Requests using AWS streaming uploads, presigned URLs, or SigV4A signatures are now blocked by default unless explicitly allowed
What
A new policy schema governs how Claude Code's credential-masking proxy handles AWS requests it cannot fully re-sign itself, covering three categories:
streaming– AWS-chunked streaming uploadspresigned– URLs with an embedded signaturesigv4a– requests using asymmetric SigV4A signatures
Each of these now defaults to "deny" (the request fails closed with a 403 error) unless explicitly set to "passthrough". This replaces old vendor code that previously implemented an unrelated JSON-schema $recursiveAnchor keyword at this same location.
Why
These request types can't be safely re-signed by the masking proxy, so letting them through by default would risk exposing real credentials. Defaulting to deny closes that gap while still allowing an explicit opt-in via passthrough where it's known to be safe.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
| `Streaming response ended before any complete data was received` | [Network](#streaming-response-ended-before-any-complete-data-was-received) |errors see the edit
| Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent…settings-reference see the edit
Anthropic's documentation has since written up awsPairs, on All settings.