scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-03 02:22:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 80

fix(cloud-agents): default LITELLM_CLOUD_AGENT_MOCK_AWS to off (Greptile P1)

Browse source 
Previously the test-connection endpoint defaulted to mock-on, so a fresh
production proxy would silently return a synthetic success for any
non-empty AWS access key. Operators saving incorrect credentials would
only discover the failure later when VMs failed to launch.

Default is now "0" — operators must set LITELLM_CLOUD_AGENT_MOCK_AWS=1
explicitly to opt into the mock path during local development.

Also adds an inline comment on _build_update_payload's `is not None`
guard so a future contributor doesn't silently drop `False` / `0`
updates by switching to truthy comparison.
This commit is contained in:
Ishaan Jaff 2026-05-06 15:31:17 -07:00
parent 793e769bd5
commit a9cd1fc764
No known key found for this signature in database
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
litellm/proxy/agent_settings_endpoints/vm_config_endpoints.py
View file

@ -159,6 +159,11 @@ def _build_update_payload(
)
for field in plain_fields:
value = getattr(body, field, None)
# Use `is not None` (not truthiness): `False`, `0`, and `""` are
# all valid values that callers may legitimately want to write
# (e.g. disabling warm pool with `warm_pool_enabled=False`,
# zeroing `warm_pool_size`). A future contributor adding a field
# here should keep this guard so those updates don't get dropped.
if value is not None:
payload[field] = value
@ -322,8 +327,15 @@ def _mock_caller_identity(creds: Dict[str, Optional[str]]) -> TestConnectionResp
def _aws_mock_enabled() -> bool:
"""Real STS is owned by B0. Mock by default until that ticket closes."""
return os.getenv("LITELLM_CLOUD_AGENT_MOCK_AWS", "1") == "1"
"""Whether `test-connection` should return a synthetic mock response
instead of calling the real `sts:GetCallerIdentity`.
Defaults to OFF — a fresh production proxy must always validate AWS
credentials against STS, never silently return success for invalid
creds. Set `LITELLM_CLOUD_AGENT_MOCK_AWS=1` explicitly to opt into the
mock path during local development / tests.
"""
return os.getenv("LITELLM_CLOUD_AGENT_MOCK_AWS", "0") == "1"
@router.post(