[BUG] awsCredentialExport called even without CLAUDE_CODE_USE_BEDROCK

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

From my local usage, it seems like awsCredentialExport is being exercised even when CLAUDE_CODE_USE_BEDROCK is not set or set, which is surprising for several reasons:

• I would not expect it to be called if Claude Code is not configured to use Bedrock
• unless there's a use case of which I'm not aware, it seems unnecessary and therefore doing "wasted" work

What Should Happen?

Any setting or script involved in Bedrock auth (awsCredentialExport, awsAuthRefresh, etc.) should not be exercised if Bedrock is not enabled.

Error Messages/Logs

See "Steps to Reproduce"

Steps to Reproduce

1. When not using Bedrock and awsCredentialExport returns an invalid structure.

/project-root/.claude/settings.json

{
  "awsCredentialExport": "echo 'should not be called'", 
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "0"
  }
}

Then Claude returns the following error on startup and on every eval:

Error getting AWS credentials from awsCredentialExport (in settings or ~/.claude.json): awsCredentialExport did not return a valid value

1. When not using Bedrock and awsCredentialExport returns a valid structure with invalid credentials (which I tried just to get past the first error).

/project-root/.claude/settings.json

{
  "awsCredentialExport": "echo '{\"Credentials\": {\"AccessKeyId\": \"value\", \"SecretAccessKey\": \"value\", \"SessionToken\": \"value\"}}'",
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "0"
  }
}

Then Claude returns the following error on eval:

API Error (403 The security token included in the request is invalid.) · Retrying in 8 seconds… (attempt X/10)

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.0.120 (Claude Code)

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

In our org, we would like to default users to a Bedrock configuration, and have that committed in /project-root/.claude/settings.json, but since we allow multiple ways of connecting, we'd like the ability to toggle that with by changing only CLAUDE_CODE_USE_BEDROCK. However, because of how the AWS settings are exercised (and the fact that not all of our users have AWS access, or that it requires some setup), the current behavior is both unexpected and prevents non-Bedrock sessions from working like they should.