mirror of https://github.com/BerriAI/litellm.git synced 2026-09-06 08:16:43 +00:00

feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI (#32241 )

* feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI

* fix(terraform): address review feedback on vendored provider

Replace deprecated io/ioutil with io. Remove the unused org/team CRUD
client methods so the endpoint audit only tracks live call sites
(54 -> 46). Redact request/response logs by parsing the JSON and
recursively masking sensitive fields, which fixes the nested-object
leak in the old credential_values regex, with a regex fallback for
non-JSON payloads; covered by new unit tests. Docs: stop showing
api_key inside vector store litellm_params and document that Sensitive
attributes still persist in plaintext state, recommending
litellm_credential_name and an encrypted state backend.

* fix(terraform): stop persisting server-returned litellm_params into vector store state

The vector store Read wrote litellm_params straight back from the API
response into state. The proxy redacts secrets in those responses, so
the readback overwrote user config with redaction sentinels and caused
perpetual diffs, and against a server that returns raw values it would
persist secrets into a non-Sensitive attribute. Read now preserves the
config value like the credential and model resources do, litellm_params
is marked Sensitive, and a regression test pins that a server-returned
api_key never lands in state

* fix(terraform): send role on team member update and stop persisting server env into MCP state

The team member update payload omitted role, and the proxy leaves role
unchanged when the field is absent, so a role downgrade reported as
applied by Terraform never took effect on the proxy. The update now
always sends the configured role (the attribute is Required).

The MCP server resource wrote env straight back from API responses
into a non-Sensitive attribute, pulling admin-visible secrets into
state and, for sanitized responses, blanking user config. Read now
preserves the config value, env is marked Sensitive, and the docs warn
against passing secrets via args. Regression tests cover both fixes
and fail against the previous behavior.

2026-07-07 09:16:59 -07:00

4.8 KiB

Raw Blame History

litellm_key Resource

Manages a LiteLLM API key.

Example Usage

resource "litellm_key" "example" {
  models               = ["gpt-3.5-turbo", "gpt-4"]
  max_budget           = 100.0
  user_id              = "user123"
  team_id              = "team456"
  max_parallel_requests = 5
  metadata             = {
    "environment" = "production"
  }
  tpm_limit            = 1000
  rpm_limit            = 60
  budget_duration      = "monthly"
  allowed_cache_controls = ["no-cache", "max-age=3600"]
  soft_budget          = 80.0
  key_alias            = "prod-key-1"
  duration             = "30d"
  aliases              = {
    "gpt-3.5-turbo" = "chatgpt"
  }
  config               = {
    "default_model" = "gpt-3.5-turbo"
  }
  permissions          = {
    "can_create_keys" = "true"
  }
  model_max_budget     = {
    "gpt-4" = 50.0
  }
  model_rpm_limit      = {
    "gpt-3.5-turbo" = 30
  }
  model_tpm_limit      = {
    "gpt-4" = 500
  }
  guardrails           = ["content_filter", "token_limit"]
  blocked              = false
  tags                 = ["production", "api"]
}

Argument Reference

The following arguments are supported:

models - (Optional) List of models that can be used with this key. This restricts the key to only use the specified models.
max_budget - (Optional) Maximum budget for this key. This sets an upper limit on the total spend allowed for this key.
user_id - (Optional) User ID associated with this key. This links the key to a specific user in the LiteLLM system.
team_id - (Optional) Team ID associated with this key. This links the key to a specific team in the LiteLLM system.
max_parallel_requests - (Optional) Maximum number of parallel requests allowed for this key. This helps in controlling concurrent usage.
metadata - (Optional) Metadata associated with this key. This can be used to store additional, custom information about the key.
tpm_limit - (Optional) Tokens per minute limit for this key. This sets a rate limit based on the number of tokens processed.
rpm_limit - (Optional) Requests per minute limit for this key. This sets a rate limit based on the number of API calls.
budget_duration - (Optional) Duration for the budget (e.g., "monthly", "weekly"). This defines the time period for which the max_budget applies.
allowed_cache_controls - (Optional) List of allowed cache control directives. This can be used to control caching behavior for requests made with this key.
soft_budget - (Optional) Soft budget limit for this key. This can be used to set a warning threshold before reaching the max_budget.
key_alias - (Optional) Alias for this key. This provides a human-readable identifier for the key.
duration - (Optional) Duration for which this key is valid. This sets an expiration time for the key.
aliases - (Optional) Map of model aliases. This allows you to create custom names for models when using this key.
config - (Optional) Configuration options for this key. This can be used to set key-specific settings.
permissions - (Optional) Permissions associated with this key. This defines what actions are allowed with this key.
model_max_budget - (Optional) Maximum budget per model. This allows setting different budget limits for each model.
model_rpm_limit - (Optional) Requests per minute limit per model. This allows setting different RPM limits for each model.
model_tpm_limit - (Optional) Tokens per minute limit per model. This allows setting different TPM limits for each model.
guardrails - (Optional) List of guardrails applied to this key. This can be used to enforce certain safety or quality checks.
blocked - (Optional) Whether this key is blocked. If set to true, the key will be unable to make any requests.
tags - (Optional) List of tags associated with this key. This can be used for organization and filtering of keys.

Attribute Reference

In addition to all arguments above, the following attributes are exported:

key - The generated API key. This is the actual key value that will be used for authentication.
spend - The current spend for this key. This reflects the total amount spent using this key so far.

State Management

Recent updates have improved how the Key resource manages its state. The provider now ensures that all non-zero and non-empty values are correctly persisted in the Terraform state file. This means that any value you set will be accurately reflected in your state, preventing unnecessary updates and ensuring consistency between your configuration and the actual resource state.

Import

LiteLLM keys can be imported using the id, e.g.,

$ terraform import litellm_key.example 12345

This allows you to import existing keys into your Terraform state, enabling management of keys that were created outside of Terraform.

4.8 KiB Raw Blame History