{"record":{"id":"3cfbb52e96d4686f","repo":"BerriAI/litellm","slug":"sqs-app-encryption-key-b64-is-required-when-encryp","errorCode":null,"errorMessage":"sqs_app_encryption_key_b64 is required when encryption is enabled.","messagePattern":"sqs_app_encryption_key_b64 is required when encryption is enabled\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/sqs.py","lineNumber":197,"sourceCode":"            litellm.aws_sqs_callback_params.get(\"sqs_strip_base64_files\", False) or sqs_strip_base64_files\n        )\n\n        self.sqs_aws_use_application_level_encryption = (\n            litellm.aws_sqs_callback_params.get(\"sqs_aws_use_application_level_encryption\", False)\n            or sqs_aws_use_application_level_encryption\n        )\n        self.sqs_app_encryption_key_b64 = (\n            litellm.aws_sqs_callback_params.get(\"sqs_app_encryption_key_b64\") or sqs_app_encryption_key_b64\n        )\n        self.sqs_app_encryption_aad = (\n            litellm.aws_sqs_callback_params.get(\"sqs_app_encryption_aad\") or sqs_app_encryption_aad\n        )\n        self.app_crypto: AppCrypto | None = None\n        if self.sqs_aws_use_application_level_encryption:\n            from litellm.litellm_core_utils.app_crypto import AppCrypto\n\n            if not self.sqs_app_encryption_key_b64:\n                raise ValueError(\"sqs_app_encryption_key_b64 is required when encryption is enabled.\")\n            key = base64.b64decode(self.sqs_app_encryption_key_b64)\n            self.app_crypto = AppCrypto(key)\n            verbose_logger.debug(\"SQSLogger: Application-level encryption enabled.\")\n        self.sqs_config = litellm.aws_sqs_callback_params.get(\"sqs_config\") or sqs_config\n\n    async def async_log_success_event(self, kwargs, response_obj, start_time, end_time) -> None:\n        try:\n            verbose_logger.debug(\"SQS Logging - Enters logging function for model %s\", kwargs)\n            standard_logging_payload = kwargs.get(\"standard_logging_object\")\n            if self.sqs_strip_base64_files:\n                standard_logging_payload = await self._strip_base64_from_messages(standard_logging_payload)\n            if standard_logging_payload is None:\n                raise ValueError(\"standard_logging_payload is None\")\n\n            self.log_queue.append(standard_logging_payload)\n            verbose_logger.debug(\n                \"sqs logging: queue length %s, batch size %s\",\n                len(self.log_queue),","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/integrations/sqs.py#L179-L215","documentation":"SQSLogger.__init__ enables application-level encryption (AES-GCM via AppCrypto) when sqs_aws_use_application_level_encryption is true, and requires a base64-encoded key from litellm.aws_sqs_callback_params['sqs_app_encryption_key_b64'] or the constructor arg. Without the key there is nothing to encrypt with, so construction aborts with ValueError.","triggerScenarios":"Turning on sqs_aws_use_application_level_encryption (env var LITELLM_SQS_USE_APPLICATION_LEVEL_ENCRYPTION or callback config) without supplying the key; passing the key under a different name or only via constructor while reading config from litellm.aws_sqs_callback_params; base64 key set but empty string (falsy) after .get().","commonSituations":"Enabling encryption in staging from a runbook that omits the key step; secrets mounted as empty files (key resolves to ''); key stored in the proxy YAML under the wrong field name.","solutions":["Set litellm.aws_sqs_callback_params = {'sqs_app_encryption_key_b64': '<base64 key>', ...} (or pass sqs_app_encryption_key_b64= to the constructor) alongside enabling encryption","Generate a valid key: python -c \"import os,base64; print(base64.b64encode(os.urandom(32)).decode())\" and distribute it to every producer/consumer that must decrypt","If encryption is not actually required, leave sqs_aws_use_application_level_encryption unset/false"],"exampleFix":"# before\nlitellm.aws_sqs_callback_params = {\n    \"sqs_aws_use_application_level_encryption\": True,\n    # key missing -> ValueError\n}\n\n# after\nimport base64, os\nlitellm.aws_sqs_callback_params = {\n    \"sqs_aws_use_application_level_encryption\": True,\n    \"sqs_app_encryption_key_b64\": base64.b64encode(os.urandom(32)).decode(),\n    \"sqs_app_encryption_aad\": \"litellm-logs\",\n}","handlingStrategy":"validation","validationCode":"import base64, binascii\n\ndef valid_b64_key(v: str | None) -> bool:\n    if not v:\n        return False\n    try:\n        return len(base64.b64decode(v, validate=True)) in (16, 24, 32)\n    except (binascii.Error, ValueError):\n        return False\n\nif litellm.aws_sqs_callback_params.get(\"sqs_aws_use_application_level_encryption\"):\n    assert valid_b64_key(\n        litellm.aws_sqs_callback_params.get(\"sqs_app_encryption_key_b64\")\n    ), \"sqs_app_encryption_key_b64 must be a base64 AES key\"","typeGuard":"from typing import Any, TypeGuard\n\ndef is_b64_aes_key(v: Any) -> TypeGuard[str]:\n    import base64, binascii\n    if not isinstance(v, str) or not v:\n        return False\n    try:\n        return len(base64.b64decode(v, validate=True)) in (16, 24, 32)\n    except (binascii.Error, ValueError):\n        return False","tryCatchPattern":"try:\n    sqs_logger = SQSLogger()\nexcept ValueError as e:\n    if \"sqs_app_encryption_key_b64 is required\" in str(e):\n        raise RuntimeError(\"SQS encryption enabled but key missing — refusing to start\") from e\n    raise","preventionTips":["Fail deployment when encryption is enabled but the key secret is absent or empty","Generate keys with a fixed script (32 random bytes, base64) and share the same key with all consumers","Rotate keys deliberately — both writer and reader need the same key material to decrypt"],"tags":["sqs","encryption","configuration","secrets"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}