[DOCS] `awsAuthRefresh` and `awsCredentialExport` timeout behavior is undocumented

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://code.claude.com/docs/en/amazon-bedrock

Section/Topic

"Advanced credential configuration" section, specifically the awsAuthRefresh and awsCredentialExport settings explanations

Current Documentation

The Bedrock page describes awsAuthRefresh:

awsAuthRefresh: Use this for commands that modify the .aws directory, such as updating credentials, SSO cache, or config files. The command's output is displayed to the user, but interactive input isn't supported. This works well for browser-based SSO flows where the CLI displays a URL or code and you complete authentication in the browser.

And awsCredentialExport:

awsCredentialExport: Only use this if you can't modify .aws and must directly return credentials. Output is captured silently and not shown to the user.

Neither description mentions any timeout behavior — what happens if these commands hang or take too long.

What's Wrong or Missing?

v2.1.41 fixed AWS auth refresh hanging indefinitely by adding a 3-minute timeout. Before this fix, a hanging awsAuthRefresh command (e.g., an SSO flow waiting for browser authentication that never completes) would block Claude Code indefinitely.

The documentation should explain:

1. That these commands have a 3-minute timeout
2. What happens when the timeout is reached (the command is killed and the request fails)
3. How this affects SSO flows that require browser interaction (users need to complete browser auth within 3 minutes)

This is particularly important because the docs specifically recommend awsAuthRefresh for "browser-based SSO flows where the CLI displays a URL or code and you complete authentication in the browser" — these are exactly the flows most likely to approach or exceed a 3-minute timeout if the user is slow to respond.

Suggested Improvement

Add timeout information to the awsAuthRefresh description:

awsAuthRefresh: Use this for commands that modify the .aws directory, such as updating credentials, SSO cache, or config files. The command's output is displayed to the user, but interactive input isn't supported. This works well for browser-based SSO flows where the CLI displays a URL or code and you complete authentication in the browser. Commands time out after 3 minutes — if your SSO flow requires browser authentication, complete it within this window.

And similarly for awsCredentialExport:

awsCredentialExport: Only use this if you can't modify .aws and must directly return credentials. Output is captured silently and not shown to the user. The command must output JSON within 3 minutes or it will be terminated.

Impact

Medium - Makes feature difficult to understand

Additional Context

• Fixed in v2.1.41 (released 2026-02-13): "Fixed AWS auth refresh hanging indefinitely by adding a 3-minute timeout"
• Related existing issues: #23399 (Bedrock auth doesn't pick up refreshed credentials), #12421 (awsAuthRefresh causes constant repeated auth attempts)
• The apiKeyHelper setting documents its refresh behavior (5-minute TTL, HTTP 401 trigger) — the AWS auth settings should similarly document their timeout behavior for consistency