[DOCS] awsCredentialExport seems to have lower priority than credentials stored in .aws/credentials

Documentation Type

Unclear/confusing documentation

Documentation Location

https://code.claude.com/docs/en/amazon-bedrock

Section/Topic

advanced-credential-configuration

Current Documentation

The documentation currently says:

awsCredentialExport: Only use this if you cannot modify .aws and must directly return credentials. Output is captured silently (not shown to the user).

To me it suggests that when awsCredentialExport is used and .aws/credentials is ignored.

What's Wrong or Missing?

However from my experiments it seems that awsCredentialExport is ignored and credentials from .aws/credentials are applied. There is a debug log:

2025-11-19T15:10:14.815Z [DEBUG] Fetching AWS caller identity for credential export command
2025-11-19T15:10:15.001Z [DEBUG] Fetched AWS caller identity, skipping AWS credential export command

which strongly suggests that if credentials are defined then awsCredentialExport is ignored.

Claude version:

$ claude --version
2.0.42 (Claude Code)

Additionally same issue applies to the AWS credentials passed via environment variables (though it is not mentioned here).

Suggested Improvement

The documentation should:

• Indicate that current AWS credentials have higher priority
• Have instructions how to configure Claude to ignore credentials that are configured in the system, both in .aws and in environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, to use awsCredentialExport

Impact

High - Prevents users from using a feature

Additional Context

I have AWS credentials configured for a user that doesn't have permissions to use Bedrock. I want to use awsCredentialExport to assume role which has limited Bedrock permissions. Currently to do it I need to:

• Create special AWS profile without credentials
• Configure .claude/settings.json to undefine AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
• Undefine AWS_PROFILE variable (because it is passed to the command in awsCredentialExport and I don't want that to happen)