{"name":"credentials.awsPairs","slug":"credentials-awspairs","family":"setting","title":"Settings keys","noun":"settings key","description":"Conflicting AWS credential pairs in the sandbox now resolve predictably and warn about risky setups.","description_source":"entry","described_by":{"version":"2.1.224","anchor":"sandbox-aws-credential-pairs-get-precedence-rules-and-scope-"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.309","builds":0,"mined_builds":150,"first_cited":{"version":"2.1.257","released_at":"2026-09-01 17:15:33","spans":2}},"aliases":[],"entries":[{"version":"2.1.271","anchor":"sandbox-aws-credential-pair-collision-logging-no-functional","heading":"Sandbox AWS credential-pair collision logging: no functional change found","line":"Sandbox AWS credential-collision handling was renamed internally with no functional change found","released_at":"2026-09-14 19:45:19","reason":"found in this entry's text"},{"version":"2.1.257","anchor":"env-var-forwarding-for-whole-value-masked-credentials-tighte","heading":"Env var forwarding for whole-value masked credentials tightened","line":"An AWS credential pair is dropped when its env vars are not forwarded as whole-value masks, with the causes listed.","released_at":"2026-09-01 17:15:33","reason":"found in this entry's text, named in this entry"},{"version":"2.1.224","anchor":"sandbox-aws-credential-pairs-get-precedence-rules-and-scope-","heading":"Sandbox AWS credential pairs get precedence rules and scope warnings","line":"Conflicting AWS credential pairs in the sandbox now resolve predictably and warn about risky setups.","released_at":"2026-08-07 01:36:32","reason":"named in this entry, found in this entry's text"}],"entries_total":3,"docs":[{"source":"claude-code","path":"managed-settings","title":"Deploy managed settings","documented":false},{"source":"claude-code","path":"sandboxing","title":"Configure the sandboxed Bash tool","documented":false},{"source":"claude-code","path":"settings-reference","title":"All settings","documented":false}],"docs_total":3,"gates":[],"related":[{"name":"credentials.envVars","slug":"credentials-envvars","description":"Sandbox credential masking adds JWT decoding, per-claim masking, and scrubbing of duplicate secret values"},{"name":"credentials.files","slug":"credentials-files","description":"Settings docs now explain that masked credential files survive a relaxed sandbox filesystem policy while denied ones do not."},{"name":"credentials.sigv4","slug":"credentials-sigv4","description":"AWS calls from inside the sandbox now work with masked credentials, since the proxy re-signs them for you."}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/credentials-awspairs","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}