scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-10 03:28:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 84
litellm/tests/test_litellm
History
Richard Tweed 0ac093b59e
fix: role chaining and session name with webauthentication for aws bedrock (#13205) 
* fix(bedrock): prevent duplicate role assumption in EKS/IRSA environments

Fixes issue where AWS role assumption would fail in EKS/IRSA environments
when trying to assume the same role that's already being used.

The problem occurred when:
1. EKS/IRSA automatically assumes a role (e.g., LitellmRole)
2. LiteLLM tries to assume the same role again, causing AccessDenied errors
3. Different models with different roles would fail due to incorrect role context

Changes:
- Added check in _auth_with_aws_role() to detect if already using target role
- Skip role assumption if current identity matches target role
- Return current credentials instead of attempting duplicate assumption
- Added comprehensive test coverage for the fix

This ensures proper role chaining works in EKS/IRSA environments where:
- Service Account can assume Role A
- Role A can assume Role B for different models/accounts

Resolves the AccessDenied errors reported in bedrock usage scenarios.

* fix(bedrock): simplify role assumption for EKS/IRSA environments

Fixes AWS Bedrock role assumption in EKS/IRSA environments by properly
handling ambient credentials when no explicit credentials are provided.

The issue occurred because commit 197e7efa8f
introduced changes that broke role assumption in EKS/IRSA environments.

Changes:
- Simplified _auth_with_aws_role() to use ambient credentials when no
  explicit AWS credentials are provided (aws_access_key_id and
  aws_secret_access_key are both None)
- This allows web identity tokens in EKS/IRSA to work automatically
  through boto3's credential chain
- Maintains backward compatibility for explicit credential scenarios

Added comprehensive test coverage:
- test_eks_irsa_ambient_credentials_used: Verifies ambient credentials work
- test_explicit_credentials_used_when_provided: Ensures explicit creds still work
- test_partial_credentials_still_use_ambient: Edge case handling
- test_cross_account_role_assumption: Multi-account scenarios
- test_role_assumption_with_custom_session_name: Custom session names
- test_role_assumption_ttl_calculation: TTL calculation verification
- test_role_assumption_error_handling: Error propagation
- test_multiple_role_assumptions_in_sequence: Sequential role assumptions

This fix ensures that in EKS/IRSA environments:
1. Service accounts can assume their initial role via web identity
2. That role can then assume other roles across accounts as configured
3. Different models can use different roles without conflicts

* fix(bedrock): add automatic IRSA detection for EKS environments

- Detect AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables
- Automatically use web identity token flow when IRSA is detected
- Read web identity token from file and pass to existing auth method
- Add test coverage for IRSA environment detection
- Fixes authentication errors in EKS with IRSA when no explicit credentials provided

* fix(bedrock): skip role assumption when IRSA role matches requested role

- Detect when AWS_ROLE_ARN environment variable matches the requested role
- Skip unnecessary role assumption when already running as the target role
- Use existing env vars authentication method for IRSA credentials
- Add test coverage for same-role IRSA scenario
- Fixes 'not authorized to perform: sts:AssumeRole' errors when trying to assume the same role

* fix(bedrock): use boto3's native IRSA support for cross-account role assumption

- Replace custom web identity token handling with boto3's built-in IRSA support
- boto3 automatically reads AWS_WEB_IDENTITY_TOKEN_FILE and assumes initial role
- Then use standard assume_role for cross-account access
- Update test to mock boto3 STS client instead of internal methods
- Fixes 'OIDC token could not be retrieved from secret manager' error

* fix(bedrock): improve IRSA error handling and add debug logging

- Add debug logging to show current identity and role assumption attempts
- Provide clearer error messages for trust policy issues
- Fix region handling in IRSA flow
- Re-raise exceptions instead of silently falling through
- This helps diagnose cross-account role assumption permission issues

* fix(bedrock): manually assume IRSA role with correct session name for cross-account scenarios

- When doing cross-account role assumption, manually assume the IRSA role first with the desired session name
- This ensures the session name in the assumed role ARN matches what's expected in trust policies
- For same-account scenarios, continue using boto3's automatic IRSA support
- Updated tests to handle the new flow
- This fixes the issue where cross-account trust policies require specific session names

* fix: Fix linting issues in base_aws_llm.py

- Fix f-string without placeholders (F541)
- Refactor _auth_with_aws_role to reduce statements count (PLR0915)
  - Extract _handle_irsa_cross_account helper method
  - Extract _handle_irsa_same_account helper method
  - Extract _extract_credentials_and_ttl helper method

---------

Co-authored-by: openhands <openhands@all-hands.dev>
2025-08-02 08:55:35 -07:00
..
caching test_qdrant_semantic_cache_async_set_cache 2025-07-19 15:59:56 -07:00
completion_extras/litellm_responses_transformation fix: handle reasoning parameters and response in responses bridge (#12433) 2025-07-10 18:06:45 -07:00
enterprise/enterprise_callbacks [Feat] Backend - Add support for disabling callbacks in request body (#12762) 2025-07-19 10:10:30 -07:00
experimental_mcp_client [MCP Gateway] Allow using stdio MCPs with LiteLLM (#12530) 2025-07-11 20:21:02 -07:00
google_genai [Bug Fix] Gemini-CLI - The Gemini Custom API request has an incorrect authorization format (#13098) 2025-07-29 13:46:43 -07:00
integrations test: update unit tests 2025-08-01 13:37:51 -07:00
litellm_core_utils Prompt Management - add local dotprompt file support 2025-07-31 22:28:29 -07:00
llms fix: role chaining and session name with webauthentication for aws bedrock (#13205) 2025-08-02 08:55:35 -07:00
passthrough Refactor: bedrock passthrough fixes - migrate to Passthrough SDK (#12089) 2025-06-26 22:51:35 -07:00
proxy [LLM] fix model reload on model update (#13216) 2025-08-01 18:08:02 -07:00
responses Remove duplicate test case verifying field filtering logic (#13023) 2025-07-28 16:40:06 -07:00
router_strategy fix mapped test 2025-07-25 07:24:42 -07:00
router_utils fix mapped tests (#12320) 2025-07-04 10:04:43 -07:00
secret_managers Added handling for pwd protected cert files in AOAI CertificateCredential auth (#12995) 2025-07-28 21:34:54 -07:00
types fix: correct CompletionRequest messages type to match OpenAI API spec (#12980) 2025-07-28 16:47:20 -07:00
vector_stores [Fix] QA Fixes - Vector Store Object Permissions (#11291) 2025-05-31 09:41:05 -07:00
__init__.py [Feat] Add github co-pilot as a new LLM API provider (#12325) 2025-07-04 13:12:16 -07:00
conftest.py fix mapped tests (#12320) 2025-07-04 10:04:43 -07:00
log.txt Litellm fix GitHub action testing (#11163) 2025-05-26 14:41:42 -07:00
readme.md Litellm fix GitHub action testing (#11163) 2025-05-26 14:41:42 -07:00
test_constants.py Litellm fix GitHub action testing (#11163) 2025-05-26 14:41:42 -07:00
test_cost_calculation_log_level.py fix: change cost calculation logs from INFO to DEBUG level 2025-06-27 11:36:58 -06:00
test_cost_calculator.py test: update test 2025-07-16 09:15:05 -07:00
test_logging.py [Bug Fix] StandardLoggingPayload on cache_hits should track custom llm provider + DD LLM Obs span type (#12652) 2025-07-16 15:43:15 -07:00
test_lowest_latency_zero_tokens.py fix(lowest_latency.py): Handle ZeroDivisionError with zero completion tokens (#12734) 2025-07-18 15:19:47 -07:00
test_main.py Fix async retryer on .acompletion() + forward clientside headers - filter out content-type from clientside request (causes llm api call to hang) (#12886) 2025-07-22 19:50:05 -07:00
test_router.py test: update tests 2025-08-01 09:12:44 -07:00
test_utils.py [Proxy]fix key mgmt (#13148) 2025-08-01 17:17:15 -07:00

readme.md

Testing for litellm/

This directory 1:1 maps the the litellm/ directory, and can only contain mocked tests.

The point of this is to:

  1. Increase test coverage of litellm/
  2. Make it easy for contributors to add tests for the litellm/ package and easily run tests without needing LLM API keys.

File name conventions

  • litellm/proxy/test_caching_routes.py maps to litellm/proxy/caching_routes.py
  • test_<filename>.py maps to litellm/<filename>.py