Sandbox credential handling now drops a credentials.awsPairs entry when the env vars it references aren't forwarded as whole-value mask entries. The resulting warning lists the possible causes: trust filtering, deny-override, the var never being declared, or extract/decode use.
Names in the bundlecredentials.awsPairs
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up credentials.awsPairs, on All settings.
| Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent…settings-reference see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up credentials.awsPairs, on All settings.