{"version":"2.1.257","anchor":"env-var-forwarding-for-whole-value-masked-credentials-tighte","canonical_anchor":"env-var-forwarding-for-whole-value-masked-credentials-tighte","heading":"Env var forwarding for whole-value masked credentials tightened","tier":"internal","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/env-var-forwarding-for-whole-value-masked-credentials-tighte","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### Env var forwarding for whole-value masked credentials tightened\n\nAn AWS credential pair is dropped when its env vars are not forwarded as whole-value masks, with the causes listed.\n\nSandbox credential handling now drops a `credentials.awsPairs` entry when the env vars it references aren't forwarded as whole-value mask entries. The resulting warning lists the possible causes: trust filtering, deny-override, the var never being declared, or extract\/decode use.\n\n- Area: Sandbox\n- Names: `credentials.awsPairs`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}