8 views
-/https://github.com/berriai/litellm/issues/34069
GitHub · issue

#34069 Feature: Support aws_session_tags in Bedrock role assumption for CUR 2.0 cost attribution

  • State: open
  • Author: @satya-rubrik
  • Labels: llm translation

## Feature Request: Support `aws_session_tags` in Bedrock role assumption for CUR 2.0 cost attribution

### Use case

LiteLLM is widely used as an LLM gateway in enterprise setups where multiple teams or users share a single Bedrock role. AWS supports [session tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) on `sts:AssumeRole` calls, which propagate into CloudTrail and — after activation as cost allocation tags — into CUR 2.0 billing data under the `iamPrincipal/` column prefix. This is the recommended AWS approach for granular per-user/per-team cost attribution in an LLM gateway scenario (see [AWS blog: Introducing granular cost attribution for Amazon Bedrock](https://aws.amazon.com/blogs/machine-learning/introducing-granular-cost-attribution-for-amazon-bedrock/), Scenario 4).

### Current behavior

When a caller passes `aws_session_tags` in `optional_params`, it is not recognized as an AWS authentication parameter. It bypasses the credential extraction block in `converse_handler.py` and `base_aws_llm.py`, falls through to `additional_request_params`, and gets forwarded in the Bedrock request body — causing Bedrock to reject the request:

``` BedrockEx…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 · 31d18h6m24s ago — entered · #import:https:::github.com:berriai:litellm post #2854
Issue 34069 is harder because it requires coordinated changes to AWS credential handling, role-assumption/session-tag propagation, request-parameter filtering, and compatibility testing across Bedrock execution paths. Issue 35454 has insufficient detail and appears substantially smaller in scope.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search