{"name":"awsPairs","slug":"awspairs","family":"setting","title":"Settings keys","noun":"settings key","description":"Managed limits on which AWS credentials the sandbox may use survive settings merges now.","description_source":"entry","described_by":{"version":"2.1.224","anchor":"sandbox-credential-restrictions-no-longer-lost-when-settings"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.308","builds":0,"mined_builds":149,"first_cited":{"version":"2.1.248","released_at":"2026-08-27 20:35:36","spans":1}},"aliases":[],"entries":[{"version":"2.1.290","anchor":"sandbox-config-changes-during-startup-are-re-applied-awspa","heading":"Sandbox setting changes made during startup are no longer lost","line":"Sandbox setting changes that arrive while the sandbox is starting are now applied afterwards, and `awsPairs` accepts a single entry","released_at":"2026-10-05 18:12:44","reason":"found in this entry's text"},{"version":"2.1.248","anchor":"sandbox-settings-schemas-built-at-load-time","heading":"Sandbox settings schemas built at load time","line":"Sandbox settings schemas are built at load time with identical rules and text.","released_at":"2026-08-27 20:35:36","reason":"found in this entry's text"},{"version":"2.1.224","anchor":"sandbox-credential-restrictions-no-longer-lost-when-settings","heading":"Sandbox credential restrictions no longer lost when settings are merged","line":"Managed limits on which AWS credentials the sandbox may use survive settings merges now.","released_at":"2026-08-07 01:36:32","reason":"found in this entry's text"},{"version":"2.1.224","anchor":"invalid-sandbox-credential-settings-now-fail-closed-instead-","heading":"Invalid sandbox credential settings now fail closed instead of being ignored","line":"A malformed sandbox.credentials block now denies everything instead of quietly disabling protection.","released_at":"2026-08-07 01:36:32","reason":"found in this entry's text"},{"version":"2.1.224","anchor":"sandbox-credential-masking-gains-jwt-handling-per-claim-mask","heading":"Sandbox credential masking gains JWT handling, per-claim masking and AWS SigV4 re-signing","line":"Sandbox credential masking can fake JWTs, mask single claims, and re-sign AWS requests after swapping keys.","released_at":"2026-08-07 01:36:32","reason":"named in this entry, found in this entry's text"}],"entries_total":5,"docs":[{"source":"claude-code","path":"claude-apps-gateway","title":"Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry","documented":false},{"source":"claude-code","path":"managed-settings","title":"Deploy managed settings","documented":false},{"source":"claude-code","path":"sandboxing","title":"Configure the sandboxed Bash tool","documented":false},{"source":"claude-code","path":"settings-reference","title":"All settings","documented":false}],"docs_total":4,"gates":[],"related":[],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/awspairs","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}