# Replace Static Cloud Credentials with Placeholders

## Analysis

PR 3554 currently materializes cloud access credentials in the tracked shared
E2E configuration. Runtime dependency code already accepts the generated S3
AK/SK and Azure Blob SAS through environment variables, but the synchronizer
can write the Terraform values back into Git. Legacy import sample data also
contains separate credentials and is outside this change.

| Credential | Tracked placeholder | Runtime source |
|---|---|---|
| Generated S3 access key | `${S3_ACCESS_KEY}` | `E2E_S3_AK` → `S3_ACCESS_KEY` |
| Generated S3 secret key | `${S3_SECRET_KEY}` | `E2E_S3_SK` → `S3_SECRET_KEY` |
| Generated Azure Blob SAS | `${AZURE_SAS_TOKEN}` | `E2E_AZURE_SAS_TOKEN` → `AZURE_SAS_TOKEN` |

Database and test-service credentials are outside this change.

## Execution Steps

1. Replace the generated date-integration static cloud credential values with
   explicit environment placeholders.
2. Redact generated S3 and Azure credentials inside the Terraform
   synchronization tool before rendering YAML.
3. Use the existing S3 and Azure SAS GitHub secrets in both E2E workflows.
4. Add focused synchronizer and configuration tests, update framework
   documentation, and run the relevant Go tests plus semantic credential
   scans.

## Risks

- Local ignored configurations that contain explicit credentials remain
  supported, but the generated date-integration credentials come from the
  workflow or invoking shell environment.
- Terraform state still contains the generated disposable credentials; this
  change only removes them from tracked E2E configuration.