disable AWS GO SDK logging

pkg/plugins/vals.go

@@ -2,6 +2,7 @@ package plugins
 
 import (
 	"io"
+	"os"
 	"sync"
 
 	"github.com/helmfile/vals"
@@ -18,6 +19,12 @@ var once sync.Once
 func ValsInstance() (*vals.Runtime, error) {
 	var err error
 	once.Do(func() {
+		// vals' AWS helper enables SDK request logging by default unless AWS_SDK_GO_LOG_LEVEL is set.
+		// Force it off unless the user explicitly opted in to avoid leaking sensitive headers.
+		if _, exists := os.LookupEnv("AWS_SDK_GO_LOG_LEVEL"); !exists {
+			_ = os.Setenv("AWS_SDK_GO_LOG_LEVEL", "off")
+		}
+
 		// Set LogOutput to io.Discard to suppress debug logs from AWS SDK and other providers
 		// This prevents sensitive information (tokens, auth headers) from being logged to stdout
 		// See issue #2270