fix(aws): let AnthropicAWS.copy() accept credentials=None so environment helpers work on Claude Platform on AWS - #1737
Conversation
…ent helpers work The environment work helpers — `client.beta.environments.work.poller()`, `EnvironmentWorker`, and `SessionToolRunner` — build a scoped sub-client via `_copy_client_with_bearer_auth`, which calls `client.copy(credentials=None, ...)`. `AnthropicAWS.copy()` / `AsyncAnthropicAWS.copy()` intentionally omit the `credentials` parameter, so these helpers raise `TypeError: copy() got an unexpected keyword argument 'credentials'` on the AWS client — making the self-hosted environment poller/worker unusable on Claude Platform on AWS. Accept `credentials` on the AWS `copy()` overrides as a no-op when None (the AWS client authenticates with SigV4 / an API key and has no token-provider credentials), and raise a clear error if a real provider is passed. The scoped sub-client is returned unchanged auth-wise, so it keeps signing with SigV4. Add regression tests covering copy(credentials=None), rejection of a real provider, and `_copy_client_with_bearer_auth` on both sync and async AWS clients.
Real-world validationI've validated this fix end-to-end using Amazon EKS as the self-hosted environment, with the in-cluster poller/worker authenticating to Claude Platform on AWS via EKS Pod Identity (SigV4, cross-account role chaining — the EKS Pod Identity role in the cluster account assuming a target role in the Claude Platform account). With the fix applied, |
|
FYI - Retargeted to next since we merge PRs into there and only merge next -> main on releases |
sophie-ant
left a comment
sophie-ant
left a comment
There was a problem hiding this comment.
Thank you for your PR! Just had a few minor comments.
|
FYI, I'm going to address my comments |
Use a real StaticToken provider instead of object() in the rejection test (object() does not satisfy the AccessTokenProvider protocol under mypy) and mirror both copy() credentials tests on AsyncAnthropicAWS. No-Verification-Needed: test-only change
|
Thanks again! |
|
Thank you for taking my contributions |
4 participants
Fixes #1736.
Problem
The self-hosted environment work helpers —
client.beta.environments.work.poller(),EnvironmentWorker, andSessionToolRunner— build a scoped sub-client via_copy_client_with_bearer_auth, which callsclient.copy(credentials=None, ...).AnthropicAWS.copy()/AsyncAnthropicAWS.copy()intentionally omitcredentials, so on the AWS platform these helpers raise before making any request:This makes the self-hosted environment poller and worker unusable on Claude Platform on AWS. Reproduced on
anthropic==0.116.0(latest release). Full repro in #1736.Fix
Accept
credentialson the AWScopy()overrides:None(the value the internal helper passes) → no-op. The AWS client authenticates with SigV4 (or an API key) and has no token-provider credential to clear, so the scoped sub-client is returned unchanged auth-wise and keeps signing with SigV4.TypeErrorwith a clear message, rather than silently ignoring it.The change is confined to
src/anthropic/lib/aws/_client.py(which the code generator never touches) and fixes all four call sites at once.Tests
Added to
tests/lib/test_aws.py:test_copy_accepts_credentials_none_noop—copy(credentials=None)stays SigV4, preserves workspace/region.test_copy_rejects_real_credentials_provider— a real provider raisesTypeError.test_scoped_bearer_client_helper_on_aws/_async— the exact_copy_client_with_bearer_authpath the poller/worker use now works on both sync and async AWS clients.tests/lib/test_aws.pypasses (39 passed); fulltests/lib/suite passes (752 passed, 1 skipped, 1 xfailed);ruff checkandruff formatclean.