[Fix] Redact user API key info in S3 logger metadata

[shivamrawat1]

Relevant issues

The S3 logger was not redacting user API key information from metadata before uploading logs to S3 when redact_user_api_key_info was true.

Pre-Submission checklist

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🐛 Bug Fix
✅ Test

Changes

• Applied the same redaction logic used in Langfuse to the S3 logger.
• Applied redaction to metadata in create_s3_batch_logging_element method before payload creation
• Added unit tests to verify redaction behavior when enabled/disabled

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
litellm	Ready	Preview, Comment	Dec 17, 2025 0:16am

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[ishaan-jaff]

add this to docs here https://docs.litellm.ai/docs/proxy/logging#s3-buckets

[krrishdholakia]

shouldn't we do this upstream in litellm_logger?

or in a base class somewhere? it seems like we'll see this in other integrations as well (e.g. datadog)

[shivamrawat1]

shouldn't we do this upstream in litellm_logger?

or in a base class somewhere? it seems like we'll see this in other integrations as well (e.g. datadog)

you are prolly right. @ishaan-jaff gave me this issue and asked me to copy the logic from langfuse. that's what i did. should i implement a higher level abstraction so it works with all integrations?