Cloudwatch: prefer webIdentity over EC2 role (#23452)

pkg/components/imguploader/s3uploader.go

@@ -58,8 +58,8 @@ func (u *S3Uploader) Upload(ctx context.Context, imageDiskPath string) (string,
 				SecretAccessKey: u.secretKey,
 			}},
 			&credentials.EnvProvider{},
-			remoteCredProvider(sess),
 			webIdentityProvider(sess),
+			remoteCredProvider(sess),
 		})
 	cfg := &aws.Config{
 		Region:           aws.String(u.region),

pkg/tsdb/cloudwatch/credentials.go

@@ -106,8 +106,8 @@ func GetCredentials(dsInfo *DatasourceInfo) (*credentials.Credentials, error) {
 				SecretAccessKey: dsInfo.SecretKey,
 			}},
 			&credentials.SharedCredentialsProvider{Filename: "", Profile: dsInfo.Profile},
-			remoteCredProvider(sess),
 			webIdentityProvider(sess),
+			remoteCredProvider(sess),
 		})
 
 	credentialCacheLock.Lock()