fix: _filter_headers_for_aws_signature - Bedrock KB

[ishaan-jaff]

fix: _filter_headers_for_aws_signature - Bedrock KB

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🐛 Bug Fix
✅ Test

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Mar 13, 2026 5:50pm

[greptile-apps]

Greptile Summary

This PR fixes a crash in the Bedrock Knowledge Base (KB) request path where botocore's SigV4Auth threw AttributeError: 'NoneType' object has no attribute 'split' because headers with None values (e.g. x-amzn-bedrock-kb-session-id) were passed directly into the signing process or merged back into the final headers dict.

Key changes:

• _filter_headers_for_aws_signature: Added if header_value is None: continue to prevent None-valued headers from reaching SigV4Auth.
• First signing code path (~line 1271): Added if header_value is not None guard when setting headers back on the AWSRequest object after signing.
• _sign_request (~line 1399): Added if header_value is not None guard when merging original headers back into the returned dict.
• Two new unit tests added (test_filter_headers_skips_none_values and test_sign_request_with_none_header_values) — both are purely mock-based with no real network calls.

Note: The PR description still shows placeholder text (Fixes #000) and all pre-submission checklist items are unchecked. Providing a link to the original issue and CI run results would help confirm the fix is working as intended.

Confidence Score: 4/5

• Safe to merge — the fix is correct, consistent, and targeted, with only a minor test coverage gap.
• The None-value guards are applied correctly in all three header-merging locations and the root cause (botocore SigV4Auth receiving None header values) is properly addressed. Two focused mock-only tests are included. The slight coverage gap is that the fix in get_request_headers (~line 1271) is not directly tested by the new tests, and the PR description still contains placeholder text ("Fixes #000") rather than referencing the actual issue.
• No files require special attention — all changes are minimal and well-scoped.

Important Files Changed

Filename	Overview
litellm/llms/bedrock/base_aws_llm.py	Adds None-value guards in three header-merging locations so that headers with None values are never passed to botocore's SigV4Auth or returned to callers — correctly fixing the NoneType has no attribute 'split' crash for Bedrock KB.
tests/test_litellm/llms/bedrock/test_base_aws_llm.py	Adds two focused unit tests: one for _filter_headers_for_aws_signature and one end-to-end for _sign_request. Both tests are mock-only (no real network calls). The end-to-end test does not exercise the separate first signing code path (around line 1271) that was also patched.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming request headers] --> B{header_value is None?}
    B -- Yes --> C[Skip / continue]
    B -- No --> D{Is it an AWS-relevant header?\nhost, content-type, x-amz-*, x-amzn-*}
    D -- No --> E[Exclude from SigV4 headers]
    D -- Yes --> F[Include in aws_signature_headers]
    F --> G[AWSRequest + SigV4Auth.add_auth]
    G --> H[Signed request headers dict]
    H --> I[Merge back original headers]
    I --> J{header_value is None?}
    J -- Yes --> K[Skip / do not add to final dict]
    J -- No --> L[Add to final headers dict]
    L --> M[Return headers + body]

Loading

Comments Outside Diff (1)

1. tests/test_litellm/llms/bedrock/test_base_aws_llm.py, line 1552-1597 (link)

   Missing coverage for get_request_headers None-value guard

   The PR patches three locations, but the new end-to-end test only exercises _sign_request. The identical post-signing header merge-back guard added to get_request_headers (around base_aws_llm.py:1270-1272) is not covered by any new test.

   Consider adding a parallel test for get_request_headers with None-valued headers (e.g. x-amzn-bedrock-kb-session-id: None) to ensure the fix there is also regression-protected. For example:

   def test_get_request_headers_skips_none_header_values():
       llm = BaseAWSLLM()
       mock_credentials = Credentials("test_key", "test_secret")
       headers_with_nones = {
           "Content-Type": "application/json",
           "x-amzn-bedrock-kb-session-id": None,
       }
       prepped = llm.get_request_headers(
           credentials=mock_credentials,
           aws_region_name="us-gov-west-1",
           extra_headers=None,
           endpoint_url="https://bedrock-agent-runtime.us-gov-west-1.amazonaws.com/knowledgebases/KB123/retrieve",
           data=b'{"test": "body"}',
           headers=headers_with_nones,
       )
       for key, value in prepped.headers.items():
           assert value is not None, f"Header '{key}' must not be None"

_{Last reviewed commit: ac4d982}

[ishaan-jaff]

@greptile review again