Skip to content

fix: resolve AWS client SigV4 signing, forced SageMaker dep, and missing embed params#728

Open
fern-support wants to merge 6 commits intomainfrom
fern-support/fix-aws-client-embed-params
Open

fix: resolve AWS client SigV4 signing, forced SageMaker dep, and missing embed params#728
fern-support wants to merge 6 commits intomainfrom
fern-support/fix-aws-client-embed-params

Conversation

@fern-support
Copy link
Collaborator

@fern-support fern-support commented Feb 11, 2026

Summary

  • SigV4 host header mismatch: The copied headers dict passed to AWSRequest for signing contained the stale api.cohere.com host instead of the rewritten Bedrock/SageMaker host, causing signature mismatch errors. Fixed by syncing headers["host"] after the URL rewrite.
  • Forced SageMaker dependency: cohere_aws.Client.__init__ unconditionally created SageMaker boto3 clients and a sagemaker.Session, even for Bedrock users. Added a mode parameter (default Mode.SAGEMAKER for backwards compat) that conditionally initializes the correct service clients (bedrock-runtime/bedrock vs sagemaker-runtime/sagemaker). SageMaker-only methods (connect_to_endpoint, create_endpoint, export_finetune, summarize, delete_endpoint) now raise a clear error if called in Bedrock mode.
  • Missing Embed v4 parameters: Added output_dimension and embedding_types to the embed() method signature, included in json_params (stripped when None by existing cleanup loop).

Closes #721

Test plan

  • Unit tests (mocked, no AWS credentials needed) verifying SigV4 host fix, mode-conditional init, and embed param passing
  • Integration tests in test_bedrock_client.py (gated by TEST_AWS env var) covering BedrockClientV2 signing, cohere_aws.Client in Bedrock mode, and embed with v4 params
  • All modified files are in .fernignore (safe from Fern regeneration)
  • Live verification with real AWS credentials (enable by setting TEST_AWS=1 + AWS credential env vars)

🤖 Generated with Claude Code


Note

Medium Risk
Touches AWS request signing and client initialization paths; failures would surface as auth/signature errors or runtime mode mismatches, though changes are small and covered by unit/integration tests.

Overview
Fixes AWS request signing by ensuring SigV4 signs with the rewritten Bedrock/SageMaker host header after the URL is updated.

Updates cohere_aws.Client to support both SageMaker and Bedrock via a new mode parameter (defaulting to Mode.SAGEMAKER), conditionally initializing the correct boto clients and guarding SageMaker-only operations with a clear runtime error.

Extends embed() to accept output_dimension and embedding_types, passes them through to Bedrock/SageMaker requests, and returns raw dict embeddings when the API responds with embeddings-by-type. Adds unit tests for all fixes plus new gated AWS integration coverage for Bedrock clients.

Written by Cursor Bugbot for commit 5f77e85. This will update automatically on new commits. Configure here.

…ing embed params

- Fix SigV4 host header mismatch: update copied headers dict with correct
  host after URL rewrite, so AWSRequest signs with the Bedrock/SageMaker
  host instead of stale api.cohere.com
- Add mode parameter to cohere_aws.Client to conditionally initialize
  boto3 clients (bedrock-runtime/bedrock vs sagemaker-runtime/sagemaker),
  avoiding forced SageMaker dependency for Bedrock users
- Add output_dimension and embedding_types params to embed() for Embed v4

Closes #721

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fern-support and others added 4 commits February 11, 2026 12:40
Add skipped integration tests (gated by TEST_AWS) covering:
- BedrockClientV2 embed with SigV4 signing (validates host header fix)
- cohere_aws.Client in Bedrock mode (validates mode param fix)
- embed() with output_dimension and embedding_types (validates v4 params)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address review feedback: In Bedrock mode, `self._sess` was never set,
so SageMaker-only methods would throw confusing AttributeErrors. Now:
- Initialize `_sess=None` and `_endpoint_name=None` in Bedrock mode
- Add `_require_sagemaker()` guard to connect_to_endpoint,
  create_endpoint, export_finetune, summarize, and delete_endpoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes mypy attr-defined error in CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
These run in CI without AWS credentials, covering:
- SigV4 signing uses correct host header after URL rewrite
- Mode-conditional boto3 client initialization (sagemaker vs bedrock)
- Default mode is SAGEMAKER for backwards compat
- embed() accepts, passes, and strips output_dimension/embedding_types

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When embedding_types is specified, the Cohere API returns embeddings as
a dict (e.g. {"float": [[...]], "int8": [[...]]}) instead of a flat list.
Both _bedrock_embed and _sagemaker_embed now detect the dict format and
return it directly instead of wrapping it in Embeddings, which would
silently produce wrong results for len() and iteration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BedrockClientV2 SigV4 Signing Failure (Host Mismatch) and cohere_aws Dependency Issues

2 participants