From e6879841ca68490519fcb6cab92335fee62f3fe2 Mon Sep 17 00:00:00 2001 From: Vineeth Sai Date: Wed, 21 Oct 2026 08:42:51 -0700 Subject: [PATCH] fix(guardrails): stop sending a non-Bedrock BYOK key to AWS Key the cached client on the credentials it was built with. --- .../guardrail_hooks/bedrock_guardrails.py | 35 +++++++- .../test_bedrock_guardrails.py | 79 +++++++++++++++++++ 2 files changed, 112 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py b/litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py index adda465ad95..b61ebf2e907 100644 --- a/litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py +++ b/litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py @@ -836,6 +836,33 @@ class BedrockGuardrail(CustomGuardrail, BaseAWSLLM): ) return credentials, aws_region_name + @staticmethod + def _request_api_key_is_a_bedrock_credential(request_data: Mapping[str, Any] | None) -> bool: + """Whether ``request_data["api_key"]`` can be a Bedrock credential at all. + + That field holds the key for the **LLM** call, not for this guardrail's own + ApplyGuardrail request. Credential-override routing + (``_apply_credential_overrides_from_model_config``) writes the caller's BYOK + provider key into it, so on a non-Bedrock deployment it is someone else's + secret: signing with it fails, and it would be sent to AWS as a bearer token. + + Only a request that is itself Bedrock-routed can carry a key that is also + valid here. When the provider cannot be determined the old behaviour is kept, + so a clientside Bedrock key keeps working. + """ + if not request_data: + return False + litellm_params: Final = request_data.get("litellm_params") + nested_provider: Final = ( + litellm_params.get("custom_llm_provider") if isinstance(litellm_params, Mapping) else None + ) + provider: Final = request_data.get("custom_llm_provider") or nested_provider + if provider: + return provider == "bedrock" + model: Final[str] = request_data.get("model") or "" + # A bare name gives nothing to route on, so leave it to the caller's config. + return "/" not in model or model.startswith("bedrock/") + def _prepare_request( self, credentials, @@ -978,7 +1005,7 @@ class BedrockGuardrail(CustomGuardrail, BaseAWSLLM): if key not in _BEDROCK_DYNAMIC_BODY_DENYLIST } ) - if request_data.get("api_key") is not None: + if request_data.get("api_key") is not None and self._request_api_key_is_a_bedrock_credential(request_data): api_key = request_data["api_key"] event_type: Final = ( @@ -1957,7 +1984,11 @@ class BedrockGuardrail(CustomGuardrail, BaseAWSLLM): # Nothing to scan (e.g. tool-only turn) -> allow, like ApplyGuardrail does. return BedrockGuardrailResponse() - api_key: Final[str | None] = request_data.get("api_key") if request_data else None + api_key: Final[str | None] = ( + request_data.get("api_key") + if request_data and self._request_api_key_is_a_bedrock_credential(request_data) + else None + ) credentials, aws_region_name = await run_aws_signing(self._load_credentials, api_key=api_key) body: Final[dict[str, object]] = {"messages": checks_messages, "checks": self.checks} diff --git a/tests/unit/proxy/guardrails/guardrail_hooks/test_bedrock_guardrails.py b/tests/unit/proxy/guardrails/guardrail_hooks/test_bedrock_guardrails.py index 69b3e113b8f..a3bb7e93e1b 100644 --- a/tests/unit/proxy/guardrails/guardrail_hooks/test_bedrock_guardrails.py +++ b/tests/unit/proxy/guardrails/guardrail_hooks/test_bedrock_guardrails.py @@ -5,6 +5,7 @@ Unit tests for Bedrock Guardrails import json import asyncio import logging +import os from typing import Final from datetime import datetime, timezone import sys @@ -6115,6 +6116,84 @@ async def test_bearer_token_never_runs_the_sigv4_credential_chain(monkeypatch): assert mock_post.call_args.kwargs["headers"]["Authorization"] == "Bearer env-bearer-token-12345" +class TestRequestApiKeyIsNotAlwaysABedrockCredential: + """request_data["api_key"] is the LLM call's key, not this guardrail's. + + Credential-override routing writes the caller's BYOK provider key into that + field, so on a non-Bedrock deployment using it as an ApplyGuardrail bearer + token both fails signing with a 403 and sends the caller's third-party secret + to AWS (issue #37872). + """ + + @staticmethod + def _guardrail(): + return BedrockGuardrail(guardrailIdentifier="gid", guardrailVersion="DRAFT") + + @pytest.mark.parametrize( + "request_data, expected", + [ + # BYOK credential override on a non-Bedrock deployment: never a Bedrock key. + ({"model": "nvidia_nim/meta/llama-3.1-8b", "api_key": "nvapi-xxx"}, False), + ({"model": "openrouter/anthropic/claude-3", "api_key": "sk-or-xxx"}, False), + ({"custom_llm_provider": "nvidia_nim", "model": "meta/llama", "api_key": "nvapi-xxx"}, False), + # Bedrock-routed requests keep the existing clientside-key behaviour. + ({"model": "bedrock/anthropic.claude-3", "api_key": "bedrock-key"}, True), + ({"custom_llm_provider": "bedrock", "model": "anthropic.claude-3", "api_key": "k"}, True), + ({"litellm_params": {"custom_llm_provider": "bedrock"}, "model": "x/y", "api_key": "k"}, True), + # Nothing to route on: unchanged, so a clientside Bedrock key still works. + ({"model": "claude-sonnet", "api_key": "k"}, True), + ({"api_key": "k"}, True), + # No request data at all. + (None, False), + ({}, False), + ], + ) + def test_only_a_bedrock_routed_request_yields_a_bedrock_credential(self, request_data, expected): + assert self._guardrail()._request_api_key_is_a_bedrock_credential(request_data) is expected + + def test_byok_key_is_not_sent_to_aws_as_a_bearer_token(self): + """End to end through _prepare_request: the NIM key must not become Authorization.""" + guardrail = self._guardrail() + credentials = MagicMock() + credentials.access_key, credentials.secret_key, credentials.token = "ak", "sk", None + request_data = {"model": "nvidia_nim/meta/llama-3.1-8b", "api_key": "nvapi-SECRET"} + + api_key = request_data["api_key"] if guardrail._request_api_key_is_a_bedrock_credential(request_data) else None + with patch.dict(os.environ, {}, clear=False): + os.environ.pop("AWS_BEARER_TOKEN_BEDROCK", None) + prepped = guardrail._prepare_request( + credentials=credentials, + data={"source": "INPUT", "content": [{"text": {"text": "hi"}}]}, + optional_params={}, + aws_region_name="us-east-1", + api_key=api_key, + ) + + assert "nvapi-SECRET" not in str(dict(prepped.headers)) + assert prepped.headers.get("Authorization", "") != "Bearer nvapi-SECRET" + + def test_an_explicit_bedrock_key_still_becomes_the_bearer_token(self): + """Control: _prepare_request is untouched, so it passes with or without the fix. + + Written against _prepare_request directly rather than through the new helper, + so it proves the capability the api_key field exists for is not regressed. + """ + guardrail = self._guardrail() + credentials = MagicMock() + credentials.access_key, credentials.secret_key, credentials.token = "ak", "sk", None + + api_key = "bedrock-KEY" + prepped = guardrail._prepare_request( + credentials=credentials, + data={"source": "INPUT", "content": [{"text": {"text": "hi"}}]}, + optional_params={}, + aws_region_name="us-east-1", + api_key=api_key, + ) + + assert prepped.headers.get("Authorization") == "Bearer bedrock-KEY" + + @pytest.mark.asyncio async def test_apply_guardrail_signs_off_the_event_loop(monkeypatch): """Regression for issue #40165: the ApplyGuardrail request is signed with SigV4, and botocore