fix(bedrock): keep s3_region_name authoritative over merged deployment region

litellm/llms/bedrock/common_utils.py

@@ -63,7 +63,7 @@ def merge_bedrock_aws_request_params(
     no static credentials configured.
     """
     request_params: Final = {**optional_params, **litellm_params}  # mutable-ok: AWS helpers require a plain dict
-    has_static_deployment_credentials = all(
+    has_static_deployment_credentials: Final = all(
         isinstance(litellm_params.get(key), str) and bool(litellm_params.get(key))
         for key in ("aws_access_key_id", "aws_secret_access_key", "aws_region_name")
     )

litellm/llms/bedrock/files/transformation.py

@@ -844,13 +844,14 @@ class BedrockFilesConfig(BaseAWSLLM, BaseFilesConfig):
         )
 
         # s3_region_name always wins for S3 operations (same priority as in
-        # get_complete_file_url above). Overwrite aws_region_name unconditionally
-        # so the SigV4 region matches the URL region, avoiding SignatureDoesNotMatch.
+        # get_complete_file_url above). Overwrite aws_region_name unconditionally,
+        # after the deployment-credential merge, so the SigV4 region matches the
+        # URL region, avoiding SignatureDoesNotMatch.
+        merged_params: Final = merge_bedrock_aws_request_params(litellm_params, optional_params)
         s3_region_name: Final = litellm_params.get("s3_region_name") or optional_params.get("s3_region_name")
-        if s3_region_name:
-            optional_params = {**optional_params, "aws_region_name": s3_region_name}
-
-        request_params: Final = merge_bedrock_aws_request_params(litellm_params, optional_params)
+        request_params: Final = (
+            {**merged_params, "aws_region_name": s3_region_name} if s3_region_name else merged_params
+        )
 
         # Sign the request and return a pre-signed request object
         signed_headers, signed_body = self._sign_s3_request(

tests/batches_tests/test_bedrock_files_and_batches.py

@@ -519,3 +519,40 @@ def test_bedrock_deployment_credentials_block_caller_profile_override(monkeypatc
 
     assert "aws_profile_name" not in captured["optional_params"]
     assert captured["optional_params"]["aws_access_key_id"] == "deployment-access-key"
+
+
+def test_bedrock_file_upload_s3_region_survives_deployment_region_merge(monkeypatch):
+    from litellm.llms.bedrock.files.transformation import BedrockFilesConfig
+
+    config = BedrockFilesConfig()
+    captured = {}
+
+    def capture_signing(**kwargs):
+        captured.update(kwargs)
+        return {}, ""
+
+    monkeypatch.setattr(config, "_sign_s3_request", capture_signing)
+
+    result = config.transform_create_file_request(
+        model="",
+        create_file_data={
+            "file": (
+                "batch.jsonl",
+                b'{"custom_id":"req-1","body":{"model":"bedrock/model"}}\n',
+                "application/jsonl",
+            ),
+            "purpose": "batch",
+        },
+        optional_params={},
+        litellm_params={
+            "s3_bucket_name": "deployment-bucket",
+            "s3_region_name": "eu-central-1",
+            "aws_access_key_id": "deployment-access-key",
+            "aws_secret_access_key": "deployment-secret",
+            "aws_region_name": "us-east-1",
+        },
+    )
+
+    assert "s3.eu-central-1.amazonaws.com" in result["url"]
+    assert captured["optional_params"]["aws_region_name"] == "eu-central-1"
+    assert captured["optional_params"]["aws_access_key_id"] == "deployment-access-key"