From be2ba6b1b35d30194287cf7ac118ce1ad5ef90eb Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Wed, 14 Jan 2026 12:30:27 -0800 Subject: [PATCH] use common get_request_headers for BaseAWS --- litellm/llms/bedrock/base_aws_llm.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/litellm/llms/bedrock/base_aws_llm.py b/litellm/llms/bedrock/base_aws_llm.py index 18e9deb53b0..bfb25416cf4 100644 --- a/litellm/llms/bedrock/base_aws_llm.py +++ b/litellm/llms/bedrock/base_aws_llm.py @@ -87,7 +87,7 @@ class BaseAWSLLM: """ import litellm from litellm.secret_managers.main import str_to_bool - + # Check environment variable first (highest priority) ssl_verify = os.getenv("SSL_VERIFY", litellm.ssl_verify) @@ -1232,15 +1232,20 @@ class BaseAWSLLM: else: headers = {"Content-Type": "application/json"} + aws_signature_headers = self._filter_headers_for_aws_signature(headers) request = AWSRequest( method="POST", url=api_base, data=json.dumps(request_data), - headers=headers, + headers=aws_signature_headers, ) sigv4.add_auth(request) request_headers_dict = dict(request.headers) + # Add back original headers after signing. Only headers in SignedHeaders + # are integrity-protected; forwarded headers (x-forwarded-*) must remain unsigned. + for header_name, header_value in headers.items(): + request_headers_dict[header_name] = header_value if ( headers is not None and "Authorization" in headers ): # prevent sigv4 from overwriting the auth header