Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.221 Home All releases ←olderv2.1.220 v2.1.222newer→
Claude Code v2.1.221

Sandbox proxy re-signs AWS SigV4 requests made with masked credentials

Use it now
Useful4 Signal0
Sandbox Notable not in their notes

AWS calls from inside the sandbox now work with masked credentials, since the proxy re-signs them for you.

credentials.sigv4
What

When AWS credentials are masked inside the sandbox, the MITM proxy now recognises SigV4 requests, resolves the sentinel access key to the real key pair, and re-signs the request before forwarding it.

Details
  • New AWS key-pair registry (getAwsPairRegistry) populated from the configured environment variables.
  • The TLS-terminating proxy receives planSigv4 and maxSigv4ResignBodyBytes, so re-signing is bounded by a body-size limit.
  • Streaming, presigned and sigv4a variants cannot be re-signed and default to deny; setting credentials.sigv4.<kind> to "passthrough" is the escape hatch.
  • A request using a masked credential with no x-amz-date header cannot be re-signed and is refused with an explicit message.
  • A warning fires if only one of the access-key/secret pair is masked.
  • Active only when sandbox credentials config is present. Sandbox exec also forwards gitSafeDirectories.
Evidence

maxSigv4ResignBodyBytes, AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it.

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.221 →