sigv4a – requests using asymmetric SigV4A signatures
Each of these now defaults to "deny" (the request fails closed with a 403 error) unless explicitly set to "passthrough". This replaces old vendor code that previously implemented an unrelated JSON-schema $recursiveAnchor keyword at this same location.
Why
These request types can't be safely re-signed by the masking proxy, so letting them through by default would risk exposing real credentials. Defaulting to deny closes that gap while still allowing an explicit opt-in via passthrough where it's known to be safe.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up sigv4, on Troubleshoot federated cloud access.* **A hostname with no usable region.** Agent Proxy reads the AWS service and signing region from the hostname, so the region must be the last label before `amazonaws.com`, as in `service.region.amazonaws.com`, `my-bucket.s3.us-east-1.amaz…claude-tag/admins/federated-access/troubleshootingsee the edit
Confirmed sinceAnthropic's documentation has since written up streaming, on Error reference.| `Streaming response ended before any complete data was received` | [Network](#streaming-response-ended-before-any-complete-data-was-received) |errorssee the edit
Confirmed sinceAnthropic's documentation has since written up awsPairs, on All settings.| Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent…settings-referencesee the edit
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up awsPairs, on All settings.
