6 views
-/https://github.com/berriai/litellm/issues/25884
GitHub · issue

#25884 aws_role_name in proxy config YAML silently dropped — cross-account Bedrock AssumeRole never fires

  • State: open
  • Author: @ideald
  • Labels: llm translation

# Bug Report: `aws_role_name` in proxy config YAML silently ignored — cross-account Bedrock AssumeRole never fires

## Summary

When configuring `aws_role_name` in `litellm_params` via the proxy config YAML for cross-account Bedrock access, the parameter is silently dropped during optional params processing. The STS AssumeRole call never fires, and Bedrock calls land in the host account's IAM identity instead of the target role's account.

## Use Case

We're a government organization (City and County of San Francisco) deploying LiteLLM as a centralized LLM Gateway on ECS Fargate. We have a central platform account running LiteLLM and multiple department accounts with Bedrock model access enabled. Each department has its own AWS account with a `LiteLLMBedrockAccess` IAM role that the LiteLLM ECS task role can assume.

Our config uses tag-based routing so each department's models route to their own Bedrock account for billing isolation:

```yaml model_list: - model_name: claude-sonnet-4-6 litellm_params: model: bedrock/us.anthropic.claude-sonnet-4-6 aws_region_name: us-west-2 aws_role_name: arn:aws:iam::244910800867:role/LiteLLMBedrockAccess aws_session_…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (2 events)
#0 of 0 · 31d18h40m20s ago — entered · #import:https:::github.com:berriai:litellm post #2211
The right issue is harder because it requires designing and integrating a new evaluation capability into the observability pipeline, including lifecycle hooks, configuration, result handling, and compatibility considerations. The left issue is comparatively contained: tracing one configuration value through existing parameter plumbing and adding targeted regression coverage.
#0 of 0 · 31d18h25m58s ago — current · #import:https:::github.com:berriai:litellm post #2430
The right issue likely requires tracing configuration propagation across proxy, provider parameter handling, and AWS credential/role-assumption behavior, with integration and security-sensitive testing. The left issue appears more localized to exception classification and HTTP status mapping in one endpoint.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search