litellm - 💡(How to fix) Fix Discontinuing AWS CI Access [1 comments, 1 participants]

litellm2026-03-11 21:03:00

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

BerriAI/litellm#23383•Fetched 2026-04-08 00:37:06

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Manouchehri

Participants

Manouchehri

Timeline (top)

cross-referenced ×2commented ×1labeled ×1mentioned ×1

Code Example

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-3-haiku-20240307-v1:0",
                "arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-3-haiku-20240307-v1:0",
                "arn:aws:bedrock:*:*:inference-profile/eu.anthropic.claude-3-haiku-20240307-v1:0",
                "arn:aws:bedrock:*::foundation-model/cohere.command-r-v1:0"
            ]
        }
    ]
}

---

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::AWS_ACCOUNT_ID_HERE_PLZ:oidc-provider/oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd:aud": "c5a99188-154f-4f69-8da2-b442b1bf78dd"
                },
                "ForAnyValue:StringLike": {
                    "oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd:sub": [
                        "org/c5a99188-154f-4f69-8da2-b442b1bf78dd/project/*/user/*/vcs-origin/github.com/BerriAI/litellm/vcs-ref/refs/heads/main",
                        "org/c5a99188-154f-4f69-8da2-b442b1bf78dd/project/*/user/*/vcs-origin/github.com/BerriAI/litellm/vcs-ref/refs/heads/litellm_*"
                    ]
                }
            }
        }
    ]
}

---

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::AWS_ACCOUNT_ID_HERE_PLZ:oidc-provider/oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd:aud": "c5a99188-154f-4f69-8da2-b442b1bf78dd"
                }
            }
        }
    ]
}

RAW_BUFFERClick to expand / collapse

Hi,

I haven't been using LiteLLM much in the past year or so. I previously had been providing CI/CD access to my company's AWS account, but as we're no longer involved with the project, it is a security burden for me to make sure the scopes are correctly set and isn't being abused.

These creds were only meant to be provided temporarily, but it's been 2 years.

litellm-github-unit-tests-circleci-v1-assume-only and litellm-github-unit-tests-circleci have been deleted.

`litellm-github-unit-tests-circleci`

Permissions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-3-haiku-20240307-v1:0",
                "arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-3-haiku-20240307-v1:0",
                "arn:aws:bedrock:*:*:inference-profile/eu.anthropic.claude-3-haiku-20240307-v1:0",
                "arn:aws:bedrock:*::foundation-model/cohere.command-r-v1:0"
            ]
        }
    ]
}

Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::AWS_ACCOUNT_ID_HERE_PLZ:oidc-provider/oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd:aud": "c5a99188-154f-4f69-8da2-b442b1bf78dd"
                },
                "ForAnyValue:StringLike": {
                    "oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd:sub": [
                        "org/c5a99188-154f-4f69-8da2-b442b1bf78dd/project/*/user/*/vcs-origin/github.com/BerriAI/litellm/vcs-ref/refs/heads/main",
                        "org/c5a99188-154f-4f69-8da2-b442b1bf78dd/project/*/user/*/vcs-origin/github.com/BerriAI/litellm/vcs-ref/refs/heads/litellm_*"
                    ]
                }
            }
        }
    ]
}

`litellm-github-unit-tests-circleci-v1-assume-only`

Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::AWS_ACCOUNT_ID_HERE_PLZ:oidc-provider/oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd:aud": "c5a99188-154f-4f69-8da2-b442b1bf78dd"
                }
            }
        }
    ]
}

No permissions needed for this one.

extent analysis

Fix Plan

To fix the security burden, we need to delete the existing IAM roles and update the CircleCI configuration.

Step 1: Delete IAM Roles

Delete the litellm-github-unit-tests-circleci and litellm-github-unit-tests-circleci-v1-assume-only IAM roles.

Step 2: Update CircleCI Configuration

Update the CircleCI configuration to remove the references to the deleted IAM roles.

# Remove the following lines from your CircleCI configuration file
version: 2.1
jobs:
  deploy:
    # ...
    steps:
      - setup_remote_docker:
          version: 20.10.7
          docker_layer_caching: true
          environment:
            # Remove the following environment variables
            AWS_ROLE_ARN: arn:aws:iam::AWS_ACCOUNT_ID_HERE_PLZ:role/litellm-github-unit-tests-circleci
            AWS_ACCOUNT_ID: AWS_ACCOUNT_ID_HERE_PLZ

Step 3: Remove OIDC Provider

Remove the OIDC provider configuration for CircleCI.

aws iam delete-open-id-connect-provider --open-id-connect-provider-arn arn:aws:iam::AWS_ACCOUNT_ID_HERE_PLZ:oidc-provider/oidc.circleci.com/org/c5a99188-154f-4f69-8da2-b442b1bf78dd

Verification

Verify that the IAM roles and OIDC provider have been deleted successfully.

aws iam get-role --role-name litellm-github-unit-tests-circleci
aws iam get-role --role-name litellm-github-unit-tests-circleci-v1-assume-only
aws iam list-open-id-connect-providers

Extra Tips

Make sure to update your CircleCI configuration to use a different authentication method, such as AWS access keys or a different IAM role. Also, review your AWS account's security settings to ensure that there are no other unused or outdated configurations.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #ssr #installation #tensor shape #autograd error #search optimization #API routing #API middleware #SSR setup #ISR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

litellm - 💡(How to fix) Fix Discontinuing AWS CI Access [1 comments, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Code Example

`litellm-github-unit-tests-circleci`

Permissions

Trust Policy

`litellm-github-unit-tests-circleci-v1-assume-only`

Trust Policy

extent analysis

Fix Plan

Step 1: Delete IAM Roles

Step 2: Update CircleCI Configuration

Step 3: Remove OIDC Provider

Verification

Extra Tips

Still need to ship something?

TRENDING

litellm - 💡(How to fix) Fix Discontinuing AWS CI Access [1 comments, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Code Example

litellm-github-unit-tests-circleci

Permissions

Trust Policy

litellm-github-unit-tests-circleci-v1-assume-only

Trust Policy

extent analysis

Fix Plan

Step 1: Delete IAM Roles

Step 2: Update CircleCI Configuration

Step 3: Remove OIDC Provider

Verification

Extra Tips

Still need to ship something?

RELATED_DISCOVERY

TRENDING

`litellm-github-unit-tests-circleci`

`litellm-github-unit-tests-circleci-v1-assume-only`