Update codeartifact login error message

.changes/next-release/enhancement-codeartifact-32392.json

@@ -0,0 +1,5 @@
+{
+  "type": "enhancement",
+  "category": "``codeartifact``",
+  "description": "Update login command error message."
+}

awscli/customizations/codeartifact/login.py

@@ -38,8 +38,8 @@ def get_relative_expiration_time(remaining):
 
 
 class CommandFailedError(Exception):
-    def __init__(self, called_process_error):
-        msg = str(called_process_error)
+    def __init__(self, called_process_error, auth_token):
+        msg = str(called_process_error).replace(auth_token, '******')
         if called_process_error.stderr is not None:
             msg +=(
                 f' Stderr from command:\n'
@@ -105,7 +105,7 @@ def _run_command(self, tool, command, *, ignore_errors=False):
             )
         except subprocess.CalledProcessError as ex:
             if not ignore_errors:
-                raise CommandFailedError(ex)
+                raise CommandFailedError(ex, self.auth_token)
         except OSError as ex:
             if ex.errno == errno.ENOENT:
                 raise ValueError(
@@ -305,7 +305,7 @@ def login(self, dry_run=False):
             )
         except subprocess.CalledProcessError as e:
             uni_print('Failed to update the NuGet.Config\n')
-            raise CommandFailedError(e)
+            raise CommandFailedError(e, self.auth_token)
 
         uni_print(source_configured_message % source_name)
         self._write_success_message('nuget')
@@ -725,7 +725,8 @@ class CodeArtifactLogin(BasicCommand):
             'action': 'store_true',
             'help_text': 'Only print the commands that would be executed '
                          'to connect your tool with your repository without '
-                         'making any changes to your configuration',
+                         'making any changes to your configuration. Note that '
+                         'this prints the unredacted auth token as part of the output',
             'required': False,
             'default': False
         },

tests/functional/codeartifact/test_codeartifact_login.py

@@ -3,6 +3,7 @@
 import platform
 import subprocess
 import time
+import re
 
 from botocore.utils import parse_timestamp
 
@@ -962,6 +963,24 @@ def test_pip_login_with_namespace_dry_run(self):
             'Argument --namespace is not supported for pip', result.stderr
         )
 
+    def test_pip_login_command_failed_auth_token_redacted(self):
+        def side_effect(command, capture_output, check):
+            raise subprocess.CalledProcessError(
+                returncode=1,
+                cmd=command
+            )
+
+        self.subprocess_mock.side_effect = side_effect
+        cmdline = self._setup_cmd(tool='pip')
+        result = self.cli_runner.run(cmdline)
+        self.assertEqual(result.rc, 255)
+        self.assertIn(
+            "Command '['pip', 'config', 'set', 'global.index-url',"
+            " 'https://aws:******@domain-domain-owner.codeartifact.aws.a2z.com/pypi/repository/simple/']'"
+            " returned non-zero exit status 1.",
+            result.stderr
+        )
+
     def test_twine_login_without_domain_owner(self):
         cmdline = self._setup_cmd(tool='twine')
         result = self.cli_runner.run(cmdline)

tests/unit/customizations/codeartifact/test_adapter_login.py

@@ -68,6 +68,21 @@ def test_run_commands_command_failed(self):
         ):
             self.test_subject._run_commands('tool', ['cmd'])
 
+    def test_run_commands_command_failed_redact_auth_token(self):
+        error_to_be_caught = subprocess.CalledProcessError(
+            returncode=1,
+            cmd=['cmd', 'with', 'auth-token', 'present'],
+            output=None,
+            stderr=b'Command error message.'
+        )
+        self.subprocess_utils.run.side_effect = error_to_be_caught
+        with self.assertRaisesRegex(
+                CommandFailedError,
+                (rf"(?=.*cmd)(?=.*with)(?!.*auth-token)(?=.*present)"
+                 rf"(?=.*Stderr from command:\nCommand error message.)")
+        ):
+            self.test_subject._run_commands('tool', ['cmd'])
+
     def test_run_commands_nonexistent_command(self):
         self.subprocess_utils.run.side_effect = OSError(
             errno.ENOENT, 'not found error'