Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

@greptileai

Greptile Summary

This PR improves the debugging experience for Bedrock OIDC auth failures by surfacing the JWT's aud and iss claims directly in the error message when AWS STS rejects a web identity token with InvalidIdentityTokenException.

• Adds _unverified_web_identity_audience — a static helper that base64url-decodes the JWT payload segment (no signature read) and extracts aud/iss via a Pydantic model, returning None gracefully on any parse error so non-JWT tokens degrade silently.
• Wraps sts_client.assume_role_with_web_identity in a try/except for InvalidIdentityTokenException, re-raising as AwsAuthError(401) with the STS reason preserved and the token's audience/issuer appended.
• Adds four targeted unit tests that mock boto3 and get_secret, covering the 401 status code, aud, iss, and original STS message all appearing in the raised error.

Confidence Score: 5/5

Safe to merge. The change is purely additive on the failure path and cannot affect the happy path.

The new code only runs when STS has already rejected the token, so it cannot change credentials-retrieval behavior on success. The JWT decode is guarded by a broad except (ValueError, ValidationError) with a None fallback, meaning any malformed or non-JWT token degrades silently to the original error message. aud and iss are public JWT claims; no signature material or secret is exposed. The four new unit tests are fully mocked and directly exercise the claims-surfacing logic end-to-end.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix(bedrock): surface web identity token..." | Re-trigger Greptile}

Greptile Summary

When AssumeRoleWithWebIdentity fails with InvalidIdentityTokenException, LiteLLM previously surfaced an opaque botocore error with no information about the token's audience, forcing operators to enable debug logging on production to diagnose the mismatch. This PR wraps that STS call and, on failure, decodes the public aud/iss claims from the JWT payload (signature never read) to include them in a structured AwsAuthError(401).

• _unverified_web_identity_audience: new static helper that base64url-decodes the JWT payload segment, validates it with a tight _WebIdentityTokenClaims Pydantic model, and returns the aud/iss formatted for the error message; returns None gracefully for non-JWT or malformed tokens.
• The STS call is now wrapped in a try/except InvalidIdentityTokenException that raises the new structured error; all other exceptions propagate unchanged, and the happy path has no overhead.
• Four mock-only unit tests cover the audience string, issuer string, original STS reason preservation, and 401 status code.

Confidence Score: 5/5

Safe to merge — the change only affects the error path; the happy path is untouched and carries no new overhead.

The new code is entirely on the failure branch of _auth_with_web_identity_token. _unverified_web_identity_audience decodes only the public payload segment, catches all expected decode errors (ValueError, ValidationError), and returns None rather than throwing when the token isn't a well-formed JWT. The exception handler is narrowly scoped to InvalidIdentityTokenException; all other STS errors propagate as before. Four targeted unit tests with full mocking confirm the aud/iss surfacing, reason preservation, and status code.

No files require special attention.

_{Reviews (2): Last reviewed commit: "fix(bedrock): surface web identity token..." | Re-trigger Greptile}

Codecov Report

❌ Patch coverage is 84.00000% with 4 lines in your changes missing coverage. Please review.

📢 Thoughts on this report? Let us know!