chore: PR improvements

Author: zeljkoX

src/queues/sqs/backend.rs

@@ -451,7 +451,7 @@ impl SqsBackend {
                 queue_url = %queue_url,
                 "Failed to send message to SQS"
             );
-            QueueBackendError::SqsError(format!("SendMessage failed: {}", DisplayErrorContext(&e)))
+            QueueBackendError::SqsError(format!("SendMessage failed: {}", classify_sdk_error(&e)))
         })?;
 
         let message_id = response
@@ -507,7 +507,12 @@ impl SqsBackend {
         match sqs_client.get_queue_url().queue_name(dlq_name).send().await {
             Ok(output) => output.queue_url().map(str::to_string),
             Err(err) => {
-                warn!(error = %err, dlq_name = %dlq_name, "Failed to resolve DLQ URL at startup");
+                warn!(
+                    error.kind = classify_sdk_error(&err),
+                    error.detail = %DisplayErrorContext(&err),
+                    dlq_name = %dlq_name,
+                    "Failed to resolve DLQ URL at startup"
+                );
                 None
             }
         }
@@ -538,7 +543,12 @@ impl SqsBackend {
                 .and_then(|value| value.parse::<u64>().ok())
                 .unwrap_or(0),
             Err(err) => {
-                warn!(error = %err, dlq_url = %dlq_url, "Failed to fetch DLQ depth");
+                warn!(
+                    error.kind = classify_sdk_error(&err),
+                    error.detail = %DisplayErrorContext(&err),
+                    dlq_url = %dlq_url,
+                    "Failed to fetch DLQ depth"
+                );
                 0
             }
         }

src/services/aws_kms/mod.rs

@@ -289,7 +289,7 @@ impl AwsKmsK256 for AwsKmsClient {
                 );
                 AwsKmsError::GetError(format!(
                     "Failed to get secp256k1 public key for key '{key_id}': {}",
-                    DisplayErrorContext(&e)
+                    classify_sdk_error(&e)
                 ))
             })?;
 
@@ -332,7 +332,10 @@ impl AwsKmsK256 for AwsKmsClient {
                     operation = "sign_digest_secp256k1",
                     "AWS KMS sign failed"
                 );
-                AwsKmsError::PermissionError(DisplayErrorContext(&e).to_string())
+                AwsKmsError::SignError(format!(
+                    "Failed to sign secp256k1 digest for key '{key_id}': {}",
+                    classify_sdk_error(&e)
+                ))
             })?
             .signature
             .ok_or(AwsKmsError::SignError(
@@ -373,7 +376,7 @@ impl AwsKmsEd25519 for AwsKmsClient {
                 );
                 AwsKmsError::GetError(format!(
                     "Failed to get Ed25519 public key for key '{key_id}': {}",
-                    DisplayErrorContext(&e)
+                    classify_sdk_error(&e)
                 ))
             })?;
 
@@ -419,7 +422,10 @@ impl AwsKmsEd25519 for AwsKmsClient {
                     operation = "sign_ed25519",
                     "AWS KMS sign failed"
                 );
-                AwsKmsError::SignError(DisplayErrorContext(&e).to_string())
+                AwsKmsError::SignError(format!(
+                    "Failed to sign Ed25519 message for key '{key_id}': {}",
+                    classify_sdk_error(&e)
+                ))
             })?
             .signature
             .ok_or(AwsKmsError::SignError(

src/utils/aws_error.rs

@@ -17,6 +17,15 @@
 //!   (e.g., `connect timed out`, `dns error: failed to lookup address`)
 //!   appears in the log instead of just the top-level wrapper.
 //!
+//! # Caution: log-only — do not embed in returned error values
+//!
+//! `DisplayErrorContext` walks the underlying SDK chain and can surface
+//! internal infrastructure details (endpoint URLs, connector kinds,
+//! credential-provider failures). Keep it confined to `tracing` fields
+//! and metrics. For error values returned to upstream callers — which
+//! ultimately reach API clients via `ApiError::InternalError(err.to_string())` —
+//! prefer the stable kind tag from [`classify_sdk_error`].
+//!
 //! Typical usage:
 //!
 //! ```ignore
@@ -25,6 +34,8 @@
 //!     error.detail = %DisplayErrorContext(&err),
 //!     "AWS call failed"
 //! );
+//! // Returned error value carries only the kind tag, not the full chain:
+//! return Err(MyError::Wrapped(format!("op X failed: {}", classify_sdk_error(&err))));
 //! ```
 
 pub use aws_smithy_types::error::display::DisplayErrorContext;