anchor.diff:  
   When the agent invokes your build scripts it passes in a set of standard Buildkite environment variables, along with any that you've defined in your build configuration. You can use these environment variables in your [build steps](/docs/pipelines/defining-steps) and [agent hooks](/docs/agent/v3/hooks).
   
  +For best practices and recommendations about using secrets in your environment variables, see the [Secrets](/docs/pipelines/secrets) documentation.
  +
   <%= toc %>
   
   ## Buildkite environment variables
  
positive.code: 
  You can define environment variables in your jobs in a few ways, depending on the nature of the value being set:
  
  * Pipeline settings — for values that are not secret.
  * [Build pipeline configuration](/docs/pipelines/command-step) — for values that are not secret.
  * An `environment` or `pre-command` [agent hook](/docs/agent/v3/hooks) — for values that are secret or agent-specific.
  
  ## Environment variable precedence
  
  
negative.code: 
  <h3 class="h3-caps">BUILDKITE_S3_SECRET_ACCESS_KEY</h3>
  
  The secret access key for your S3 IAM user, for use with [private S3 buckets](/docs/agent/v3/cli-artifact#using-your-own-private-aws-s3-bucket). The variable is read by the `buildkite-agent artifact upload` command, as well as during the artifact upload phase of [command steps](/docs/pipelines/command-step#command-step-attributes). The value can only be set by exporting the environment variable in the `environment`, `pre-checkout` or `pre-command` hooks. Do not print or export this variable anywhere except your agent hooks. 
  
  Example: `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"`
  
  