[BUG] Bedrock auth doesn't pick up refreshed AWS credentials without restart

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When using Claude Code with Bedrock, refreshing AWS credentials doesn't take effect until Claude Code is restarted. Credentials are written to ~/.aws/credentials by my auth tool, and aws sts get-caller-identity works fine in the Claude Code bash session after refresh - but Bedrock model calls continue using stale cached credentials.

What Should Happen?

Claude Code should re-read credentials from ~/.aws/credentials (or the SDK credential chain) when they're refreshed, without requiring a restart.

Error Messages/Logs

N/A - no errors in debug log, just expired credential failures when tokens go stale mid-session.

Steps to Reproduce

1. Start Claude Code with valid Bedrock credentials in ~/.aws/credentials
2. Use Claude Code until credentials expire (or manually refresh early)
3. Run credential refresh tool
4. Verify aws sts get-caller-identity works in Claude Code's bash
5. Continue conversation - Bedrock calls fail with auth errors until restart

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.31

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Warp

Additional Information

• Auth method: SAML-based tool writing to credentials file (not env vars)
• AWS_PROFILE=default and AWS_REGION=us-west-2 set as env vars
• Credentials file includes aws_session_token (temporary STS credentials)