Skip to content

BedrockClientV2 SigV4 Signing Failure (Host Mismatch) and cohere_aws Dependency Issues #721

@q2mark

Description

@q2mark

SDK Version (required): 5.20.2

1. Bug: BedrockClientV2 SigV4 Host Header Mismatch

The BedrockClientV2 (via AwsClientV2) is currently broken for all Bedrock calls due to an incorrect host being used during the SigV4 calculation.

  • The Cause: AwsClientV2 initializes with a hardcoded base_url="https://api.cohere.com". While the map_request_to_bedrock event hook updates the request.url and request.headers["host"] to the AWS endpoint, the CanonicalRequest used for signing is generated using the original api.cohere.com host.
  • The Result: AWS rejects the request with a 403 Forbidden because the signature tied to api.cohere.com does not match the actual transport host (bedrock-runtime.{region}.amazonaws.com).
  • Evidence: Debug logs show the CanonicalRequest host as api.cohere.com, while the final httpx dispatch is to the AWS Bedrock URL.

2. Bug: cohere_aws.Client Forced SageMaker Dependency

The manually maintained cohere.manually_maintained.cohere_aws.Client is intended to support both SageMaker and Bedrock. However, it is currently unusable for Bedrock-only users who do not have the sagemaker library installed.

  • The Cause: The __init__ method of the client forcibly calls lazy_sagemaker().Session().
  • The Result: This triggers an ImportError even if the user explicitly sets co.mode = Mode.BEDROCK.
  • Fix Required: The SageMaker session should be initialized lazily only when Mode.SAGEMAKER is actually used.

**3. Improvement: Support for Embed v4 in cohere_aws.Client**

While BedrockClientV2 is broken, the alternative cohere_aws.Client lacks support for the new parameters introduced in Embed v4.

  • The Issue: The embed method in the manually maintained client is statically defined and does not accept or pass the output_dimension parameter.
  • The Result: Users cannot utilize the selectable dimensionality (256, 512, 1024) features of Embed v4 via the SDK on Bedrock.

Steps to Reproduce (BedrockClientV2)

import cohere
# This will fail with 403 Forbidden due to Host signing mismatch
co = cohere.BedrockClientV2(aws_region='us-east-1')
co.embed(texts=['test'], model='cohere.embed-v4-0', input_type='search_document')

Suggested Fixes

  1. **For AwsClientV2**: Ensure the httpx.Request host and URL are fully updated prior to the SigV4Auth signer being invoked so the CanonicalRequest uses the AWS host.
  2. **For cohere_aws.Client**: Guard the sagemaker.Session creation so it doesn't block users who only have boto3 and botocore installed for Bedrock use.
  3. For Embed v4: Update the embed signature in the manually maintained client to support output_dimension and embedding_types.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions