The whole hunk
from line 6, old and new numbered
/
lines
from line 6
66
77In **Settings > Credentials**, choose **AWS**, **Google Cloud**, or **Microsoft Azure**, then Connect. Provide the credential (access key, service-account JSON, HMAC key, service principal, or connection string) and list the bucket names (AWS, GCP) or **Blob containers** (Azure) this credential covers. S3-compatible stores use the AWS form with the **S3-compatible endpoint** field; you'll need to allowlist that endpoint host separately.
88
9Listing a bucket adds its address to the sandbox network allowlist so code can reach it without a per-call card. Access within the bucket is still limited to the credential's permissions. Credentials are encrypted on your computer and sent only to the provider they belong to.
9Listing a bucket adds its address to the sandbox network allowlist so code can reach it without a network permission card. Access within the bucket is still limited to the credential's permissions. Credentials are encrypted on your computer and sent only to the provider they belong to.
1010
1111Claude reads and writes objects with ordinary code using the provider's Python library (`boto3`, Azure SDK). **Settings > Storage** lists connected credentials and lets you browse and import objects (up to 100 GB) or export artifacts.
1212
from line 15
1515</Note>
1616
1717<Warning>
18 Any code Claude writes can use credentials you add here. If a bucket should never be reachable from an analysis session, don't add its credential.
18 Code that Claude writes can use a credential you add here only after you approve a **Credentials** card that names it. By default the approval lasts for the conversation. If a bucket should never be reachable from an analysis session, don't add its credential.
1919</Warning>
2020