{"version":"2.1.224","anchor":"sandbox-aws-credential-pairs-get-precedence-rules-and-scope-","canonical_anchor":"sandbox-aws-credential-pairs-get-precedence-rules-and-scope-","heading":"Sandbox AWS credential pairs get precedence rules and scope warnings","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/sandbox-aws-credential-pairs-get-precedence-rules-and-scope-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Sandbox AWS credential pairs get precedence rules and scope warnings\n\nConflicting AWS credential pairs in the sandbox now resolve predictably and warn about risky setups.\n\n**What**\n\nThe sandbox's forwarding of AWS credentials via `credentials.awsPairs` now resolves conflicts predictably and warns about risky setups. Later entries override earlier ones with the same target, each environment variable can fill only one slot, and the losing slot is disabled with a placeholder rather than silently taking the wrong value.\n\n**Details**\n\n- Deliberately empty \"suppressor\" entries are preserved so they keep implicit AWS auto-pairing switched off.\n- Pairs whose key id or secret are not masked as whole values are either dropped or forwarded with a warning.\n- New warning when SigV4 re-signing is configured without `injectHosts`, because the real secret is then in scope at every entry in `network.allowedDomains`.\n- New warning when a session token belonging to a forwarded pair is not itself forwarded.\n\n**Evidence**\n\n`SigV4 re-signing with the real secret is in scope at EVERY host in network.allowedDomains`\n\n- Area: Sandbox\n- Names: `credentials.awsPairs`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}