def should_log_partial_credential(key):
    """
    Returns true if we should log the last 4 characters the value of the credential
    given the key (name) of the credential.
    For robustness, prefer an allowlist over a blocklist
    """

    suffix_allowlist = [
        # s3
        '_ACCESS_KEY_ID',

        # google cloud storage
        '_CLIENT_ID',
    ]

    return any(key.endswith(suffix) for suffix in suffix_allowlist)