mirror of https://github.com/BerriAI/litellm.git synced 2026-09-15 23:31:29 +00:00

feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI (#32241 )

* feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI

* fix(terraform): address review feedback on vendored provider

Replace deprecated io/ioutil with io. Remove the unused org/team CRUD
client methods so the endpoint audit only tracks live call sites
(54 -> 46). Redact request/response logs by parsing the JSON and
recursively masking sensitive fields, which fixes the nested-object
leak in the old credential_values regex, with a regex fallback for
non-JSON payloads; covered by new unit tests. Docs: stop showing
api_key inside vector store litellm_params and document that Sensitive
attributes still persist in plaintext state, recommending
litellm_credential_name and an encrypted state backend.

* fix(terraform): stop persisting server-returned litellm_params into vector store state

The vector store Read wrote litellm_params straight back from the API
response into state. The proxy redacts secrets in those responses, so
the readback overwrote user config with redaction sentinels and caused
perpetual diffs, and against a server that returns raw values it would
persist secrets into a non-Sensitive attribute. Read now preserves the
config value like the credential and model resources do, litellm_params
is marked Sensitive, and a regression test pins that a server-returned
api_key never lands in state

* fix(terraform): send role on team member update and stop persisting server env into MCP state

The team member update payload omitted role, and the proxy leaves role
unchanged when the field is absent, so a role downgrade reported as
applied by Terraform never took effect on the proxy. The update now
always sends the configured role (the attribute is Required).

The MCP server resource wrote env straight back from API responses
into a non-Sensitive attribute, pulling admin-visible secrets into
state and, for sanitized responses, blanking user config. Read now
preserves the config value, env is marked Sensitive, and the docs warn
against passing secrets via args. Regression tests cover both fixes
and fail against the previous behavior.

2026-07-07 09:16:59 -07:00

3.3 KiB

Raw Permalink Blame History

litellm_team Resource

Manages a team configuration in LiteLLM. Teams allow you to group users and manage their access to models and usage limits.

Example Usage

Basic Team Configuration

resource "litellm_team" "engineering" {
  team_alias = "engineering-team"
  models     = ["gpt-4-proxy", "claude-2"]
  max_budget = 1000.0
}

Team with Comprehensive Configuration

resource "litellm_team" "advanced_team" {
  team_alias      = "ai-research-team"
  organization_id = "org_123456"
  models          = ["gpt-4-proxy", "claude-2", "gpt-3.5-turbo"]

  # Budget and rate limiting
  max_budget      = 1000.0
  budget_duration = "1mo"
  tpm_limit       = 500000
  rpm_limit       = 5000
  blocked         = false

  # Team member permissions
  team_member_permissions = [
    "create_key",
    "delete_key",
    "view_spend",
    "edit_team"
  ]

  # Metadata for organization
  metadata = {
    department = "Engineering"
    project    = "AI Research"
    cost_center = "R&D-001"
  }
}

Team with Model Dependencies

# First create models
resource "litellm_model" "gpt4" {
  model_name          = "gpt-4-proxy"
  custom_llm_provider = "openai"
  base_model          = "gpt-4"
  model_api_key       = var.openai_api_key
}

resource "litellm_model" "claude" {
  model_name          = "claude-proxy"
  custom_llm_provider = "anthropic"
  base_model          = "claude-3-sonnet-20240229"
  model_api_key       = var.anthropic_api_key
}

# Then create team with access to these models
resource "litellm_team" "model_dependent_team" {
  team_alias = "model-users"
  models = [
    litellm_model.gpt4.model_name,
    litellm_model.claude.model_name
  ]
  
  max_budget      = 500.0
  budget_duration = "1mo"
  
  team_member_permissions = [
    "view_spend"
  ]
}

Argument Reference

The following arguments are supported:

team_alias - (Required) A human-readable identifier for the team.
organization_id - (Optional) The ID of the organization this team belongs to.
models - (Optional) List of model names that this team can access.
metadata - (Optional) A map of metadata key-value pairs associated with the team.
blocked - (Optional) Whether the team is blocked from making requests. Default is false.
tpm_limit - (Optional) Team-wide tokens per minute limit.
rpm_limit - (Optional) Team-wide requests per minute limit.
max_budget - (Optional) Maximum budget allocated to the team.
budget_duration - (Optional) Duration for the budget cycle. Valid values are:
- daily
- weekly
- monthly
- yearly
team_member_permissions - (Optional) List of permissions granted to team members. This controls what actions team members can perform within the team context.

Attribute Reference

In addition to the arguments above, the following attributes are exported:

id - The unique identifier for the team.

Import

Teams can be imported using the team ID:

terraform import litellm_team.engineering <team-id>

Note: The team ID is generated when the team is created and is different from the team_alias.

Note on Team Members

Team members are managed through the separate litellm_team_member resource. This allows for more granular control over team membership and permissions. See the litellm_team_member resource documentation for details on managing team members.

3.3 KiB Raw Permalink Blame History