.Database",
                     "data_type": "string",
@@ -342,6 +349,13 @@
                         "failed"
                     ]
                 },
+                {
+                    "data_path": "action_result.parameter.credentials",
+                    "data_type": "password",
+                    "contains": [
+                        "aws credentials"
+                    ]
+                },
                 {
                     "data_path": "action_result.parameter.database",
                     "data_type": "string",

From 6ce7bfee584eab638337c5cb8888364aa5f70da3 Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Mon, 3 Aug 2026 16:43:03 -0600
Subject: [PATCH 4/6] chore: update connector quality tooling

Use dev-cicd-tools v2.2.9 so generated metadata follows the corrected secret-output handling.

Authored-by: Codex <codex@openai.com>
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 704da0b..5c5ee7a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -61,7 +61,7 @@ repos:
         exclude: "README.md"
   # Central hooks
   - repo: https://github.com/phantomcyber/dev-cicd-tools
-    rev: v2.2.8
+    rev: v2.2.9
     hooks:
       - id: build-docs
         language: python

From 1f295eb64a095392530b73358bc818fb9c53b207 Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Mon, 3 Aug 2026 16:53:56 -0600
Subject: [PATCH 5/6] fix: omit secret credential output metadata

Regenerate connector metadata with the corrected validation hook so password parameters are not advertised as action outputs.

Authored-by: Codex <codex@openai.com>
---
 README.md   |  2 --
 athena.json | 14 --------------
 2 files changed, 16 deletions(-)

diff --git a/README.md b/README.md
index 158d6f8..fdbbd75 100644
--- a/README.md
+++ b/README.md
@@ -85,7 +85,6 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
 DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
 --------- | ---- | -------- | --------------
 action_result.status | string | | success failed |
-action_result.parameter.credentials | password | `aws credentials` | |
 action_result.data.\*.NamedQuery.Database | string | | sampledb |
 action_result.data.\*.NamedQuery.Description | string | | Sample query to get the top 10 airports with the most number of departures since 2000 |
 action_result.data.\*.NamedQuery.Name | string | | Flights Select Query |
@@ -128,7 +127,6 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
 DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
 --------- | ---- | -------- | --------------
 action_result.status | string | | success failed |
-action_result.parameter.credentials | password | `aws credentials` | |
 action_result.parameter.database | string | | sampledb |
 action_result.parameter.encryption | string | | SSE_S3 |
 action_result.parameter.query | string | `athena query` `athena named query` | 1234abcd-12ab-ab12-ab12-123456abcdef |
diff --git a/athena.json b/athena.json
index c829bea..5074ee1 100644
--- a/athena.json
+++ b/athena.json
@@ -144,13 +144,6 @@
                         "failed"
                     ]
                 },
-                {
-                    "data_path": "action_result.parameter.credentials",
-                    "data_type": "password",
-                    "contains": [
-                        "aws credentials"
-                    ]
-                },
                 {
                     "data_path": "action_result.data.*.NamedQuery.Database",
                     "data_type": "string",
@@ -349,13 +342,6 @@
                         "failed"
                     ]
                 },
-                {
-                    "data_path": "action_result.parameter.credentials",
-                    "data_type": "password",
-                    "contains": [
-                        "aws credentials"
-                    ]
-                },
                 {
                     "data_path": "action_result.parameter.database",
                     "data_type": "string",

From 2e080e76dd24df1645203b211f84b3232827c482 Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Mon, 3 Aug 2026 17:29:09 -0600
Subject: [PATCH 6/6] chore: retry connector quality gates

Run the existing changes against the current shared workflow after the prior workflow identifier was retired.

Authored-by: Codex <codex@openai.com>