fix: CDK does not honor NO_PROXY settings

[RomainMuller]

CDK was extracting the value of HTTPS?_PROXY and passing this to
proxy-agent explicitly, which resulted in not honoring the NO_PROXY
setting.

This removes that behavior and lets proxy-agent delegate to
proxy-from-env, which will leverage values in HTTPS?_PROXY and
NO_PROXY correctly.

Fixes #7121

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: baa1f51
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[ryparker]

I believe this change is causing EKS deployments to fail. CloudFormation now throws Internal Failure. when trying to create.

This handler is used in the "onComplete" Lambda function which does not have the proxy-agent available. We only pass an http_proxy env var into the "onEvent" Lambda since that is the only Lambda that makes requests with the aws-sdk-js.

I tested this by moving the proxy logic to the onEvent() method and was able to successfully deploy again. I'll make a PR.

[ryparker]

I also noticed that new ProxyAgent() does not automatically detect process.env.http_proxy or process.env.HTTP_PROXY.

[ryparker]

Here's what ProxyAgent looks like when you log it in the Lambda:

Code:

const agent = new ProxyAgent()
console.log(`agent: ${JSON.stringify(agent, null, 2)}`);

Logs:

2021-10-01T22:32:09.812Z	03de5aeb-e937-4b3d-91a3-aee2c524cb47	INFO	agent: {}

---

Code:

const agent = new ProxyAgent(process.env.http_agent);
console.log(`agent: ${JSON.stringify(agent, null, 2)}`);

Logs:

2021-10-01T22:30:23.701Z	0ffc17d9-134f-498a-a8d9-dcfbe0754ae5	INFO	agent: {
  "proxy": {
    "protocol": "http:",
    "slashes": true,
    "auth": "user1:user1",
    "host": "184.73.16.134",
    "port": null,
    "hostname": "184.73.16.134",
    "hash": null,
    "search": null,
    "query": null,
    "pathname": "/",
    "path": "/",
    "href": "http://user1:[email protected]/"
  },
  "proxyUri": "http://user1:[email protected]"
}

[ryparker]

Tested using https://github.com/ryparker/aws-cdk-sample-eks

[RomainMuller]

It's normal and expected that the ProxyAgent instance does not look the same. If provided with a proxy, it will use ALWAYS and ONLY that proxy. When not specified, it will delegate to proxy-from-env, which will look at the correct proxy environment variable for the request' protocol & honor NO_PROXY.

I'd argue that the broken Lambda function should receive an HTTPS_PROXY and not HTTP_PROXY, as the AWS SDK typically makes only TSL connections... So it should be expected NOT to use HTTP_PROXY (using that value is incorrect there and should be considered a bug).