fix(aws): let AnthropicAWS.copy() accept credentials=None so environment helpers work on Claude Platform on AWS#1737
Open
csantanapr wants to merge 1 commit into
Conversation
…ent helpers work The environment work helpers — `client.beta.environments.work.poller()`, `EnvironmentWorker`, and `SessionToolRunner` — build a scoped sub-client via `_copy_client_with_bearer_auth`, which calls `client.copy(credentials=None, ...)`. `AnthropicAWS.copy()` / `AsyncAnthropicAWS.copy()` intentionally omit the `credentials` parameter, so these helpers raise `TypeError: copy() got an unexpected keyword argument 'credentials'` on the AWS client — making the self-hosted environment poller/worker unusable on Claude Platform on AWS. Accept `credentials` on the AWS `copy()` overrides as a no-op when None (the AWS client authenticates with SigV4 / an API key and has no token-provider credentials), and raise a clear error if a real provider is passed. The scoped sub-client is returned unchanged auth-wise, so it keeps signing with SigV4. Add regression tests covering copy(credentials=None), rejection of a real provider, and `_copy_client_with_bearer_auth` on both sync and async AWS clients.
Author
Real-world validationI've validated this fix end-to-end using Amazon EKS as the self-hosted environment, with the in-cluster poller/worker authenticating to Claude Platform on AWS via EKS Pod Identity (SigV4, cross-account role chaining — the EKS Pod Identity role in the cluster account assuming a target role in the Claude Platform account). With the fix applied, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1736.
Problem
The self-hosted environment work helpers —
client.beta.environments.work.poller(),EnvironmentWorker, andSessionToolRunner— build a scoped sub-client via_copy_client_with_bearer_auth, which callsclient.copy(credentials=None, ...).AnthropicAWS.copy()/AsyncAnthropicAWS.copy()intentionally omitcredentials, so on the AWS platform these helpers raise before making any request:This makes the self-hosted environment poller and worker unusable on Claude Platform on AWS. Reproduced on
anthropic==0.116.0(latest release). Full repro in #1736.Fix
Accept
credentialson the AWScopy()overrides:None(the value the internal helper passes) → no-op. The AWS client authenticates with SigV4 (or an API key) and has no token-provider credential to clear, so the scoped sub-client is returned unchanged auth-wise and keeps signing with SigV4.TypeErrorwith a clear message, rather than silently ignoring it.The change is confined to
src/anthropic/lib/aws/_client.py(which the code generator never touches) and fixes all four call sites at once.Tests
Added to
tests/lib/test_aws.py:test_copy_accepts_credentials_none_noop—copy(credentials=None)stays SigV4, preserves workspace/region.test_copy_rejects_real_credentials_provider— a real provider raisesTypeError.test_scoped_bearer_client_helper_on_aws/_async— the exact_copy_client_with_bearer_authpath the poller/worker use now works on both sync and async AWS clients.tests/lib/test_aws.pypasses (39 passed); fulltests/lib/suite passes (752 passed, 1 skipped, 1 xfailed);ruff checkandruff formatclean.