fix(proxy): resolve os.environ/ refs for all AWS auth params in DB-sourced models

[yucheng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

The customer reported that after upgrading from 1.89.1 to 1.91.0, a model stored in the DB with aws_role_name: os.environ/BEDROCK_ASSUME_ROLE_ARN stopped working. STS returns ValidationError: os.environ/BEDROCK_ASSUME_ROLE_ARN is invalid because the literal string reaches AssumeRole instead of the resolved ARN.

The proof-of-fix curls a proxy connected to a real Postgres, with a DB row shaped like the customer's:

model_id        | bedrock-repro-1
model_name      | bedrock-claude
litellm_params  | {"model": "bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
                   "aws_role_name": "os.environ/BEDROCK_ASSUME_ROLE_ARN",
                   "aws_region_name": "us-east-1"}
BEDROCK_ASSUME_ROLE_ARN=arn:aws:iam::111111111111:role/some-bedrock-role

Before (unfixed 1.91.x): the router receives the literal os.environ/... string and forwards it to STS

$ curl -sS http://localhost:4000/model/info -H 'Authorization: Bearer sk-1234' | jq '.data[] | select(.model_name=="bedrock-claude") | .litellm_params'
{
  "aws_region_name": "us-east-1",
  "model": "bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
  "aws_role_name": "os.environ/BEDROCK_ASSUME_ROLE_ARN"
}

$ curl -sS -w "\nHTTP=%{http_code}\n" http://localhost:4000/v1/chat/completions \
    -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
    -d '{"model":"bedrock-claude","messages":[{"role":"user","content":"hi"}]}'

The traceback shows _auth_with_aws_role was called with the literal string as RoleArn, so sts_client.assume_role(RoleArn="os.environ/BEDROCK_ASSUME_ROLE_ARN", ...) fires and STS rejects it. In this repro the fake AWS creds trip InvalidClientTokenId first, but the customer's real AWS creds get past that check and hit the exact ValidationError: ... is invalid they reported

After (with this PR): the router receives the resolved ARN, and STS receives a well-formed value

$ curl -sS http://localhost:4000/model/info -H 'Authorization: Bearer sk-1234' | jq '.data[] | select(.model_name=="bedrock-claude") | .litellm_params'
{
  "aws_region_name": "us-east-1",
  "model": "bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
  "aws_role_name": "arn:aws:iam::111111111111:role/some-bedrock-role"
}

LIT-3831 stays closed: an attacker sending aws_role_name: os.environ/DATABASE_URL in the HTTP request body is still refused by the existing _BANNED_REQUEST_BODY_PARAMS gate

$ curl -sS -w "\nHTTP=%{http_code}\n" http://localhost:4000/v1/chat/completions \
    -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
    -d '{"model":"bedrock-claude","messages":[{"role":"user","content":"hi"}],"aws_role_name":"os.environ/DATABASE_URL"}'
{"error":{"message":"Authentication Error, Rejected Request: aws_role_name is not allowed in request body. ..."}}
HTTP=401

Team-scoped DB models still get resolve_env_refs=False, matching the LIT-3831 defense-in-depth contract for the team-scoped DB path (see the regression test test_ProxyConfig__add_deployment_keeps_team_aws_env_refs_literal)

Type

🐛 Bug Fix

Changes

Root cause: PR #30867 (LIT-3831) removed the per-request os.environ/ expansion inside BaseAWSLLM.get_credentials. That is only safe if the config-load path pre-resolves os.environ/ refs, so the value reaching get_credentials is already the real secret. The YAML config path has always done this. The DB-load path (ProxyConfig._resolve_db_litellm_param in litellm/proxy/proxy_server.py) only re-expands keys in _DB_LITELLM_PARAM_ENV_REF_KEYS, which covered api_key, client_secret, vertex_credentials, vertex_ai_credentials, aws_access_key_id, and aws_secret_access_key, but none of the other AWS auth fields. A model row like aws_role_name: os.environ/BEDROCK_ASSUME_ROLE_ARN lands on the router with the literal string, get_credentials no longer expands it, and STS rejects the AssumeRole call

Fix: extend _DB_LITELLM_PARAM_ENV_REF_KEYS to cover the remaining nine AWS auth params (aws_session_token, aws_region_name, aws_session_name, aws_profile_name, aws_role_name, aws_web_identity_token, aws_sts_endpoint, aws_external_id, aws_bedrock_runtime_endpoint). Now os.environ/ refs resolve at DB-load time (trusted, server-owned), matching the YAML-config code path. Team-scoped DB rows still get resolve_env_refs=False, so the LIT-3831 team-scoped defense-in-depth path is unchanged and the request-body attack surface stays gated by _BANNED_REQUEST_BODY_PARAMS

Regression tests in tests/test_litellm/proxy/proxy_server/test_proxy_config.py:

• test_ProxyConfig__add_deployment_resolves_env_refs_for_aws_bedrock_auth_params pins every added field as an os.environ/… DB value and asserts each resolves on the router (mutation-checked; fails on unfixed code with the exact "literal string not resolved" symptom)
• test_ProxyConfig__add_deployment_keeps_team_aws_env_refs_literal pins that team-scoped DB rows do NOT resolve aws_role_name, guarding the LIT-3831 team path

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

yucheng seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[yucheng-berri]

@greptileai

[greptile-apps]

Greptile Summary

This PR fixes a bug where DB-stored AWS auth parameters containing os.environ/ references (e.g. aws_role_name: os.environ/BEDROCK_ASSUME_ROLE_ARN) were not resolved at load time, causing the literal string to reach AWS STS and fail validation. The fix extends _DB_LITELLM_PARAM_ENV_REF_KEYS to cover all remaining AWS auth params, bringing DB-load behavior in line with the YAML-config code path.

• proxy_server.py: 12 AWS auth fields added to _DB_LITELLM_PARAM_ENV_REF_KEYS; _resolve_db_litellm_param already guards on decrypted_value.startswith(\"os.environ/\") so literal values like \"us-east-1\" are unaffected.
• Tests: Two new mock-only regression tests cover both the happy path (env refs resolved for global DB models) and the defense-in-depth path (team-scoped DB models leave refs literal).

Confidence Score: 5/5

Safe to merge — additive, narrow change to the DB model loading path with preserved team-scope bypass.

The fix restores load-time resolution of AWS auth env refs in DB-stored models, matching YAML config behavior. LiteLLM_Params uses extra=allow so all new keys are preserved. Team-scoped bypass remains intact and is tested.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/proxy_server.py	Extends _DB_LITELLM_PARAM_ENV_REF_KEYS with 12 additional AWS auth params; team-scoped model path is unchanged.
tests/test_litellm/proxy/proxy_server/test_proxy_config.py	Adds two targeted mock-only regression tests covering env-ref resolution and team-scoped bypass.

_{Reviews (3): Last reviewed commit: "fix(proxy): also allow os.environ/ resol..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR fixes a regression where DB-stored models with os.environ/ references in AWS auth parameters (e.g. aws_role_name, aws_session_name, aws_sts_endpoint) received unresolved literal strings instead of actual values, because _DB_LITELLM_PARAM_ENV_REF_KEYS only covered aws_access_key_id and aws_secret_access_key.

• proxy_server.py: Extends _DB_LITELLM_PARAM_ENV_REF_KEYS with the nine missing AWS auth params (aws_session_token, aws_region_name, aws_session_name, aws_profile_name, aws_role_name, aws_web_identity_token, aws_sts_endpoint, aws_external_id, aws_bedrock_runtime_endpoint) — all confirmed as valid fields passed through to BaseAWSLLM.get_credentials.
• test_proxy_config.py: Adds two targeted regression tests — one verifying that all nine new params resolve for global DB models, and one verifying that team-scoped DB models continue to receive unresolved os.environ/ strings, preserving the existing defense-in-depth boundary.

Confidence Score: 5/5

Safe to merge — minimal, surgical change with comprehensive regression tests covering both the fix and the security boundary it must not cross.

The change is a single frozenset extension in proxy_server.py. Every added key is confirmed to flow directly into BaseAWSLLM.get_credentials or its callers (verified in base_aws_llm.py, converse_handler.py, batches/handler.py). The resolve_env_refs=False guard for team-scoped models is untouched and is explicitly tested by the new regression test. No existing tests are modified, and all new tests use mocks with no real network calls.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/proxy_server.py	Extends _DB_LITELLM_PARAM_ENV_REF_KEYS with 9 missing AWS auth params so DB-stored os.environ/ refs resolve at load time, matching the YAML-config path
tests/test_litellm/proxy/proxy_server/test_proxy_config.py	Adds two regression tests: one pins that all 9 new AWS params resolve for global DB models, one pins that team-scoped DB models leave os.environ/ refs literal

_{Reviews (2): Last reviewed commit: "fix(proxy): resolve os.environ/ refs for..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yucheng-berri]

@greptileai