fix(bedrock-mantle): use correct SigV4 signing service name

[sanyamk23]

Summary

The bedrock-mantle endpoint requires SigV4 signing with service_name="bedrock-mantle", not "bedrock". Using the wrong service name causes IAM permission errors because AWS evaluates the request against the bedrock service namespace instead of bedrock-mantle.

Changes (2 files)

• litellm/llms/bedrock_mantle/common_utils.py: Changed service_name="bedrock" → service_name="bedrock-mantle" in the standalone Mantle provider's sign_request
• litellm/llms/bedrock/chat/mantle/transformation.py: Added sign_request override to AmazonMantleConfig that uses service_name="bedrock-mantle", preventing the base class from signing with the wrong service name

base_invoke_transformation.py is unchanged — it serves regular Bedrock requests that correctly use service_name="bedrock".

Evidence

• AWS managed policy AmazonBedrockMantleInferenceAccess uses bedrock-mantle:* actions
• CloudTrail shows event source as bedrock-mantle.amazonaws.com
• AmazonBedrockMantleFullAccess managed policy uses bedrock-mantle:*

Testing

• Verified bedrock_mantle/common_utils.py signs with service_name="bedrock-mantle"
• Verified AmazonMantleConfig overrides sign_request with correct service name
• Verified base_invoke_transformation.py unchanged (regular Bedrock still uses "bedrock")

Fixes #31475
Fixes #31113
Fixes #31196

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Greptile Summary

This PR fixes SigV4 signing for the bedrock-mantle endpoint by correcting the service_name from "bedrock" to "bedrock-mantle" in both provider paths, preventing IAM permission errors caused by the wrong credential scope.

• bedrock_mantle/common_utils.py: Fixes the service_name in BedrockMantleAuthMixin.sign_request; the module-level docstring still mentions the old "bedrock" service name and should be updated.
• bedrock/chat/mantle/transformation.py: Adds a sign_request override on AmazonMantleConfig that passes service_name="bedrock-mantle", correctly shadowing the inherited "bedrock" value from BaseInvokeTransformation.

Confidence Score: 4/5

Safe to merge — the two-line service name fix is well-scoped and the regular Bedrock path is unchanged.

Both changed files make targeted, correct fixes: the wrong "bedrock" service name is replaced with "bedrock-mantle" in exactly the two places that handle Mantle signing. The only leftover is a stale module docstring in common_utils.py that still documents the old service name, which could mislead future contributors but does not affect runtime behavior.

The module-level docstring in litellm/llms/bedrock_mantle/common_utils.py still references service "bedrock" and should be updated to "bedrock-mantle" to match the fixed code.

Important Files Changed

Filename	Overview
litellm/llms/bedrock_mantle/common_utils.py	Fixes service_name from "bedrock" to "bedrock-mantle" in BedrockMantleAuthMixin.sign_request; module-level docstring still references the old "bedrock" service name and needs updating.
litellm/llms/bedrock/chat/mantle/transformation.py	Adds a sign_request override on AmazonMantleConfig that correctly delegates to _sign_request with service_name="bedrock-mantle", preventing the inherited "bedrock" service name from being used.

Comments Outside Diff (1)

1. litellm/llms/bedrock_mantle/common_utils.py, line 3-8 (link)

   The module-level docstring still describes the SigV4 fallback as using service "bedrock", which was exactly the bug this PR fixes. A reader following the doc will be misled about what signing service is used.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

_{Reviews (1): Last reviewed commit: "fix(bedrock-mantle): use correct SigV4 s..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sanyamk23]

.

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing sanyamk23:fix/bedrock-mantle-v2 (bc3688e) with litellm_internal_staging (956d517)}

[shivamrawat1]

Thanks for the PR, but the premise here was already tested and refuted in #31476. @6matt ran the live matrix there with real IAM credentials and no bearer token, and @laiweihwa repeated it with a role holding only AmazonBedrockMantleInferenceAccess (bedrock-mantle:* actions, nothing else): signing with service="bedrock" returns HTTP 200 real completions, same as service="bedrock-mantle". Only unrecognized names like mantle get the 401. So the current signing is not broken, and the credential-scope check is an app-layer name check rather than an IAM action evaluation, which is why the IAM policy and CloudTrail naming don't imply a signing failure

The actual root cause of #31113 and #31196 was an unsigned request (the no-op sign_request), fixed in #30714. This PR therefore doesn't fix #31475, #31113, or #31196

The remaining value here is the cosmetic alignment to the canonical bedrock-mantle signing name, and #31476 already covers that with the verification evidence attached, so I'm closing this one as a duplicate. Happy to have your review over there instead