From fe9722777e0fedb746bf80fc81367c2a770ce883 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:49:08 -0700
Subject: [PATCH] fix(proxy): ban aws_profile_name from request bodies

---
 litellm/proxy/auth/auth_utils.py              |  1 +
 .../proxy/auth/test_auth_utils.py             | 41 +++++++++++++++++++
 .../auth/test_banned_params_extra_body.py     |  1 +
 3 files changed, 43 insertions(+)

diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py
index 893e09ece6e..6f7007fa071 100644
--- a/litellm/proxy/auth/auth_utils.py
+++ b/litellm/proxy/auth/auth_utils.py
@@ -251,6 +251,7 @@ _BANNED_REQUEST_BODY_PARAMS: Tuple[str, ...] = (
     "aws_sts_endpoint",
     "aws_web_identity_token",
     "aws_role_name",
+    "aws_profile_name",
     "vertex_credentials",
     # Azure managed-identity / federated-auth token. The Azure provider
     # transformer reads ``azure_ad_token`` (top-level or via
diff --git a/tests/test_litellm/proxy/auth/test_auth_utils.py b/tests/test_litellm/proxy/auth/test_auth_utils.py
index 042fc107f40..2c0306e9b63 100644
--- a/tests/test_litellm/proxy/auth/test_auth_utils.py
+++ b/tests/test_litellm/proxy/auth/test_auth_utils.py
@@ -1749,6 +1749,47 @@ class TestIsRequestBodySafeBlocksBedrockProjectOverride:
         )
 
 
+class TestIsRequestBodySafeBlocksAwsProfileOverride:
+    def test_aws_profile_name_in_request_body_is_rejected(self):
+        with pytest.raises(ValueError, match="aws_profile_name"):
+            is_request_body_safe(
+                request_body={
+                    "model": "bedrock/anthropic.claude-v2",
+                    "aws_profile_name": "any-profile-on-the-proxy-host",
+                },
+                general_settings={},
+                llm_router=None,
+                model="bedrock/anthropic.claude-v2",
+            )
+
+    def test_aws_profile_name_with_api_key_still_rejected(self):
+        with pytest.raises(ValueError, match="aws_profile_name"):
+            is_request_body_safe(
+                request_body={
+                    "model": "bedrock/anthropic.claude-v2",
+                    "api_key": "sk-anything",
+                    "aws_profile_name": "any-profile-on-the-proxy-host",
+                },
+                general_settings={},
+                llm_router=None,
+                model="bedrock/anthropic.claude-v2",
+            )
+
+    def test_admin_opt_in_proxy_wide_allows_aws_profile_name(self):
+        assert (
+            is_request_body_safe(
+                request_body={
+                    "model": "bedrock/anthropic.claude-v2",
+                    "aws_profile_name": "byok-profile",
+                },
+                general_settings={"allow_client_side_credentials": True},
+                llm_router=None,
+                model="bedrock/anthropic.claude-v2",
+            )
+            is True
+        )
+
+
 class TestIsRequestBodySafeBlocksNVCFFunctionOverride:
     """``nvcf_function_id`` is rejected as a request-body param unless the
     admin opted in proxy-wide or per-deployment."""
diff --git a/tests/test_litellm/proxy/auth/test_banned_params_extra_body.py b/tests/test_litellm/proxy/auth/test_banned_params_extra_body.py
index 2ccee386281..e87b206a40a 100644
--- a/tests/test_litellm/proxy/auth/test_banned_params_extra_body.py
+++ b/tests/test_litellm/proxy/auth/test_banned_params_extra_body.py
@@ -23,6 +23,7 @@ from litellm.proxy.auth.auth_utils import is_request_body_safe  # noqa: E402
         "aws_web_identity_token",
         "aws_sts_endpoint",
         "aws_role_name",
+        "aws_profile_name",
         "api_base",
         "base_url",
         "vertex_credentials",