Remove full CloudFormation event logging

aws_organizations/attach_integration_permissions.py

@@ -251,7 +251,6 @@ def handle_create_update(event, context):
 
 
 def handler(event, context):
-    LOGGER.info("Event received: %s", json.dumps(event))
     if event['RequestType'] == 'Delete':
         handle_delete(event, context)
     else:

aws_organizations/attach_integration_permissions_test.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 import json
+from pathlib import Path
 import sys
 import unittest
 from unittest.mock import patch, Mock, MagicMock, call
@@ -22,6 +23,7 @@
     cleanup_legacy_base_policies,
     handle_create_update,
     handle_delete,
+    handler,
     POLICY_NAME_STANDARD,
     BASE_POLICY_PREFIX_INSTRUMENTATION,
     BASE_POLICY_PREFIX_RESOURCE_COLLECTION,
@@ -258,6 +260,27 @@ def test_does_not_touch_instrumentation(self):
         self.assertTrue(all("instrumentation" not in a for a in arns))
 
 
+class TestHandlerLogging(unittest.TestCase):
+    @patch("attach_integration_permissions.handle_create_update")
+    @patch("attach_integration_permissions.LOGGER")
+    def test_handler_does_not_log_cloudformation_event(self, mock_logger, mock_create_update):
+        marker = "forged\r\nlog entry"
+        event = {
+            "RequestType": "Create",
+            "ResourceProperties": {"UntrustedValue": marker},
+        }
+
+        handler(event, None)
+
+        mock_create_update.assert_called_once_with(event, None)
+        self.assertNotIn(marker, str(mock_logger.method_calls))
+
+    def test_inline_handler_does_not_log_cloudformation_event(self):
+        template = Path(__file__).with_name("main_organizations.yaml").read_text()
+
+        self.assertNotIn('LOGGER.info("Event received: %s", json.dumps(event))', template)
+
+
 class TestManageBasePermissions(unittest.TestCase):
     # ManageBasePermissions gates the standard + resource-collection policies. The role-creation
     # path sets it true (manage everything); the post-setup add-on sets it false so it manages only

aws_organizations/main_organizations.yaml

@@ -690,7 +690,6 @@ Resources:
 
 
           def handler(event, context):
-              LOGGER.info("Event received: %s", json.dumps(event))
               if event['RequestType'] == 'Delete':
                   handle_delete(event, context)
               else: