settings.json

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "0",
    "DISABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "AWS_PROFILE": "my-sandbox",
    "AWS_REGION": "eu-central-1",
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "ANTHROPIC_MODEL": "eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
    "ANTHROPIC_SMALL_FAST_MODEL": "eu.anthropic.claude-haiku-4-5-20251001-v1:0",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "eu.anthropic.claude-haiku-4-5-20251001-v1:0",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "eu.anthropic.claude-opus-4-6-v1",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
    "DISABLE_PROMPT_CACHING": "0",
    "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "10240",
    "MAX_THINKING_TOKENS": "1024"
  },
  "deny": [
    "Bash(aws * delete*)",
    "Bash(aws * remove*)",
    "Bash(aws * destroy*)",
    "Bash(aws * terminate*)",
    "Bash(aws * deregister*)",
    "Bash(aws * purge*)",
    "Bash(aws s3 rm *)",
    "Bash(aws s3 rb *)",
    "Bash(aws cloudformation delete-stack *)",
    "Bash(aws ec2 run-instances *)",
    "Bash(aws ec2 stop-instances *)",
    "Bash(aws autoscaling set-desired-capacity *)",
    "Bash(aws autoscaling update-auto-scaling-group *)",
    "Bash(aws application-autoscaling *)",
    "Bash(aws ecs update-service *)",
    "Bash(aws iam delete*)",
    "Bash(aws iam create*)",
    "Bash(aws iam put*)",
    "Bash(aws iam attach*)",
    "Bash(kubectl delete *)",
    "Bash(kubectl apply *)",
    "Bash(kubectl create *)",
    "Bash(kubectl patch *)",
    "Bash(kubectl scale *)",
    "Bash(kubectl rollout *)",
    "Bash(kubectl drain *)",
    "Bash(kubectl cordon *)",
    "Bash(kubectl exec *)",
    "Bash(kubectl edit *)",
    "Bash(terraform destroy *)",
    "Bash(terraform destroy)",
    "Bash(terraform apply *)",
    "Bash(terraform apply)",
    "Bash(terraform import *)",
    "Bash(terraform state rm *)",
    "Bash(terraform taint *)",
    "Bash(helm install *)",
    "Bash(helm upgrade *)",
    "Bash(helm delete *)",
    "Bash(helm uninstall *)",
    "Bash(helm rollback *)",
    "Bash(git push --force *)",
    "Bash(git push -f *)",
    "Bash(git push --force-with-lease *)",
    "Bash(git push origin main *)",
    "Bash(git push origin main)",
    "Bash(git push origin master *)",
    "Bash(git push origin master)",
    "Bash(git reset --hard *)",
    "Bash(git clean -f *)",
    "Bash(pnpm publish-packages)", 
    "Bash(rm -rf /)",
    "Bash(rm -rf /*)",
    "Bash(rm -rf ~)",
    "Bash(rm -rf ~/*)",
    "Bash(rm -rf ..*)",
    "Bash(mkfs.*)",
    "Bash(dd if=*/dev/*)",
    "Bash(sudo *)",
    "Bash(sudo)",
    "Bash(chmod 777 *)",
    "Bash(chown root *)",
    "Bash(ssh *)",
    "Bash(scp *)",
    "Bash(curl * | sh)",
    "Bash(curl * | bash)",
    "Bash(wget * | sh)",
    "Bash(wget * | bash)",
    "Read(~/.aws/**)",
    "Read(~/.kube/**)",
    "Read(~/.ssh/**)",
    "Read(.env)",
    "Read(.env.*)",
    "Read(**/secrets/**)",
    "Read(**/*credentials*)",
    "mcp__datadog-mcp__create_datadog_notebook",
    "mcp__datadog-mcp__edit_datadog_notebook",
    "mcp__atlassian__jira_delete_issue",
    "mcp__atlassian__jira_remove_issue_link",
    "mcp__atlassian__confluence_delete_page",
    "mcp__atlassian__confluence_delete_attachment"
  ],
  "allow": [
    "Bash(git log *)",
    "Bash(git status *)",
    "Bash(git status)",
    "Bash(git diff *)",
    "Bash(git diff)",
    "Bash(git branch *)",
    "Bash(git branch)",
    "Bash(git show *)",
    "Bash(git rev-parse *)",
    "Bash(git remote -v)",
    "Bash(ls *)",
    "Bash(ls)",
    "Bash(pwd)",
    "Bash(which *)",
    "Bash(npm test *)",
    "Bash(npm test)",
    "Bash(npm run test *)",
    "Bash(npm run lint *)",
    "Bash(npx jest *)",
    "Bash(npx tsc *)",
    "Bash(pnpm test:compile)",
    "Bash(pnpm test:browser)",
    "Bash(pnpm test)",
    "Bash(pnpm build)",
    "Bash(pnpm install)",
    "Bash(pnpm install:*)",
    "Bash(pnpm lint)",    
    "Bash(pnpm lint:fix)",    
    "Bash(pnpx tsc *)", 
    "Bash(go test *)",
    "Bash(mvn test *)",
    "Bash(gradle test *)",
    "Bash(python -m pytest *)",
    "Bash(python3 -m pytest *)",
    "Bash(aws * describe* *)",
    "Bash(aws * list* *)",
    "Bash(aws * get* *)",
    "Bash(aws s3 ls *)",
    "Bash(aws sts get-caller-identity *)",
    "Bash(aws sts get-caller-identity)",
    "Bash(kubectl get *)",
    "Bash(kubectl describe *)",
    "Bash(kubectl logs *)",
    "Bash(terraform plan *)",
    "Bash(terraform plan)",
    "Bash(terraform validate *)",
    "Bash(terraform validate)",
    "Bash(terraform fmt *)",
    "Bash(terraform fmt)",
    "Read(./**)",
    "Edit(./**)",
    "mcp__datadog-mcp__analyze_datadog_logs",
    "mcp__datadog-mcp__get_datadog_incident",
    "mcp__datadog-mcp__get_datadog_metric",
    "mcp__datadog-mcp__get_datadog_metric_context",
    "mcp__datadog-mcp__get_datadog_notebook",
    "mcp__datadog-mcp__get_datadog_trace",
    "mcp__datadog-mcp__search_datadog_dashboards",
    "mcp__datadog-mcp__search_datadog_events",
    "mcp__datadog-mcp__search_datadog_hosts",
    "mcp__datadog-mcp__search_datadog_incidents",
    "mcp__datadog-mcp__search_datadog_logs",
    "mcp__datadog-mcp__search_datadog_metrics",
    "mcp__datadog-mcp__search_datadog_monitors",
    "mcp__datadog-mcp__search_datadog_notebooks",
    "mcp__datadog-mcp__search_datadog_rum_events",
    "mcp__datadog-mcp__search_datadog_service_dependencies",
    "mcp__datadog-mcp__search_datadog_services",
    "mcp__datadog-mcp__search_datadog_spans"
  ],
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{"type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/validate-bash-command.sh"}]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "*",
        "hooks": [{"type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/audit-log.sh"}]
      }
    ]
  },
  "statusLine": {
    "type": "command",
    "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/statusline.sh"
  }
}