[DOCS] Bedrock docs omit `aws configure export-credentials` JSON shape support for `awsCredentialExport`

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://code.claude.com/docs/en/amazon-bedrock

Section/Topic

Advanced credential configuration, specifically awsCredentialExport.

Current Documentation

The Bedrock guide currently says:

awsCredentialExport: Only use this if you can't modify .aws and must directly return credentials. This command runs whenever credentials need to be refreshed, not only when credentials are expired. Output is captured silently and not shown to the user. The command must output JSON in this format:

It then shows only this shape:

{
"Credentials": {
"AccessKeyId": "value",
"SecretAccessKey": "value",
"SessionToken": "value",
"Expiration": "2026-01-01T00:00:00Z"
}
}

The page also says:

Expiration is optional. As of Claude Code v2.1.176, when the command returns a valid ISO 8601 Expiration, Claude Code caches the credentials until five minutes before that time. Without it, or on earlier versions, credentials are cached for one hour.

What's Wrong or Missing?

Claude Code v2.1.181 changes awsCredentialExport to accept the JSON shape emitted by aws configure export-credentials:

Fixed AWS awsCredentialExport credentials with a short remaining lifetime causing credential refreshes every minute, and now accepts the JSON shape from aws configure export-credentials

The Bedrock documentation still says the command "must output JSON in this format" and only shows the nested Credentials object. That is now incomplete or misleading because users can apparently point awsCredentialExport at a command that emits the AWS CLI export-credentials shape directly.

The docs should explain:

A. Which shapes are valid

List the existing nested Credentials object shape and the aws configure export-credentials shape now accepted in v2.1.181.

B. A direct command example

Users should be able to copy an example such as aws configure export-credentials --format process if that is the supported command form.

C. Expiration behavior for short-lived credentials

The changelog says short remaining lifetime no longer causes refreshes every minute. The Bedrock page should describe the current refresh threshold or behavior so users with STS credentials can reason about refresh cadence.

Suggested Improvement

Replace "must output JSON in this format" with wording like:

The command can output either of these JSON shapes: 1. Claude Code's nested Credentials shape. 2. The AWS CLI shape emitted by aws configure export-credentials.

Add an example:

{
"Version": 1,
"AccessKeyId": "value",
"SecretAccessKey": "value",
"SessionToken": "value",
"Expiration": "2026-01-01T00:00:00Z"
}

Add a command example if this is the intended direct use:

aws configure export-credentials --format process

Update the Expiration paragraph to mention the v2.1.181 short-lifetime behavior, including the exact refresh threshold if there is one.

Impact

Medium - Makes feature difficult to understand

Additional Context

Affected Pages:

| Page | Line(s) | Context |
|------|---------|---------|
| https://code.claude.com/docs/en/amazon-bedrock | awsCredentialExport subsection | Shows only the nested Credentials JSON shape and says the command must output that format |
| https://code.claude.com/docs/en/settings | awsCredentialExport row | Points users back to the Bedrock advanced credential configuration |

Version: Claude Code v2.1.181 added support for the aws configure export-credentials JSON shape and fixed refresh behavior for credentials with a short remaining lifetime.