uPjYdZddlZddlZddlmZmZddlZddlZddlm Z ddl m Z ddl m Z ddlmZmZddlmZdd lmZdd lmZdd lmZd d lmZGdde eZy)ao This is a file for the AWS Secret Manager Integration Handles Async Operations for: - Read Secret - Write Secret (CreateSecret) - Update Secret (PutSecretValue) - for in-place rotation when alias is preserved - Delete Secret Relevant issue: https://github.com/BerriAI/litellm/issues/1883 Requires: * `os.environ["AWS_REGION_NAME"], * `pip install boto3>=1.28.57` N)AnyFinal)verbose_logger)get_aws_dns_suffix) BaseAWSLLM)_get_httpx_clientget_async_httpx_client)KeyManagementSystem)get_secret_str)httpxSpecialProvider)KeyManagementSettings)BaseSecretManagerceZdZ d)dedzdedzdedzdedzdedzdedzdedzd eedzfd Zed Ze d*d edzd e dzfdZ d+dede dzde e jzdzdedzdedzf dZ d+dede dzde e jzdzdedzdedzf dZdedzde fdZdedededzfdZdedededzfdZ d,dedededzde dzde e jzdzde ezdzde fdZ d-ded eede eefdzde e jzdzde eeff dZ d-dedede dzde e jzdzde f dZ d-d ed!ed"ede dzde e jzdzde f fd# Z d.ded$edzde dzde e jzdzde f d%Z d+d&edededzde dzd'e dzdeeeeff d(ZxZS)/AWSSecretsManagerV2Naws_region_name aws_role_nameaws_session_nameaws_external_idaws_profile_nameaws_web_identity_tokenaws_sts_endpointreplica_regionsc  tj|fi| tj|fi| ||_||_||_||_||_||_||_ |xsg|_ yN) r__init__rrrrrrrrr) selfrrrrrrrrkwargss r/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/secret_managers/aws_secret_manager_v2.pyrzAWSSecretsManagerV2.__init__(sq ""4262D+F+ /* 0. 0&<# 0*9*?Rcdtjvr'N'N  0:/?/?/AStq!Q]adS S,/,=*,=G )-@-S-SG *T  G s0B C CC"-CC C&C!!C& secret_nameoptional_paramstimeoutprimary_secret_namereturncK|r|j||d{S|jd||\}}}ttjd|i} |j |||j dd{} | j| jd S77)#tj$r td t$r*} tjd |t| Yd} ~ yd} ~ wwxYww) z Async function to read a secret from AWS Secrets Manager Returns: str: Secret value Raises: ValueError: If the secret is not found or an HTTP error occurs r:r=NGetSecretValueactionr:r;r< llm_providerparamsutf-8urlheadersdata SecretStringTimeout error occurred6Error reading secret='%s' from AWS Secrets Manager: %s)%async_read_secret_from_primary_secret_prepare_requestr r SecretManagerpostdecoderaise_for_statusjsonhttpxTimeoutException ValueErrorr4r exceptionstr) rr:r;r<r= endpoint_urlrJbody async_clientresponser8s rasync_read_secretz%AWSSecretsManagerV2.async_read_secretss CC'=PD '+&;&;##+'<' # gt 5-;;w' $0$5$5,PW^b^i^ijq^r$5$ssH  % % '==?>2 2% t%% 756 6   $ $HA     sKC;B$9C;&B(<B&=&B(#C;&B((&C8 C3.C;3C88C;c |dvrtj|S|r|j||S|jd||\}}}t d|i} |j |||j d} | jd S#tj$r td tj$r\} tjd |t| jj t| jj"Yd } ~ y d } ~ wt$$r*} tjd |t| Yd } ~ y d } ~ wwxYw)z Sync function to read a secret from AWS Secrets Manager Done for backwards compatibility with existing codebase, since get_secret is a sync function )AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYr"r#AWS_BEDROCK_RUNTIME_ENDPOINTr@rArBr<)rFrGrHrLrMz:Error reading secret='%s' from AWS Secrets Manager: %s, %sNrN)r%getenv$sync_read_secret_from_primary_secretrPrrRrSrUrVrWrXHTTPStatusErrorrrYrZr^text status_coder4) rr:r;r<r=r[rJr\ sync_clientr^r8s rsync_read_secretz$AWSSecretsManagerV2.sync_read_secretsX   99[) ) <<'=P= '+&;&;##+'<' # gt /w'  )..<W[WbWbcjWk.lH==?>2 2%% 756 6$$   $ $LAJJOO$AJJ**+       $ $HA     s%5B 0E )>K^)>)_)-)C)CD[)\&**;77r cK|j|d{}|j|}|j|S7&w)rprqN)r_rnrrrss rrOz9AWSSecretsManagerV2.async_read_secret_from_primary_secretsI04/E/ERe/E/f)f)-)C)CD[)\&**;77*gsA?'A secret_value descriptiontagsc *Kddlm}||t|jd}|r||d<|rbt |t r/|j D cgc]\} } | t| d} } } nt |tr|} n td| |d<|jd|||| \} } }ttjd |i } |j| | |jd  d{}|j|j!}|j,rK |j/||j,||d{t1j2d||j,|S|Scc} } w7#t"j$$r'}td|j&j(d}~wt"j*$r tdwxYw7#t4$r6}t1j6d||j,t|Yd}~|Sd}~wwxYww)a Async function to write a secret to AWS Secrets Manager Args: secret_name: Name of the secret secret_value: Value to store (can be a JSON string) description: Optional description for the secret optional_params: Additional AWS parameters timeout: Request timeout tags: Optional dict or list of tags to apply, e.g. {"Environment": "Prod", "Owner": "AI-Platform"} or [{"Key": "Environment", "Value": "Prod"}] ruuid)NamerLClientRequestToken Description)KeyValuez1Tags must be a dict or list of {Key, Value} pairsTags CreateSecretrCr:rvr; request_datar<rDrGrHNHTTP error occurred: rM)r:rr;r<z%Replicated secret '%s' to regions: %suSFailed to replicate secret '%s' to regions %s: %s — key was created successfully.) litellm._uuidr{rZuuid4 isinstancedictr/listrXrPr r rQrRrSrTrUrVrfr^rgrWrasync_replicate_secretrdebugr4r')rr:rvrwr;r<rxr{rKr6r7 tags_listr[rJr\r]r^create_responseerrreplication_errs rasync_write_secretz&AWSSecretsManagerV2.async_write_secrets2, ' ("%djjl"3'  "-D  $%EIZZ\RTQQQ8R RD$'  !TUU$DL&*&;&;!#%+ '<' # gt5-;;w' 7$0$5$5 [[)%6%H  % % '%-]]_O    11 +$($8$8$3# 2 $$;((mS*$$ J4S\\5F5F4GHI I%% 756 6 7  &&i(((  sAHE-*AH &E5/E30$E5 H!"GG%G) H3E55G "F**"G  HG H+H H HHc0K|siStjd||||Dcgc]}d|ic}d}|jd|||\}}} ttj d|i} | j ||| jd d {} | j| jScc}w7)#tj$r'} td | jjd } ~ wtj$r td wxYww) u\ Replicate a secret to additional AWS regions using ReplicateSecretToRegions. Called after a successful CreateSecret when replica_regions is configured. Replication is best-effort — callers should not depend on this for correctness. Args: secret_name: Name or ARN of the secret to replicate replica_regions: List of target AWS region names, e.g. ["us-west-2"] optional_params: Additional AWS parameters timeout: Request timeout Returns: dict: AWS response, or {} if replica_regions is empty z=ReplicateSecretToRegions called for secret '%s' in regions %sRegion)SecretIdAddReplicaRegionsReplicateSecretToRegionsrCr:r;rr<rDrGrHNrrM)rinforPr r rQrRrSrTrUrVrfrXr^rgrW) rr:rr;r<rrKr[rJr\r]r^rs rrz*AWSSecretsManagerV2.async_replicate_secretQs-,I K   $9H!IA8Q-!I*  '+&;&;-#+ '<' # gt5-;;w'  7$0$5$5,PW^b^i^ijq^r$5$ssH  % % '==? "%"J t$$ J4S\\5F5F4GHI I%% 756 6 7sE!D B5;D*&B<B:#B<4D:B<<D"C11"DDcKddlm}||t|jd}|j d||||\}}} t t jd|i} | j||| jd d {} | j| jS7$#tj$r'} td | jj d } ~ wtj"$r td wxYww) a0 Async function to update an existing secret's value in AWS Secrets Manager. Uses PutSecretValue to update in place. Use this when rotating a secret that keeps the same name (current_secret_name == new_secret_name). Args: secret_name: Name of the existing secret to update secret_value: New value to store optional_params: Additional AWS parameters timeout: Request timeout Returns: dict: Response from AWS Secrets Manager containing update details rrz)rrLr}PutSecretValuerr<rDrGrHNrrM)rr{rZrrPr r rQrRrSrTrUrVrfrXr^rgrW) rr:rvr;r<r{rKr[rJr\r]r^rs rasync_put_secret_valuez*AWSSecretsManagerV2.async_put_secret_values , '$("%djjl"3'  '+&;&;##%+ '<' # gt5-;;w'  7$0$5$5,PW^b^i^ijq^r$5$ssH  % % '==? "t$$ J4S\\5F5F4GHI I%% 756 6 7s<AD&B+B)#B+(D)B++D>"C  "DDcurrent_secret_namenew_secret_namenew_secret_valuecK||k(r3tjd||j||||d{St||||||d{S7 7w)z Rotate a secret. When current_secret_name == new_secret_name (in-place update), uses PutSecretValue instead of create+delete to avoid ResourceExistsException. z8Secret rotated in-place (PutSecretValue): secret_name=%s)r:rvr;r<N)rrrr;r<)rrrsuperasync_rotate_secret)rrrrr;r< __class__s rrz'AWSSecretsManagerV2.async_rotate_secrets / 1   J# 44/- / 5 W0 3+-+ 1    s!4AAAAAArecovery_window_in_dayscK||d}|jd|||\}}}ttjd|i} | j |||j dd{} | j | jS7$#tj$r'} td | jjd} ~ wtj$r td wxYww) a Async function to delete a secret from AWS Secrets Manager Args: secret_name: Name of the secret to delete recovery_window_in_days: Number of days before permanent deletion (default: 7) optional_params: Additional AWS parameters timeout: Request timeout Returns: dict: Response from AWS Secrets Manager containing deletion details )rRecoveryWindowInDays DeleteSecretrr<rDrGrHNrrM)rPr r rQrRrSrTrUrVrfrXr^rgrW) rr:rr;r<rKr[rJr\r]r^rs rasync_delete_secretz'AWSSecretsManagerV2.async_delete_secrets*$$;  '+&;&;!#+ '<' # gt5-;;w'  7$0$5$5,PW^b^i^ijq^r$5$ssH  % % '==? "t$$ J4S\\5F5F4GHI I%% 756 6 7s:rsK   +G857?D2k3*&7k3r