{"record":{"id":"e6491c27d10e8129","repo":"BerriAI/litellm","slug":"file-id-must-be-a-managed-litellm-s3-file-id","errorCode":null,"errorMessage":"file_id must be a managed LiteLLM S3 file id","messagePattern":"file_id must be a managed LiteLLM S3 file id","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/llms/bedrock/files/transformation.py","lineNumber":175,"sourceCode":"    Resolve a Bedrock file id to its S3 URI.\n\n    Accepts either a base64-encoded LiteLLM unified file id (whose decoded\n    form carries `llm_output_file_id,s3://...`) or a direct `s3://` URI.\n    \"\"\"\n    try:\n        padded: Final = file_id + \"=\" * (-len(file_id) % 4)\n        decoded: Final = base64.urlsafe_b64decode(padded).decode()\n\n        if decoded.startswith(SpecialEnums.LITELM_MANAGED_FILE_ID_PREFIX.value):\n            if \"llm_output_file_id,\" in decoded:\n                return decoded.split(\"llm_output_file_id,\")[1].split(\";\")[0]\n    except Exception:\n        pass\n\n    if file_id.startswith(\"s3://\"):\n        return file_id\n\n    raise ValueError(\"file_id must be a managed LiteLLM S3 file id\")\n\n\ndef get_configured_s3_bucket_name(litellm_params: Mapping[str, object]) -> str:\n    \"\"\"\n    Resolve the server-configured S3 bucket for Bedrock file operations.\n\n    Only trusts the immutable server-side credential snapshot or the\n    environment; never a request-supplied param, since the bucket is what\n    `validate_managed_cloud_file_id` checks file ids against.\n    \"\"\"\n    trusted_model_credentials: Final = litellm_params.get(\"_litellm_internal_model_credentials\")\n    bucket_name: str | None = None\n    if isinstance(trusted_model_credentials, MappingProxyType):\n        snapshot: Final[dict[str, object]] = {}\n        snapshot.update(trusted_model_credentials)  # any-ok: untyped snapshot\n        bucket_name = _TrustedS3ModelCredentials.model_validate(snapshot).s3_bucket_name\n    bucket_name = bucket_name or os.getenv(\"AWS_S3_BUCKET_NAME\")\n    if not bucket_name:","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/bedrock/files/transformation.py#L157-L193","documentation":"validate_managed_cloud_file_id accepts only ids that decode to LiteLLM-managed ids (base64url payloads with the LITELM_MANAGED_FILE_ID_PREFIX) or literal 's3://' URIs; anything else is rejected to prevent unvalidated file-id injection into S3 key resolution.","triggerScenarios":"Passing a raw OpenAI file id (e.g. 'file-abc123') or arbitrary string as file_id to Bedrock file content/operations instead of the managed id returned by litellm's file create, and not an s3:// URI.","commonSituations":"Migrating from OpenAI to Bedrock-backed files and reusing OpenAI ids; client apps storing provider-agnostic ids; passing an id after the managed-prefix format changed between litellm versions.","solutions":["Use the id returned by litellm's create-file endpoint for Bedrock (an s3:// URI or a managed LiteLLM id).","If you own the object, pass the full 's3://bucket/key' URI directly.","Re-upload the file through litellm to obtain a valid managed id."],"exampleFix":"# before\nhandler.file_content(FileContentRequest(file_id=\"file-1a2b3c\"))\n\n# after\nhandler.file_content(FileContentRequest(file_id=\"s3://my-bucket/bedrock-managed-batch/model-uuid.jsonl\"))","handlingStrategy":"type-guard","validationCode":"import base64\nfrom litellm.constants import SpecialEnums  # prefix enum\n\ndef is_managed_or_s3_id(file_id: str) -> bool:\n    if file_id.startswith(\"s3://\"):\n        return True\n    try:\n        padded = file_id + \"=\" * (-len(file_id) % 4)\n        return base64.urlsafe_b64decode(padded).decode().startswith(\n            SpecialEnums.LITELM_MANAGED_FILE_ID_PREFIX.value\n        )\n    except Exception:\n        return False","typeGuard":"def is_usable_bedrock_file_id(file_id: str) -> bool:\n    return file_id.startswith(\"s3://\") or is_managed_or_s3_id(file_id)","tryCatchPattern":"try:\n    content = handler.file_content(FileContentRequest(file_id=fid))\nexcept ValueError as e:\n    if \"managed LiteLLM S3 file id\" in str(e):\n        raise BadUserInput(fid)  # 400 to client\n    raise","preventionTips":["Persist the id litellm's create-file returns, not upstream provider ids.","Namespace stored ids by provider to avoid OpenAI/Bedrock mixups."],"tags":["bedrock","files","file-id","validation"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}