From 29f0b02a83f8d36cfcc508b5de9d9105b3930afd Mon Sep 17 00:00:00 2001 From: yucheng Date: Mon, 6 Jul 2026 10:06:42 -0700 Subject: [PATCH] fix(proxy): also allow os.environ/ resolution for aws_bedrock_project_id, aws_batch_role_arn, aws_workspace_id Round out the AWS auth-field coverage of _DB_LITELLM_PARAM_ENV_REF_KEYS so every stringy aws_* field a deployment can pin in the DB resolves os.environ/ refs at load time: - aws_bedrock_project_id: Bedrock project/workspace association, banned from request bodies via _BANNED_REQUEST_BODY_PARAMS - aws_batch_role_arn: Bedrock batches role ARN (analog of aws_role_name) - aws_workspace_id: Claude Platform workspace ID Verified against three independent sources: - BaseAWSLLM.aws_authentication_params (all 11) - LiteLLM_Params-declared AWS fields (all 5) - every aws_* string read from litellm_params/kwargs/optional_params across litellm/ (all 14, excluding aws_bedrock_client which is a boto3 client object, not a string, and aws_polly which is a provider name) The regression test now pins all 12 newly-allowlisted fields. --- litellm/proxy/proxy_server.py | 3 +++ tests/test_litellm/proxy/proxy_server/test_proxy_config.py | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index b0fff2b63c3..1474c15e778 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -1134,6 +1134,9 @@ _DB_LITELLM_PARAM_ENV_REF_KEYS = frozenset( "aws_sts_endpoint", "aws_external_id", "aws_bedrock_runtime_endpoint", + "aws_bedrock_project_id", + "aws_batch_role_arn", + "aws_workspace_id", } ) diff --git a/tests/test_litellm/proxy/proxy_server/test_proxy_config.py b/tests/test_litellm/proxy/proxy_server/test_proxy_config.py index 36c98815d52..9a687addbdd 100644 --- a/tests/test_litellm/proxy/proxy_server/test_proxy_config.py +++ b/tests/test_litellm/proxy/proxy_server/test_proxy_config.py @@ -1175,6 +1175,12 @@ def test_ProxyConfig__add_deployment_resolves_env_refs_for_aws_bedrock_auth_para "BEDROCK_RUNTIME_ENDPOINT", "https://bedrock-runtime.us-east-1.amazonaws.com", ), + "aws_bedrock_project_id": ("BEDROCK_PROJECT_ID", "resolved-project-id"), + "aws_batch_role_arn": ( + "BEDROCK_BATCH_ROLE_ARN", + "arn:aws:iam::123456789012:role/batch", + ), + "aws_workspace_id": ("BEDROCK_WORKSPACE_ID", "resolved-workspace-id"), } for _, (env_name, env_value) in aws_env.items(): monkeypatch.setenv(env_name, env_value)