diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 79b7fac..92e3daf 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -2,13 +2,15 @@
 Changelog
 *********
 
-1.1.2 -- 2019-09-??
+1.1.2 -- 2019-10-??
 ===================
 
 Bugfixes
 --------
 * Fix :class:`AwsKmsCryptographicMaterialsProvider` regional clients override bug
   `#124 <https://github.com/aws/aws-dynamodb-encryption-python/issues/124>`_
+* Remove ``attributes`` attribute from :class:`EncryptionContext` ``str`` and ``repr`` values.
+  `#127 <https://github.com/aws/aws-dynamodb-encryption-python/issues/127>`_
 
 1.1.1 -- 2019-08-29
 ===================
diff --git a/examples/src/aws_kms_encrypted_item.py b/examples/src/aws_kms_encrypted_item.py
index 8527d3f..665d673 100644
--- a/examples/src/aws_kms_encrypted_item.py
+++ b/examples/src/aws_kms_encrypted_item.py
@@ -41,7 +41,7 @@ def encrypt_item(table_name, aws_cmk_id):
     plaintext_item.update(index_key)
 
     # Create a normal table resource.
-    table = boto3.resource("dynamodb").Table(table_name)
+    table = boto3.resource("dynamodb").Table(table_name)  # generated code confuse pylint: disable=no-member
 
     # Use the TableInfo helper to collect information about the indexes.
     table_info = TableInfo(name=table_name)
diff --git a/examples/src/aws_kms_encrypted_resource.py b/examples/src/aws_kms_encrypted_resource.py
index f57478a..dabcf31 100644
--- a/examples/src/aws_kms_encrypted_resource.py
+++ b/examples/src/aws_kms_encrypted_resource.py
@@ -64,7 +64,9 @@ def encrypt_batch_items(table_name, aws_cmk_id):
     )
 
     # Get the encrypted item using the standard service resource.
-    encrypted_items = resource.batch_get_item(RequestItems={table_name: {"Keys": index_keys}})["Responses"][table_name]
+    encrypted_items = resource.batch_get_item(  # generated code confuse pylint: disable=no-member
+        RequestItems={table_name: {"Keys": index_keys}}
+    )["Responses"][table_name]
 
     # Get the item using the encrypted service resource, transparently decyrpting it.
     decrypted_items = encrypted_resource.batch_get_item(RequestItems={table_name: {"Keys": index_keys}})["Responses"][
diff --git a/examples/src/aws_kms_encrypted_table.py b/examples/src/aws_kms_encrypted_table.py
index f781f64..54f4823 100644
--- a/examples/src/aws_kms_encrypted_table.py
+++ b/examples/src/aws_kms_encrypted_table.py
@@ -39,7 +39,7 @@ def encrypt_item(table_name, aws_cmk_id):
     plaintext_item.update(index_key)
 
     # Create a normal table resource.
-    table = boto3.resource("dynamodb").Table(table_name)
+    table = boto3.resource("dynamodb").Table(table_name)  # generated code confuse pylint: disable=no-member
     # Create a crypto materials provider using the specified AWS KMS key.
     aws_kms_cmp = AwsKmsCryptographicMaterialsProvider(key_id=aws_cmk_id)
     # Create attribute actions that tells the encrypted table to encrypt all attributes except one.
diff --git a/examples/src/most_recent_provider_encrypted_table.py b/examples/src/most_recent_provider_encrypted_table.py
index cbb6656..972251f 100644
--- a/examples/src/most_recent_provider_encrypted_table.py
+++ b/examples/src/most_recent_provider_encrypted_table.py
@@ -41,7 +41,7 @@ def encrypt_item(table_name, aws_cmk_id, meta_table_name, material_name):
     plaintext_item.update(index_key)
 
     # Create a normal table resource for the meta store.
-    meta_table = boto3.resource("dynamodb").Table(meta_table_name)
+    meta_table = boto3.resource("dynamodb").Table(meta_table_name)  # generated code confuse pylint: disable=no-member
     # Create a crypto materials provider for the meta store using the specified AWS KMS key.
     aws_kms_cmp = AwsKmsCryptographicMaterialsProvider(key_id=aws_cmk_id)
     # Create a meta store using the AWS KMS crypto materials provider.
@@ -53,7 +53,7 @@ def encrypt_item(table_name, aws_cmk_id, meta_table_name, material_name):
         version_ttl=600.0,  # Check for a new material version every five minutes.
     )
     # Create a normal table resource.
-    table = boto3.resource("dynamodb").Table(table_name)
+    table = boto3.resource("dynamodb").Table(table_name)  # generated code confuse pylint: disable=no-member
     # Create attribute actions that tells the encrypted table to encrypt all attributes except one.
     actions = AttributeActions(
         default_action=CryptoAction.ENCRYPT_AND_SIGN, attribute_actions={"leave me": CryptoAction.DO_NOTHING}
diff --git a/examples/src/wrapped_rsa_encrypted_table.py b/examples/src/wrapped_rsa_encrypted_table.py
index d6eed86..d26e21b 100644
--- a/examples/src/wrapped_rsa_encrypted_table.py
+++ b/examples/src/wrapped_rsa_encrypted_table.py
@@ -40,7 +40,7 @@ def encrypt_item(table_name, rsa_wrapping_private_key_bytes, rsa_signing_private
     plaintext_item.update(index_key)
 
     # Create a normal table resource.
-    table = boto3.resource("dynamodb").Table(table_name)
+    table = boto3.resource("dynamodb").Table(table_name)  # generated code confuse pylint: disable=no-member
     # Create a crypto materials provider using the provided wrapping and signing keys.
     # We show private keys used here, but public keys could be used as well, allowing
     # only wrapping or signature verification.
diff --git a/examples/src/wrapped_symmetric_encrypted_table.py b/examples/src/wrapped_symmetric_encrypted_table.py
index 22a6508..0db58c4 100644
--- a/examples/src/wrapped_symmetric_encrypted_table.py
+++ b/examples/src/wrapped_symmetric_encrypted_table.py
@@ -40,7 +40,7 @@ def encrypt_item(table_name, aes_wrapping_key_bytes, hmac_signing_key_bytes):
     plaintext_item.update(index_key)
 
     # Create a normal table resource.
-    table = boto3.resource("dynamodb").Table(table_name)
+    table = boto3.resource("dynamodb").Table(table_name)  # generated code confuse pylint: disable=no-member
     # Create a crypto materials provider using the provided wrapping and signing keys.
     wrapping_key = JceNameLocalDelegatedKey(
         key=aes_wrapping_key_bytes,
diff --git a/src/dynamodb_encryption_sdk/structures.py b/src/dynamodb_encryption_sdk/structures.py
index 48e82cb..0dd3546 100644
--- a/src/dynamodb_encryption_sdk/structures.py
+++ b/src/dynamodb_encryption_sdk/structures.py
@@ -68,6 +68,7 @@ class EncryptionContext(object):
         validator=attr.validators.optional(attr.validators.instance_of(six.string_types)), default=None
     )
     attributes = attr.ib(
+        repr=False,
         validator=(dictionary_validator(six.string_types, dict), _validate_attribute_values_are_ddb_items),
         default=attr.Factory(dict),
     )

Add repr=False to attributes in EncryptionContext
https://github.com/aws/aws-dynamodb-encryption-python/blob/master/src/dynamodb_encryption_sdk/structures.py#L49-L78

We should add `repr=False` to the attributes section in the `EncryptionContext`, to make the string representation safe within material providers. This is useful particularly in the context of logging.

Similar to https://github.com/aws/aws-dynamodb-encryption-java/issues/100
diff --git a/test/unit/test_structures.py b/test/unit/test_structures.py
new file mode 100644
index 0000000..6bae7da
--- /dev/null
+++ b/test/unit/test_structures.py
@@ -0,0 +1,26 @@
+# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"). You
+# may not use this file except in compliance with the License. A copy of
+# the License is located at
+#
+# http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+# ANY KIND, either express or implied. See the License for the specific
+# language governing permissions and limitations under the License.
+"""Unit tests for ``dynamodb_encryption_sdk.structures``."""
+import pytest
+
+from dynamodb_encryption_sdk.structures import EncryptionContext
+
+
+@pytest.mark.parametrize("operator", (repr, str))
+def test_encryption_context_repr(operator):
+    value = EncryptionContext(attributes={"unique_name": {"S": "unique_value"}})
+
+    test = operator(value)
+
+    assert "unique_name" not in test
+    assert "unique_value" not in test

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest
apt-get update apt-get install -y gcc
3.7
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs==24.2.0
boto3==1.33.13
botocore==1.33.13
certifi @ file:///croot/certifi_1671487769961/work/certifi
cffi==1.15.1
cryptography==44.0.2
-e git+https://github.com/aws/aws-dynamodb-encryption-python.git@9d99241b04a56aa7eb5e0dcb9c3f7e52e09f2f74#egg=dynamodb_encryption_sdk
exceptiongroup==1.2.2
importlib-metadata==6.7.0
iniconfig==2.0.0
jmespath==1.0.1
packaging==24.0
pluggy==1.2.0
pycparser==2.21
pytest==7.4.4
python-dateutil==2.9.0.post0
s3transfer==0.8.2
six==1.17.0
tomli==2.0.1
typing_extensions==4.7.1
urllib3==1.26.20
zipp==3.15.0

name: aws-dynamodb-encryption-python
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=22.3.1=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - attrs==24.2.0
      - boto3==1.33.13
      - botocore==1.33.13
      - cffi==1.15.1
      - cryptography==44.0.2
      - exceptiongroup==1.2.2
      - importlib-metadata==6.7.0
      - iniconfig==2.0.0
      - jmespath==1.0.1
      - packaging==24.0
      - pluggy==1.2.0
      - pycparser==2.21
      - pytest==7.4.4
      - python-dateutil==2.9.0.post0
      - s3transfer==0.8.2
      - six==1.17.0
      - tomli==2.0.1
      - typing-extensions==4.7.1
      - urllib3==1.26.20
      - zipp==3.15.0
prefix: /opt/conda/envs/aws-dynamodb-encryption-python

test/unit/test_structures.py::test_encryption_context_repr[repr] test/unit/test_structures.py::test_encryption_context_repr[str]
examples/src/wrapped_symmetric_encrypted_table.py examples/src/aws_kms_encrypted_table.py examples/src/aws_kms_encrypted_resource.py CHANGELOG.rst examples/src/aws_kms_encrypted_item.py src/dynamodb_encryption_sdk/structures.py examples/src/most_recent_provider_encrypted_table.py examples/src/wrapped_rsa_encrypted_table.py
examples/src/wrapped_symmetric_encrypted_table.py examples/src/aws_kms_encrypted_table.py examples/src/aws_kms_encrypted_resource.py CHANGELOG.rst examples/src/aws_kms_encrypted_item.py src/dynamodb_encryption_sdk/structures.py examples/src/most_recent_provider_encrypted_table.py examples/src/wrapped_rsa_encrypted_table.py