| 124 | return cls(config, session=session) |
| 125 | |
| 126 | def sign(self, *, method: str, url: str, headers: Mapping[str, str], body: bytes | None) -> dict[str, str]: |
| 127 | try: |
| 128 | credentials = ( |
| 129 | self._credentials_provider() |
| 130 | if self._credentials_provider is not None |
| 131 | else self._explicit_credentials or self._session.get_credentials() |
| 132 | ) |
| 133 | if credentials is None: |
| 134 | raise OpenAIError( |
| 135 | "Could not find credentials for Bedrock. Pass a bearer credential or AWS credentials to " |
| 136 | "`bedrock(...)`, " |
| 137 | "set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain." |
| 138 | ) |
| 139 | |
| 140 | get_frozen_credentials = getattr(credentials, "get_frozen_credentials", None) |
| 141 | if callable(get_frozen_credentials): |
| 142 | credentials = get_frozen_credentials() |
| 143 | |
| 144 | signed_headers = { |
| 145 | name: value for name, value in headers.items() if name.lower() not in _AWS_SIGNING_HEADERS |
| 146 | } |
| 147 | signed_headers["X-Amz-Content-SHA256"] = hashlib.sha256(body or b"").hexdigest() |
| 148 | aws_request = self._aws_request_cls( |
| 149 | method=method, |
| 150 | url=url, |
| 151 | data=body, |
| 152 | headers=signed_headers, |
| 153 | ) |
| 154 | self._sigv4_auth_cls(credentials, "bedrock-mantle", self.config.region).add_auth(aws_request) |
| 155 | except OpenAIError: |
| 156 | raise |
| 157 | except Exception as exc: |
| 158 | raise OpenAIError( |
| 159 | "Failed to resolve AWS credentials for Bedrock. Verify your AWS profile, environment variables, " |
| 160 | "or runtime identity configuration and try again." |
| 161 | ) from exc |
| 162 | |
| 163 | return dict(aws_request.headers.items()) |
| 164 | |
| 165 | |
| 166 | def resolve_aws_region_with_source( |