Configuring both HTTP proxy and TLS Context

[zdelv]

HTTP Proxy support was recently added (thank you!), but I can't seem to find any way of setting both a TLS context (internal root cert) and a proxy config.

My research/experimentation so far:

• The default client defined here in aws-smithy-runtime reads from proxy environment variables, but does not set a TLS context, so it inherits the defaults for TLS.
• The documented method for building an SdkConfig with a custom root cert works via aws_smithy_http_client::Builder. This builder does not have any proxy config methods on it and the final build_https() step creates a connector that does not have a proxy config.
• Both the TLS context and proxy config can be configured on aws_smithy_http_client::ConnectorBuilder, but I don't see any way to attach this connector to a client without writing a fully custom client. I believe this isn't a supported config method anyways.
• I can use aws_smithy_http_client::Builder.build_with_connector_fn(), which was added specifically for HTTP proxy support, but this is likely not supported due to it being undocumented.

I might be missing the obvious way to do this, so please let me know if that is the case.

---

If this is a missing feature, I see three different solutions here:

1. Add AWS_CA_BUNDLE env var support (available in boto3) that is used for the TLS context in the default client, if it is set.
2. Add proxy_config() or similar to aws_smithy_http_client::Builder
3. Document Builder.build_with_connector_fn to allow end users to configure what they need on the connector.

[aajtodd]

Add AWS_CA_BUNDLE env var support

I believe only the CLI currently supports AWS_CA_BUNDLE. I've created a feature request to track adding it

Add proxy_config() or similar to aws_smithy_http_client::Builder

We could consider this. Really what we'd like to be able to do longer term is have stable Connector traits that allow users to configure a lot more externally so we don't have to expose every config option.

---

If you are using rustls you might try SSL_CERT_DIR or SSL_CERT_FILE env variables as a workaround which should be supported by that provider (see rustls/rustls-native-certs#16)

[zdelv]

I believe only the CLI currently supports AWS_CA_BUNDLE. I've created a feature request to track adding it

It also works in boto3 from my experience, though I haven't had to use it in awhile. That doc link I mentioned is specifically for boto3 as well.

Really what we'd like to be able to do longer term is have stable Connector traits that allow users to configure a lot more externally so we don't have to expose every config option.

I like this idea a lot. I see you guys are still getting things in place, plus afaik the hyper-util legacy traits aren't stable so that might be a hurdle as well.

---

Turns out that utilizing the rustls env var for SSL_CERT_FILE was the solution. I had SSL_CERT_FILE pointed to an invalid cert and was getting a not-very-helpful error message about it. After unsetting that variable and relying on system certs (where the internal cert is also installed), the error went away and the default client that uses HTTP proxy env vars worked.

It seems like relying on the default client's HTTP proxy config and SSL_CERT_FILE/DIR is the method for configuring both if the system cert store does not have the cert installed. I'll mark this as resolved as this is a good enough solution for the time being.