From f54cd287a2f149e6f6096299114b34be7c1af6b5 Mon Sep 17 00:00:00 2001
From: "devin-ai-integration[bot]"
 <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 14:55:46 -0700
Subject: [PATCH] fix(bedrock): grant bedrock:CountTokens in OIDC session
 policy (#33145)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/llms/bedrock/base_aws_llm.py                |  1 +
 .../bedrock/test_web_identity_session_policy.py     | 13 +++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/litellm/llms/bedrock/base_aws_llm.py b/litellm/llms/bedrock/base_aws_llm.py
index 11851427181..db6f2c0d491 100644
--- a/litellm/llms/bedrock/base_aws_llm.py
+++ b/litellm/llms/bedrock/base_aws_llm.py
@@ -859,6 +859,7 @@ class BaseAWSLLM:
                     "Action": [
                         "bedrock:InvokeModel",
                         "bedrock:InvokeModelWithResponseStream",
+                        "bedrock:CountTokens",
                         "bedrock:ApplyGuardrail",
                         "bedrock:GetGuardrail",
                         "bedrock:ListGuardrails",
diff --git a/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py b/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
index 0cbdc518cc2..3ea840519f9 100644
--- a/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
+++ b/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
@@ -117,6 +117,19 @@ class TestWebIdentitySessionPolicyShape:
         ):
             assert required in actions, f"{required} missing from BedrockLiteLLM"
 
+    def test_bedrock_count_tokens_action_present(self):
+        """Regression for #33142: the CountTokens handler authorizes
+        against ``bedrock:CountTokens``, so the session-policy ceiling
+        must grant it or every count-tokens request via OIDC auth 403s
+        even when the role's identity policy allows it."""
+        policy = _captured_policy()
+        bedrock_stmt = _statement_by_sid(policy, "BedrockLiteLLM")
+        actions = set(bedrock_stmt["Action"])
+        assert "bedrock:CountTokens" in actions, (
+            "bedrock:CountTokens missing from BedrockLiteLLM — "
+            "count-tokens requests will 403 on OIDC auth"
+        )
+
 
 class TestClaudePlatformActionsCovered:
     """The #30200 bug: every action in the claude_platform service