Description of problem:

When log forwarding to cloudWatch using different AWS Role, all logs arrives to the first AWS role defined as it's taking the value from ENV variable and it only exists one.

ClusterLogForwarder definition:

 spec:
  inputs:
  - application:
      namespaces:
      - logforwarder1
    name: namespace1
  - application:
      namespaces:
      - logforwarder2
    name: namespace2
  outputs:
  - cloudwatch:
      groupPrefix: /path/logforwarder1
      region: us-east-1
    name: cloudwatch-namespace1
    secret:
      name: cw-sts-credentials1
    type: cloudwatch
  - cloudwatch:
      groupPrefix: /path/logforwarder2
      region: us-east-1
    name: cloudwatch-namespace2
    secret:
      name: cw-sts-credentials2
    type: cloudwatch
  pipelines:
  - inputRefs:
    - namespace1
    name: namespace1-logs-to-cloudwatch
    outputRefs:
    - cloudwatch-namespace1
    parse: json
  - inputRefs:
    - namespace2
    name: namespace2-logs-to-cloudwatch
    outputRefs:
    - cloudwatch-namespace2
    parse: json

Environment variable in the collector pods is only one, the one matching the first secret. And this variable is used for both outputs defined. Then, all the logs are sent to the same AWS Role

$ oc rsh <vector pod>
$ env |grep -i AWS
AWS_REGION=xxxxx
AWS_ROLE_ARN=xxxxx
AWS_ROLE_SESSION_NAME=xxxxx

Version-Release number of selected component (if applicable):

Logging 5.8 and 5.9 latest versions

How reproducible:

Always

Steps to Reproduce:

1. Create a clusterlogforwarder as visible in the "Description of Problem" where the AWS role in `cw-sts-credentials1` is different to the set in `cw-sts-credentials2`

Actual results:

Logs from the namespace1 and namespace2 are all of them set to the AWS role defined in the first secret as the variable used by Vector is taken from Environment pod variables:

$ oc rsh <vector pod> 
$ env |grep -i AWS
AWS_REGION=xxxxx
AWS_ROLE_ARN=xxxxx
AWS_ROLE_SESSION_NAME=xxxxx

Expected results:

Expected to log forwarder the logs from:

 - namespace1 to the output `cloudwatch-namespace1` using the AWS role set in `cw-sts-credentials1`

 - namespace2 to the output `cloudwatch-namespace2` using the AWS role set in `cw-sts-credentials2`

Additional info: