def should_log_full_credential(key):
    """
    Returns true if we should log the value of the credential given the key (name) of the credential
    For robustness, prefer an allowlist over a blocklist
    """

    suffix_allowlist = [
        # generic
        '_TYPE',

        # s3
        '_REGION',
        '_ENDPOINT',
        '_V2_AUTH',

        # azureblob
        '_ACCOUNT',

        # swift
        '_USER',
        '_AUTH',
        '_TENANT',

        # google cloud storage
        '_PROJECT_NUMBER',
        '_OBJECT_ACL',
        '_BUCKET_ACL',

        # sftp
        '_HOST',
        '_PORT',
        '_USER',
        '_KEY_FILE',

        # dropbox

        # onedrive
        '_DRIVE_ID',
        '_DRIVE_TYPE',

        # webdav
        '_URL',
        '_USER',
    ]

    return any(key.endswith(suffix) for suffix in suffix_allowlist)