Revert Bedrock CI back to the reactivated AWS account (888602223428)

[mateo-berri]

Relevant issues

Reverts the Bedrock CI account migration in #28728.

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

The change is a code-side revert of resource identifiers; the live proof is the CI Bedrock jobs going green once the CircleCI credentials are repointed (see the action item below). The verification done locally is the structural side: the mock-based AgentCore transformation tests and the reasoning-effort grid both pass against the reverted ARNs and grid_spec.

$ python -m pytest tests/test_litellm/llms/bedrock/chat/agentcore/test_agentcore_transformation.py -q
20 passed in 0.32s

$ python -m pytest tests/llm_translation/reasoning_effort_grid/test_reasoning_effort_grid.py -q
46 passed, 187 skipped in 116.90s

(The 187 skips are the live grid cells that skip when AWS creds are absent in the dev container.)

Type

🧹 Refactoring
✅ Test

Changes

#28728 migrated every Bedrock-touching CI resource from account 888602223428 to a fresh account (941277531214) after the original account was put under an AWS security restriction following a leaked key. That account has since been reactivated, and the replacement account never gained access to several models the suites exercise (legacy Bedrock Claude 3 models, Cohere, Nova Canvas image generation, Bedrock batch inference, and flagship Opus). This PR is the exact inverse of #28728 so CI points back at the reactivated account and regains that coverage.

Concretely, all hardcoded 941277531214 references revert to 888602223428 (provisioned- and imported-model ARNs, AgentCore runtime ARNs including their regenerated suffixes, the batch execution role ARN, and the example proxy config). The S3 buckets revert to litellm-proxy and load-testing-oct; the guardrail IDs revert to wf0hkdb5x07f and ff6ujrregl1q; the SageMaker endpoint and Bedrock Knowledge Base revert to their original ids; and the live-call tests go back to the legacy model strings. The fail_reason/xfail workaround that #28728 added for the unentitled Opus grid cells is dropped, while the unrelated bedrock_effort_ceiling field added to grid_spec.py after the migration is preserved.

One thing this PR cannot do on its own: the CircleCI AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY project env vars still hold the 941277531214 credentials and must be set to the reactivated account's fresh credentials separately via the CircleCI API. AWS_REGION_NAME stays us-west-2. Until those are repointed, the live Bedrock CI jobs will still run against the new account.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This PR reverts the Bedrock CI account migration from #28728, pointing all hardcoded resource identifiers (provisioned-model ARNs, AgentCore runtime ARNs, S3 buckets, guardrail IDs, Knowledge Base IDs, SageMaker endpoint, batch role ARN) back from account 941277531214 to the reactivated account 888602223428. Live-call tests that were mocked on the new account (because it lacked legacy Claude 3, Cohere, Nova Canvas, batch inference, and Opus entitlements) are restored to use real model strings.

• Resource identifier revert — all 23 changed files are mechanical find-and-replace of the account ID, derived S3 bucket names, and resource IDs; no logic changes in production code.
• Test de-mocking — test_amazon_titan_image_gen is converted from a fully-mocked HTTP call back to a live API call, and the mocked test_basic_image_generation overrides for both Nova Canvas classes are removed. The earlier mocked versions carried explicit cost-tracking and response-shape assertions that are no longer present.
• xfail cleanup — the fail_reason workaround for claude-opus-4-7 (inaccessible on 941277531214) is removed; those grid cells will now run live and fail hard if entitlement is unexpectedly absent on 888602223428.

Confidence Score: 4/5

Safe to merge for the code-side revert; the CircleCI credentials must be separately repointed before live Bedrock CI jobs will use the reactivated account.

The production-code changes are comment-only. All other changes are test resource identifiers and model strings — a well-scoped mechanical revert. The two image-generation test files lose explicit cost-tracking and response-shape assertions that were added specifically to cover the mocked path; if the logging callback pipeline regresses for Bedrock image providers, these test files will no longer catch it. The xfail removal for claude-opus-4-7 assumes 888602223428 already has access; if that assumption is wrong the grid cell becomes a hard failure rather than a marked expected failure.

tests/image_gen_tests/test_bedrock_image_gen_unit_tests.py and tests/image_gen_tests/test_image_generation.py — both lost explicit cost-tracking and response-shape assertions when mock wrappers were removed.

Important Files Changed

Filename	Overview
litellm/llms/bedrock/chat/agentcore/transformation.py	Docstring examples updated to the reverted account ID (888602223428) and regenerated runtime suffix — no logic changes.
tests/image_gen_tests/test_bedrock_image_gen_unit_tests.py	test_amazon_titan_image_gen converted from a fully-mocked test to a live API call; drops shape assertions and requires live AWS entitlement for titan-image-generator-v2.
tests/image_gen_tests/test_image_generation.py	Removes _assert_mocked_bedrock_image_generation helper and the test_basic_image_generation overrides for both Nova Canvas classes, dropping cost-tracking and response-shape assertions.
tests/llm_translation/reasoning_effort_grid/grid_spec.py	fail_reason field removed from ModelEntry dataclass and the xfail entry for claude-opus-4-7 dropped; tests for that model will now run live and fail if entitlement is absent.
tests/llm_translation/test_bedrock_agentcore.py	All AgentCore runtime ARNs reverted to 888602223428 with regenerated suffixes; mock tests unaffected by the account change.
tests/local_testing/test_sagemaker.py	SageMaker endpoint name reverted consistently across all live and mocked tests.
tests/logging_callback_tests/test_bedrock_knowledgebase_hook.py	Knowledge base vector_store_id reverted to T37J8R4WTM consistently across all test cases.
tests/guardrails_tests/test_bedrock_guardrails.py	Guardrail IDs reverted from zgkmukebruil/4w3d1di3snt5 to wf0hkdb5x07f/ff6ujrregl1q across all six test functions.

Comments Outside Diff (1)

1. tests/image_gen_tests/test_bedrock_image_gen_unit_tests.py, line 207-243 (link)

   Mock removed — test now requires live AWS credentials

   test_amazon_titan_image_gen was previously mocked end-to-end (patch.object(client, "post", ...) with a fake 200 response) and explicitly checked response._hidden_params["response_cost"]. The replacement calls litellm.image_generation with no mock and no skip guard. If AWS creds are absent in the test environment the test hard-fails instead of skipping, and the cost-tracking assertion is still present but the response-data shape is no longer verified. If the reactivated account does not have amazon.titan-image-generator-v2:0 entitlement this test will surface a live API error rather than a clear skip message.

_{Reviews (1): Last reviewed commit: "Revert "chore(tests): migrate Bedrock CI..." | Re-trigger Greptile}

[greptile-apps]

Explicit cost-tracking assertions dropped for Nova Canvas classes

The removed _assert_mocked_bedrock_image_generation helper carried four assertions beyond what BaseImageGenTest.test_basic_image_generation typically verifies: that standard_logging_payload was populated, that response_cost > 0, that response.data is non-empty, and that each item is an Image with b64_json or url set. TestBedrockNovaCanvasTextToImage and TestBedrockNovaCanvasColorGuidedGeneration now inherit the base test which does not exercise those logging/cost paths. If the cost-tracking callback pipeline regresses for Bedrock image providers, this test file will no longer catch it.

Rule Used: What: Flag any modifications to existing tests and... (source)

[mateo-berri]

This is a false positive. The four assertions are not dropped; BaseImageGenTest.test_basic_image_generation (tests/image_gen_tests/base_image_generation_test.py lines 69-86) already wires up the same TestCustomLogger callback and asserts standard_logging_payload is not None, standard_logging_payload["response_cost"] is not None, response_cost > 0, and then iterates response.data asserting each item isinstance(d, Image) with d.b64_json is not None or d.url is not None. So the cost-tracking, logging-callback, and response-shape coverage is identical to what the removed _assert_mocked_bedrock_image_generation helper checked. The only behavioral difference is mocked versus live.

This PR is a faithful revert of #28728; tests/image_gen_tests/test_image_generation.py is byte-identical to its pre-#28728 state. The mocked override only existed because the interim account 941277531214 lacked Nova Canvas entitlement. Account 888602223428 has been reactivated and does have that entitlement, so restoring the inherited live base test is the intended behavior and keeps the same assertions running against a real Bedrock response.