From 4885594a1e522706e3f172d5b5d8443129d4ba0d Mon Sep 17 00:00:00 2001 From: yassin Date: Thu, 17 Sep 2026 21:55:32 +0000 Subject: [PATCH] fix(proxy): use path-style S3 URLs for dotted Transcribe media buckets Virtual-hosted URLs for bucket names containing dots fail TLS verification, so the media duration fetch failed and completed jobs were charged the eight hour maximum Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../transcribe_passthrough_logging_handler.py | 7 +++++-- .../test_transcribe_passthrough_logging_handler.py | 6 ++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/pass_through_endpoints/llm_provider_handlers/transcribe_passthrough_logging_handler.py b/litellm/proxy/pass_through_endpoints/llm_provider_handlers/transcribe_passthrough_logging_handler.py index 2745876229b..763b2437523 100644 --- a/litellm/proxy/pass_through_endpoints/llm_provider_handlers/transcribe_passthrough_logging_handler.py +++ b/litellm/proxy/pass_through_endpoints/llm_provider_handlers/transcribe_passthrough_logging_handler.py @@ -290,13 +290,16 @@ def transcribe_job_lookup(aws_region_name: str) -> JobLookup: def s3_media_url(media_uri: str, aws_region_name: str) -> str | None: """ Transcribe accepts media as s3://bucket/key or as an https S3 URL; the bucket is required to - live in the job's region, so the s3 form maps onto that region's virtual-hosted endpoint. - The proxy's AWS signature is only ever sent to that partition's own hosts. + live in the job's region, so the s3 form maps onto that region's endpoint. Buckets with dots in + their name use the path-style form because they cannot match the virtual-hosted wildcard + certificate. The proxy's AWS signature is only ever sent to that partition's own hosts. """ dns_suffix: Final = get_aws_dns_suffix(aws_region_name) if not media_uri.startswith("s3://"): return media_uri if httpx.URL(media_uri).host.endswith(f".{dns_suffix}") else None bucket, _, key = media_uri.removeprefix("s3://").partition("/") + if "." in bucket: + return f"https://s3.{aws_region_name}.{dns_suffix}/{bucket}/{quote(key)}" return f"https://{bucket}.s3.{aws_region_name}.{dns_suffix}/{quote(key)}" diff --git a/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_transcribe_passthrough_logging_handler.py b/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_transcribe_passthrough_logging_handler.py index 80f118f76dd..5765900f444 100644 --- a/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_transcribe_passthrough_logging_handler.py +++ b/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_transcribe_passthrough_logging_handler.py @@ -197,6 +197,12 @@ class TestS3MediaUrl: == "https://my-bucket.s3.us-west-2.amazonaws.com/dir/a%20b.wav" ) + def test_dotted_bucket_maps_to_the_regional_path_style_endpoint(self): + assert ( + s3_media_url("s3://media.example.com/dir/a b.wav", "us-west-2") + == "https://s3.us-west-2.amazonaws.com/media.example.com/dir/a%20b.wav" + ) + @pytest.mark.parametrize( "media_uri", [