fix(router): keep bedrock batch litellm_params through credential resolution

[devin-ai-integration]

TLDR

Problem this solves:

• Model-routed /v1/batches dropped aws_batch_role_arn
• Bedrock batch create failed despite config being set

How it solves it:

• Declare the batch/S3 params on CredentialLiteLLMParams
• Regression test pins them through router credential resolution

Relevant issues

Linear ticket

Resolves LIT-4781

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Config used for both runs (lit4781_config.yaml):

model_list:
  - model_name: bedrock-batch
    litellm_params:
      model: bedrock/anthropic.claude-3-5-sonnet-20240620-v1:0
      aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
      aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
      aws_region_name: us-east-1
      s3_bucket_name: litellm-batch-input-repro
      s3_output_bucket_name: litellm-batch-output-repro
      s3_region_name: us-east-1
      aws_batch_role_arn: arn:aws:iam::REDACTED:role/BedrockBatchInferenceRole
    model_info:
      mode: batch
general_settings:
  master_key: sk-1234

Both runs start the proxy with

python litellm/proxy/proxy_cli.py --config lit4781_config.yaml --detailed_debug 2>&1 | tee litellm.log

and then issue the same request

curl -sS -X POST http://localhost:4000/v1/batches \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"model":"bedrock-batch","input_file_id":"s3://litellm-batch-input-repro/litellm-batch-inputs/test.jsonl","endpoint":"/v1/chat/completions","completion_window":"24h"}'

Before, at 8177230a29 (staging HEAD); the role ARN set in litellm_params never reaches the Bedrock transformation:

{
    "error": {
        "message": "AWS IAM role ARN is required for Bedrock batch jobs. Set 'aws_batch_role_arn' in litellm_params or AWS_BATCH_ROLE_ARN env var",
        "type": "internal_server_error",
        "param": "None",
        "code": "500"
    }
}

After, at 8c5f96e940; the request is now signed and sent to Bedrock's CreateModelInvocationJob, and the response is AWS rejecting the model id, which is expected since the repro account only has plain Bedrock invoke access and the buckets/role are placeholders:

{
    "error": {
        "message": "{\"message\":\"The provided model identifier is invalid.\"}",
        "type": "internal_server_error",
        "param": "None",
        "code": "400"
    }
}

The error moving from LiteLLM's own pre-flight check to an AWS API response is the proof that the params now survive credential resolution.

Type

🐛 Bug Fix

Changes

Router.get_deployment_credentials_with_provider() round-trips a deployment's litellm_params through CredentialLiteLLMParams, which acts as an allowlist: anything not declared as a field is dropped by model_dump(exclude_none=True). s3_bucket_name was added in #30745 to fix the /v1/files upload, but the batch-side keys were never declared, so model-routed /v1/batches lost them.

 class CredentialLiteLLMParams(BaseModel):
     ...
     s3_bucket_name: Optional[str] = None
+    s3_output_bucket_name: Optional[str] = None
+    s3_region_name: Optional[str] = None
+    s3_encryption_key_id: Optional[str] = None
+    aws_batch_role_arn: Optional[str] = None
+    bedrock_tags: Optional[List[Dict[str, str]]] = None

aws_batch_role_arn and s3_output_bucket_name were fatal at batch create; s3_region_name degraded silently to the model-derived region, and s3_encryption_key_id / bedrock_tags were ignored. bedrock_tags is typed as a list of {"key": ..., "value": ...} dicts to match what _validate_bedrock_tags in the Bedrock batch transformation accepts.

The new test in tests/test_litellm/test_router.py asserts all five keys survive get_deployment_credentials_with_provider(); it fails on staging HEAD and passes here. ui/litellm-dashboard/src/lib/http/schema.d.ts is regenerated via npm run gen:api since the new fields show up in the proxy OpenAPI spec.

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/77e1f69362a64e55be1917ccf0a33c35
Requested by: @shivamrawat1

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR preserves Bedrock batch and S3 parameters during router credential resolution.

• Adds five previously omitted parameters to CredentialLiteLLMParams.
• Adds a hermetic regression test confirming that all relevant parameters survive credential filtering.

Confidence Score: 5/5

The PR appears safe to merge, with the changed allowlist fields matching downstream contracts and the original credential-dropping regression covered by a focused test.

The router now retains the Bedrock batch and S3 configuration consumed by existing batch handling, while the test directly verifies the credential-filtering boundary that previously discarded those values.

Important Files Changed

Filename	Overview
litellm/types/router.py	Extends the credential-resolution allowlist with types matching the downstream Bedrock batch parameter contracts.
tests/test_litellm/test_router.py	Adds focused regression coverage for all newly preserved parameters without network access or global-state mutation.

_{Reviews (1): Last reviewed commit: "fix(router): keep bedrock batch litellm_..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_lit_4781_bedrock_batch_credential_params (b4d2ba6) with litellm_internal_staging (8177230)}