scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-08-28 05:25:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 36

fix(bedrock): grant bedrock:CountTokens in OIDC session policy (#33145)

Browse source 
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
devin-ai-integration[bot] 2026-08-05 14:55:46 -07:00 • committed by GitHub
parent 9d58923065
commit f54cd287a2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
litellm/llms/bedrock/base_aws_llm.py
View file

@ -859,6 +859,7 @@ class BaseAWSLLM:
"Action": [
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:CountTokens",
"bedrock:ApplyGuardrail",
"bedrock:GetGuardrail",
"bedrock:ListGuardrails",

13
tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
View file

@ -117,6 +117,19 @@ class TestWebIdentitySessionPolicyShape:
):
assert required in actions, f"{required} missing from BedrockLiteLLM"
def test_bedrock_count_tokens_action_present(self):
"""Regression for #33142: the CountTokens handler authorizes
against ``bedrock:CountTokens``, so the session-policy ceiling
must grant it or every count-tokens request via OIDC auth 403s
even when the role's identity policy allows it."""
policy = _captured_policy()
bedrock_stmt = _statement_by_sid(policy, "BedrockLiteLLM")
actions = set(bedrock_stmt["Action"])
assert "bedrock:CountTokens" in actions, (
"bedrock:CountTokens missing from BedrockLiteLLM — "
"count-tokens requests will 403 on OIDC auth"
)
class TestClaudePlatformActionsCovered:
"""The #30200 bug: every action in the claude_platform service