diff --git a/docs/input.md b/docs/input.md
index cb9371c..534efc5 100644
--- a/docs/input.md
+++ b/docs/input.md
@@ -76,7 +76,7 @@ Check AWS key on start. Default is true.
 
 ## proxy_uri
 
-URI of proxy environment.
+URI of proxy environment. The value is masked in the configuration dump, so credentials embedded in the URI are not written to the log.
 
 ## \<sqs\> section
 
diff --git a/docs/output.md b/docs/output.md
index ac01eda..0f8032f 100644
--- a/docs/output.md
+++ b/docs/output.md
@@ -312,7 +312,7 @@ Check AWS key on start. Default is true.
 
 ## proxy_uri
 
-uri of proxy environment.
+uri of proxy environment. The value is masked in the configuration dump, so credentials embedded in the URI are not written to the log.
 
 ## path
 
diff --git a/lib/fluent/plugin/in_s3.rb b/lib/fluent/plugin/in_s3.rb
index b27da68..459afaa 100644
--- a/lib/fluent/plugin/in_s3.rb
+++ b/lib/fluent/plugin/in_s3.rb
@@ -109,7 +109,7 @@ def initialize
     desc "Check AWS key on start"
     config_param :check_apikey_on_start, :bool, default: true
     desc "URI of proxy environment"
-    config_param :proxy_uri, :string, default: nil
+    config_param :proxy_uri, :string, default: nil, secret: true
     desc "Optional RegEx to match incoming messages"
     config_param :match_regexp, :regexp, default: nil
 
diff --git a/lib/fluent/plugin/out_s3.rb b/lib/fluent/plugin/out_s3.rb
index 35e332b..c6c1a51 100644
--- a/lib/fluent/plugin/out_s3.rb
+++ b/lib/fluent/plugin/out_s3.rb
@@ -121,7 +121,7 @@ def initialize
     desc "Check AWS key on start"
     config_param :check_apikey_on_start, :bool, default: true
     desc "URI of proxy environment"
-    config_param :proxy_uri, :string, default: nil
+    config_param :proxy_uri, :string, default: nil, secret: true
     desc "Use S3 reduced redundancy storage for 33% cheaper pricing. Deprecated. Use storage_class instead"
     config_param :reduced_redundancy, :bool, default: false, deprecated: "Use storage_class parameter instead."
     desc "The type of storage to use for the object(STANDARD,REDUCED_REDUNDANCY,STANDARD_IA)"