diff --git a/litellm/llms/bedrock/common_utils.py b/litellm/llms/bedrock/common_utils.py index 57202f2d626..48bc60a07e5 100644 --- a/litellm/llms/bedrock/common_utils.py +++ b/litellm/llms/bedrock/common_utils.py @@ -63,7 +63,7 @@ def merge_bedrock_aws_request_params( no static credentials configured. """ request_params: Final = {**optional_params, **litellm_params} # mutable-ok: AWS helpers require a plain dict - has_static_deployment_credentials = all( + has_static_deployment_credentials: Final = all( isinstance(litellm_params.get(key), str) and bool(litellm_params.get(key)) for key in ("aws_access_key_id", "aws_secret_access_key", "aws_region_name") ) diff --git a/litellm/llms/bedrock/files/transformation.py b/litellm/llms/bedrock/files/transformation.py index f50651f4cb7..4ff7323c33f 100644 --- a/litellm/llms/bedrock/files/transformation.py +++ b/litellm/llms/bedrock/files/transformation.py @@ -844,13 +844,14 @@ class BedrockFilesConfig(BaseAWSLLM, BaseFilesConfig): ) # s3_region_name always wins for S3 operations (same priority as in - # get_complete_file_url above). Overwrite aws_region_name unconditionally - # so the SigV4 region matches the URL region, avoiding SignatureDoesNotMatch. + # get_complete_file_url above). Overwrite aws_region_name unconditionally, + # after the deployment-credential merge, so the SigV4 region matches the + # URL region, avoiding SignatureDoesNotMatch. + merged_params: Final = merge_bedrock_aws_request_params(litellm_params, optional_params) s3_region_name: Final = litellm_params.get("s3_region_name") or optional_params.get("s3_region_name") - if s3_region_name: - optional_params = {**optional_params, "aws_region_name": s3_region_name} - - request_params: Final = merge_bedrock_aws_request_params(litellm_params, optional_params) + request_params: Final = ( + {**merged_params, "aws_region_name": s3_region_name} if s3_region_name else merged_params + ) # Sign the request and return a pre-signed request object signed_headers, signed_body = self._sign_s3_request( diff --git a/tests/batches_tests/test_bedrock_files_and_batches.py b/tests/batches_tests/test_bedrock_files_and_batches.py index 52e88937916..b9045cc43d6 100644 --- a/tests/batches_tests/test_bedrock_files_and_batches.py +++ b/tests/batches_tests/test_bedrock_files_and_batches.py @@ -519,3 +519,40 @@ def test_bedrock_deployment_credentials_block_caller_profile_override(monkeypatc assert "aws_profile_name" not in captured["optional_params"] assert captured["optional_params"]["aws_access_key_id"] == "deployment-access-key" + + +def test_bedrock_file_upload_s3_region_survives_deployment_region_merge(monkeypatch): + from litellm.llms.bedrock.files.transformation import BedrockFilesConfig + + config = BedrockFilesConfig() + captured = {} + + def capture_signing(**kwargs): + captured.update(kwargs) + return {}, "" + + monkeypatch.setattr(config, "_sign_s3_request", capture_signing) + + result = config.transform_create_file_request( + model="", + create_file_data={ + "file": ( + "batch.jsonl", + b'{"custom_id":"req-1","body":{"model":"bedrock/model"}}\n', + "application/jsonl", + ), + "purpose": "batch", + }, + optional_params={}, + litellm_params={ + "s3_bucket_name": "deployment-bucket", + "s3_region_name": "eu-central-1", + "aws_access_key_id": "deployment-access-key", + "aws_secret_access_key": "deployment-secret", + "aws_region_name": "us-east-1", + }, + ) + + assert "s3.eu-central-1.amazonaws.com" in result["url"] + assert captured["optional_params"]["aws_region_name"] == "eu-central-1" + assert captured["optional_params"]["aws_access_key_id"] == "deployment-access-key"