Merge pull request #41138 from BerriAI/litellm_bedrock_files_s3_endpoint_url

fix(bedrock): carry s3_endpoint_url and s3_region_name into file content downloads

litellm/batches/batch_utils.py

@@ -533,6 +533,8 @@ def _extract_file_access_credentials(litellm_params: dict | None) -> dict:
             "vertex_credentials",
             "gcs_bucket_name",
             "bucket_name",
+            "s3_endpoint_url",
+            "s3_region_name",
             "timeout",
             "max_retries",
             "_litellm_internal_model_credentials",

litellm/litellm_core_utils/get_litellm_params.py

@@ -44,6 +44,8 @@ OPTIONAL_KWARGS_KEYS: Final = (
             "client_side_timeout",
             "gcs_bucket_name",
             "bucket_name",
+            "s3_endpoint_url",
+            "s3_region_name",
             "vertex_credentials",
             "vertex_project",
             "vertex_location",

litellm/types/router.py

@@ -302,6 +302,7 @@ class CredentialLiteLLMParams(BaseModel):
     aws_bedrock_runtime_endpoint: str | None = None
     aws_bedrock_project_id: str | None = None
     s3_bucket_name: str | None = None
+    s3_endpoint_url: str | None = None
     s3_region_name: str | None = None
     s3_encryption_key_id: str | None = None
     aws_batch_role_arn: str | None = None

litellm/types/utils.py

@@ -3776,6 +3776,7 @@ bedrock_batch_litellm_params: Final = (
     "aws_batch_role_arn",
     "s3_bucket_name",
     "s3_region_name",
+    "s3_endpoint_url",
     "s3_output_bucket_name",
     "bedrock_tags",
 )

tests/test_litellm/batches/test_batch_utils.py

@@ -278,6 +278,8 @@ def test_extract_credentials_all_supported_keys():
         "vertex_credentials",
         "gcs_bucket_name",
         "bucket_name",
+        "s3_endpoint_url",
+        "s3_region_name",
         "timeout",
         "max_retries",
     }

tests/test_litellm/litellm_core_utils/test_get_litellm_params.py

@@ -55,6 +55,18 @@ class TestGetLitellmParamsKwargsExtraction:
         assert result["timeout"] == 30
         assert result["rpm"] == 100
 
+    def test_s3_endpoint_kwargs_are_extracted_when_provided(self):
+        result = get_litellm_params(
+            s3_endpoint_url="https://bucket.vpce-abc.s3.us-east-1.vpce.amazonaws.com",
+            s3_region_name="us-east-1",
+        )
+        assert result["s3_endpoint_url"] == "https://bucket.vpce-abc.s3.us-east-1.vpce.amazonaws.com"
+        assert result["s3_region_name"] == "us-east-1"
+
+        result_without_s3_kwargs = get_litellm_params()
+        assert "s3_endpoint_url" not in result_without_s3_kwargs
+        assert "s3_region_name" not in result_without_s3_kwargs
+
     def test_subset_of_kwargs_only_includes_provided(self):
         """Only provided kwargs appear, others remain absent."""
         result = get_litellm_params(azure_ad_token="token123")

tests/test_litellm/llms/bedrock/files/test_bedrock_files_transformation.py

@@ -2271,6 +2271,19 @@ class TestBedrockFileContentTransformation:
         authorization = litellm_params[S3_SIGNED_REQUEST_HEADERS_PARAM]["Authorization"]
         assert "/eu-west-1/s3/aws4_request" in authorization
 
+    def test_s3_request_target_uses_configured_endpoint_url(self):
+        from litellm.litellm_core_utils.get_litellm_params import get_litellm_params
+        from litellm.llms.bedrock.files.transformation import BedrockFilesConfig
+
+        lp = get_litellm_params(
+            aws_region_name="us-east-1",
+            s3_endpoint_url="https://bucket.vpce-abc.s3.us-east-1.vpce.amazonaws.com",
+        )
+
+        assert BedrockFilesConfig()._s3_request_target(
+            optional_params={}, litellm_params=lp
+        ).endpoint_url == "https://bucket.vpce-abc.s3.us-east-1.vpce.amazonaws.com"
+
     def test_validate_environment_merges_and_pops_signed_get_headers(self):
         from litellm.llms.bedrock.files.transformation import (
             S3_SIGNED_REQUEST_HEADERS_PARAM,

ui/litellm-dashboard/src/lib/http/schema.d.ts

@@ -30940,6 +30940,8 @@ export interface components {
             s3_bucket_name?: string | null;
             /** S3 Encryption Key Id */
             s3_encryption_key_id?: string | null;
+            /** S3 Endpoint Url */
+            s3_endpoint_url?: string | null;
             /** S3 Output Bucket Name */
             s3_output_bucket_name?: string | null;
             /** S3 Region Name */
@@ -41573,6 +41575,8 @@ export interface components {
             s3_bucket_name?: string | null;
             /** S3 Encryption Key Id */
             s3_encryption_key_id?: string | null;
+            /** S3 Endpoint Url */
+            s3_endpoint_url?: string | null;
             /** S3 Output Bucket Name */
             s3_output_bucket_name?: string | null;
             /** S3 Region Name */