add application level encryption in SQS

[deepanshululla]

Title

Adds application level encryption in SQS

To generate the master key

import os, base64
print(base64.b64encode(os.urandom(32)).decode())

Relevant configuration

litellm_settings:
  aws_sqs_callback_params:
    sqs_queue_url: os.environ/SQS_LOGS_URL   # AWS SQS Queue URL
    sqs_region_name: us-west-2              # AWS Region Name for SQS
    sqs_batch_size: 10  # [OPTIONAL] Number of messages to batch before sending (default: 10)
    sqs_flush_interval: 30  # [OPTIONAL] Time in seconds to wait before flushing batch (default: 30)
    sqs_aws_use_application_level_encryption: true
    sqs_app_encryption_key_b64: os.environ/secret_key
    sqs_app_encryption_aad: os.environ/secret_aad

Relevant issues

Since the data can potentially contain PII/PCI information for enterprise usecases, the recommendation from infosec is for contents of message to be application encrypted.

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• I have added a screenshot of my new test passing locally
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

🆕 New Feature

Changes

[vercel]

Someone is attempting to deploy a commit to the CLERKIEAI Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

deepanshu seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[ishaan-jaff]

small request

@deepanshululla any latency concern with adding this ? do we know how much cpu% this encryption takes up

[deepanshululla]

@deepanshululla any latency concern with adding this ? do we know how much cpu% this encryption takes up

I didn't do exhaustive testing and I guess it depends on the size of payload. we can do exhaustive load testing and get back but for now we need to get the infosec escalation resolved.
This is disabled by default so unless folks exclusively specify it, it doesn't get enabled by default.

thanks.

[ishaan-jaff]

LGTM