cli: http proxy does not work anymore

[holomekc]

Describe the bug

With the migration to aws-sdk-js-v3 the http proxy options do not work anymore.

Using HTTP(S)_PROXY or http(s)_proxy are ignored as it seems by the sdk and the cdk cli also do not extract those values.
Using --proxy also does not work and results in an error, which is only visible with --debug --verbose:

[08:08:22] Unable to determine the default AWS account (TypeError): Invalid IP address: http://127.0.0.1:3128

Due to the fact that env variables are ignored now I tried to provide the proxy settings to the cli via --proxy in different ways, but none was successful:
--proxy="http://localhost:3128"
--proxy="http://127.0.0.1:3128"
--proxy "http://localhost:3128"
--proxy "http://127.0.0.1:3128"
--proxy="127.0.0.1:3128"

This issue describes some issues with http proxies in v3:
aws/aws-sdk-js-v3#5168

I am still searching for a way to work around this by editing the aws-cdk from the nodes_modules folder, but no luck so far.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.165.0

Expected Behavior

http proxy env variables are used properly as well as the --proxy option

Current Behavior

http proxy env variables are not working. Same applies for --proxy

Reproduction Steps

Well. Most likely you need an http proxy to test this

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.168.0

Framework Version

No response

Node.js Version

22.11.0

OS

mac osx

Language

Java

Language Version

Java 21

Other information

No response

[holomekc]

Also see: https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-proxies.html

[pahud]

did you simply

export HTTPS_PROXY=http://127.0.0.1:3128

And it was working in 2.165.0 but not anymore since 2.166.0 ?

[munch9]

We are also experiencing similar issues.
Deployment is across multiple accounts using temporary credentials also set as environment variables.
Bootstrapping is up to date, and trust in place between acct2 and acct1
Have HTTP_PROXY/HTTPS_PROXY set in the environment. Have also tried setting using --proxy option.
Synth/Deploy fails when attempting to populate cdk.context.json I think.

Works with versions <=2.166.0
Fails with all versions >=2.167.*

`[16:46:26] Some context information is missing. Fetching...

[16:46:26] [trace] SdkProvider#resolveEnvironment()
[16:46:26] [trace] SdkProvider#baseCredentialsPartition()
[16:46:26] [trace] SdkProvider#resolveEnvironment()
[16:46:26] [trace] SdkProvider#obtainBaseCredentials()
[16:46:26] [trace] SdkProvider#defaultAccount()
[16:46:26] [trace] SdkProvider#defaultCredentials()
[16:46:26] [trace] SDK#currentAccount()
[16:46:26] Retrieved account ID from disk cache
[16:46:26] Reading SSM parameter :eu-west-1:/
[16:46:26] [trace] SdkProvider#forEnvironment()
[16:46:26] [trace] SdkProvider#resolveEnvironment()
[16:46:26] [trace] SdkProvider#obtainBaseCredentials()
[16:46:26] [trace] SdkProvider#defaultAccount()
[16:46:26] [trace] SdkProvider#defaultCredentials()
[16:46:26] [trace] SdkProvider#withAssumedRole()
[16:46:26] Assuming role 'arn:aws:iam:::role/cdk-hnb659fds-lookup-role--eu-west-1'.
[16:53:12] Assuming role failed: connect ETIMEDOUT 67.220.226.247:443
[16:53:12] Setting "ssm:account=:parameterName=/:region=eu-west-1" context to {"$providerError":"Could not assume role in target account using current credentials (which are for account ) connect ETIMEDOUT 67.220.226.247:443 . Please make sure that this role exists in the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.","$dontSaveContext":true}
`

[holomekc]

Yes before HTTPS_PROXY was working. I think the proxy config for v2 was easier. With v3 you need to do more manually as the linked AWS docu describes. Seems like third party libs are necessary.

That is also the reason why it worked with 2.165.0 because there v2 of aws sdk was used