Conflicting AWS credential pairs in the sandbox now resolve predictably and warn about risky setups.
What's wrong with this entry?
The sandbox's forwarding of AWS credentials via credentials.awsPairs now resolves conflicts predictably and warns about risky setups. Later entries override earlier ones with the same target, each environment variable can fill only one slot, and the losing slot is disabled with a placeholder rather than silently taking the wrong value.
- Deliberately empty "suppressor" entries are preserved so they keep implicit AWS auto-pairing switched off.
- Pairs whose key id or secret are not masked as whole values are either dropped or forwarded with a warning.
- New warning when SigV4 re-signing is configured without
injectHosts, because the real secret is then in scope at every entry innetwork.allowedDomains. - New warning when a session token belonging to a forwarded pair is not itself forwarded.
SigV4 re-signing with the real secret is in scope at EVERY host in network.allowedDomains
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.221
Sandbox proxy re-signs AWS SigV4 requests made with masked credentials
Both mention credential sandbox
-
v2.1.246
Disabled settings files no longer feed rules into the sandbox
Both mention credential sandbox