fix(bedrock): sign batch retrieve and cancel with deployment credentials when AWS_BEARER_TOKEN_BEDROCK is set

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

litellm/llms/bedrock/batches/handler.py

@@ -10,6 +10,8 @@ from litellm.types.llms.bedrock import AwsAuthParams, AwsSessionTag
 from litellm.types.utils import LiteLLMBatch
 
 if TYPE_CHECKING:
+    from botocore.config import Config
+
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
 
 # AWS Bedrock model-invocation-job statuses → OpenAI Batch statuses.
@@ -31,6 +33,12 @@ _BEDROCK_MIJ_STATUS_TO_OPENAI: Final = {
 _CANCEL_IDEMPOTENT_STATUSES: Final = frozenset({"cancelling", "cancelled", "completed", "failed", "expired"})
 
 
+def _sigv4_config() -> "Config":
+    from botocore.config import Config
+
+    return Config(signature_version="v4")
+
+
 def _extract_region_from_bedrock_arn(arn: str) -> str | None:
     """ARN shape: ``arn:aws:bedrock:<region>:<account>:<type>/<id>``"""
     try:
@@ -150,6 +158,7 @@ class BedrockBatchesHandler:
             aws_access_key_id=creds.access_key,
             aws_secret_access_key=creds.secret_key,
             aws_session_token=creds.token,
+            config=_sigv4_config(),
         )
 
         def job_status() -> "LiteLLMBatch":
@@ -309,6 +318,7 @@ class BedrockBatchesHandler:
             aws_access_key_id=creds.access_key,
             aws_secret_access_key=creds.secret_key,
             aws_session_token=creds.token,
+            config=_sigv4_config(),
         )
 
         if logging_obj is not None:

tests/test_litellm/llms/bedrock/batches/test_handler.py

@@ -570,3 +570,53 @@ def test_cancel_batch_stops_and_polls_the_job_with_the_tagged_session(monkeypatc
     fake_bedrock.stop_model_invocation_job.assert_called_once_with(jobIdentifier=JOB_ARN)
     assert batch.status == "cancelled"
     assert [kwargs["aws_access_key_id"] for kwargs in bedrock_client_kwargs] == ["ASIABATCHCANCELTAGGED"] * 2
+
+
+def _sigv4_capture_send(sent_headers: list[dict[str, str]], body: dict):
+    import json
+
+    from botocore.awsrequest import AWSResponse
+
+    def send(_self, request):
+        sent_headers.append({k: v.decode() if isinstance(v, bytes) else v for k, v in request.headers.items()})
+        raw = MagicMock()
+        raw.stream.return_value = iter([json.dumps(body, default=str).encode()])
+        return AWSResponse(request.url, 200, {"content-type": "application/json"}, raw)
+
+    return send
+
+
+def test_retrieve_signs_with_deployment_credentials_when_env_bearer_token_is_set(monkeypatch):
+    """A proxy-wide AWS_BEARER_TOKEN_BEDROCK must not override the deployment's own SigV4 credentials."""
+    monkeypatch.setenv("AWS_BEARER_TOKEN_BEDROCK", "env-bearer-token")
+    sent_headers: list[dict[str, str]] = []
+
+    with patch("botocore.httpsession.URLLib3Session.send", _sigv4_capture_send(sent_headers, _fake_boto3_response())):
+        batch = BedrockBatchesHandler._handle_model_invocation_job_status(
+            batch_id=JOB_ARN,
+            aws_access_key_id="AKIADEPLOYMENTKEY",
+            aws_secret_access_key="deployment-secret",
+        )
+
+    assert batch.status == "completed"
+    assert len(sent_headers) == 1
+    assert sent_headers[0]["Authorization"].startswith("AWS4-HMAC-SHA256 Credential=AKIADEPLOYMENTKEY/")
+
+
+def test_cancel_signs_with_deployment_credentials_when_env_bearer_token_is_set(monkeypatch):
+    monkeypatch.setenv("AWS_BEARER_TOKEN_BEDROCK", "env-bearer-token")
+    sent_headers: list[dict[str, str]] = []
+
+    with patch(
+        "botocore.httpsession.URLLib3Session.send",
+        _sigv4_capture_send(sent_headers, _fake_boto3_response(status="Stopped")),
+    ):
+        batch = BedrockBatchesHandler.cancel_batch(
+            batch_id=JOB_ARN,
+            aws_access_key_id="AKIADEPLOYMENTKEY",
+            aws_secret_access_key="deployment-secret",
+        )
+
+    assert batch.status == "cancelled"
+    assert len(sent_headers) == 2
+    assert all(h["Authorization"].startswith("AWS4-HMAC-SHA256 Credential=AKIADEPLOYMENTKEY/") for h in sent_headers)