From 993650fdf8eec3fe0422844f06167d090820932a Mon Sep 17 00:00:00 2001
From: Filippo Menghi <113345637+Cyberfilo@users.noreply.github.com>
Date: Wed, 10 Jun 2026 12:40:26 +0200
Subject: [PATCH] fix(router): don't drop bedrock pass-through deployments
 using IAM credentials (#30111)

* Fix Bedrock passthrough deployment dropped when using IAM credentials

Bedrock deployments with use_in_pass_through enabled and IAM/OIDC auth
(aws_role_name, no api_key) hit the generic pass-through branch in
Router._initialize_deployment_for_pass_through, which calls
set_pass_through_credentials and raises "api_key is required". The
exception drops the deployment from the router entirely, breaking both
passthrough and normal routing for that model.

Skip the credential store write when no api_key is set; the bedrock
passthrough route resolves AWS credentials at request time via
BedrockConverseLLM.get_credentials(), not the passthrough credential
store, so there is nothing to register here.

Fixes #27728.

* Reset passthrough credentials singleton before api_key credential test

The test reads the module-level passthrough_endpoint_router singleton,
so a stale "openai" entry written by an earlier test in the same
process could make the assertion pass without exercising the code path.
Clearing the credentials dict up front makes the test order-independent.
---
 litellm/router.py                 |  7 ++++++
 tests/test_litellm/test_router.py | 42 +++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)

diff --git a/litellm/router.py b/litellm/router.py
index bf79694ec24..8966a2fc191 100644
--- a/litellm/router.py
+++ b/litellm/router.py
@@ -8521,6 +8521,13 @@ class Router:
                     credential_values.get("api_key")
                     or deployment.litellm_params.api_key
                 )
+                if api_key is None:
+                    verbose_router_logger.debug(
+                        "Skipping pass-through credential setup for deployment model=%s, custom_llm_provider=%s; no api_key set. Providers like bedrock resolve credentials at request time.",
+                        model,
+                        custom_llm_provider,
+                    )
+                    return
                 passthrough_endpoint_router.set_pass_through_credentials(
                     custom_llm_provider=custom_llm_provider,
                     api_base=api_base,
diff --git a/tests/test_litellm/test_router.py b/tests/test_litellm/test_router.py
index af63fb99774..e681247959f 100644
--- a/tests/test_litellm/test_router.py
+++ b/tests/test_litellm/test_router.py
@@ -4561,6 +4561,48 @@ def test_get_available_deployment_for_pass_through_raises_when_dict_blocked():
         )
 
 
+def test_initialize_deployment_for_pass_through_keeps_bedrock_iam_deployment():
+    """
+    Bedrock deployments using IAM/OIDC auth have no api_key; pass-through
+    init must not raise and drop them from routing (#27728).
+    """
+    import litellm
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "bedrock-claude",
+                "litellm_params": {
+                    "model": "bedrock/anthropic.claude-3-5-sonnet-20241022-v2:0",
+                    "aws_role_name": "arn:aws:iam::123456789012:role/my-role",
+                    "aws_session_name": "my-session",
+                    "use_in_pass_through": True,
+                },
+                "model_info": {"id": "bedrock-iam-pt"},
+            }
+        ]
+    )
+    assert [m["model_info"]["id"] for m in router.get_model_list()] == [
+        "bedrock-iam-pt"
+    ]
+
+
+def test_initialize_deployment_for_pass_through_sets_credentials_with_api_key():
+    from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import (
+        passthrough_endpoint_router,
+    )
+
+    passthrough_endpoint_router.credentials.clear()
+    router = _router_with_two_pass_through_deployments([False, False])
+    assert len(router.get_model_list()) == 2
+    assert (
+        passthrough_endpoint_router.get_credentials(
+            custom_llm_provider="openai", region_name=None
+        )
+        == "sk-fake-for-tests"
+    )
+
+
 def test_get_deployment_credentials_returns_none_for_blocked_deployment():
     router = _router_with_two_deployments([True, False])
     assert router.get_deployment_credentials(model_id="dep-0") is None