[moneytool]

Fixes #1545

The CLI only picked up a custom CA bundle from --ca-bundle-path / caBundlePath or the AWS_CA_BUNDLE environment variable. The AWS CLI (botocore) also uses the ca_bundle setting of the active profile and falls back to REQUESTS_CA_BUNDLE. Behind a TLS-intercepting proxy, a setup that works for aws sso login failed in the CDK CLI with self-signed certificate in certificate chain on SSO.GetRoleCredentials, and the user saw only "Unable to resolve AWS account to use".

This change resolves the CA bundle in the same order as botocore (Session.create_client and EndpointCreator._get_verify_value):

1. --ca-bundle-path / caBundlePath in cdk.json
2. AWS_CA_BUNDLE (the existing lowercase aws_ca_bundle check stays)
3. the ca_bundle setting of the profile in the shared credentials file, then the shared config file (botocore merges the credentials file over the config file). The profile is --profile, then AWS_PROFILE, then AWS_DEFAULT_PROFILE, then default. The files are read with @smithy/shared-ini-file-loader, which is already a dependency and honours AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE.
4. REQUESTS_CA_BUNDLE

The source that was used is logged at debug level, for example Using CA bundle path from REQUESTS_CA_BUNDLE: /path/to/bundle.pem.

No other wiring was needed. The resolved bundle goes into the ProxyAgent, which sdkRequestHandler() passes to the credential chain as clientConfig.requestHandler. The SDK's SSOClient (GetRoleCredentials) and SSOOIDCClient (token refresh) are built from that clientConfig, so the reporter's SSO path now uses the bundle. The detached telemetry sender gets the resolved path the same way it did before.

I updated the --ca-bundle-path help text in cli-config.ts and regenerated parse-command-line-arguments.ts, user-input.ts and cli-type-registry.json with the package's pre-compile task.

Decisions to flag:

• The profile is picked the way AwsCliCompatible in toolkit-lib already picks it (AWS_PROFILE before AWS_DEFAULT_PROFILE). Botocore's own chain lists AWS_DEFAULT_PROFILE first; I followed the existing CDK convention so the bundle and the credentials come from the same profile.
• SSL_CERT_FILE is not used. Botocore ignores it too, and this PR aims for parity with the AWS CLI. A test pins this down.
• The resolution order matches botocore: the first source that is set wins, even if the file it names doesn't exist. Before this change a missing file meant "no bundle", and that is unchanged.
• The integ-runner has its own proxy-agent.ts that only reads AWS_CA_BUNDLE. I left it alone to keep this PR to one concern.

Testing: new unit tests in packages/aws-cdk/test/cli/proxy-agent.test.ts cover each precedence step using temporary AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE files: explicit path, AWS_CA_BUNDLE, the profile ca_bundle from --profile/AWS_PROFILE/AWS_DEFAULT_PROFILE/default, credentials file over config file, REQUESTS_CA_BUNDLE, no config file, and SSL_CERT_FILE being ignored. I didn't add an integration test because it would need a TLS-intercepting proxy.

I used an AI coding assistant for parts of this change and reviewed and tested it myself.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[maintainer-for-aws]

Automated review

A maintainer will still review this — treat the notes below as a starting point.

📌 Commit 4ae3121

This PR fixes a bug (#1545) where the CDK CLI ignored a custom CA bundle unless AWS_CA_BUNDLE was set, causing SSO and other calls to fail behind TLS-intercepting corporate proxies. It extends CA-bundle resolution in proxy-agent.ts to mirror the AWS CLI/botocore order: explicit --ca-bundle-path, then AWS_CA_BUNDLE, then the active profile's ca_bundle setting (read from the shared credentials file then the config file), then REQUESTS_CA_BUNDLE. A new profile option is threaded through from cli.ts, resolution now carries a source label for the debug log, and the --ca-bundle-path help text is regenerated across the generated argument files. The change is clean and well-scoped: the profile-key lookup matches how the shared-ini loader normalizes section headers, the new @smithy/shared-ini-file-loader usage relies on an already-declared dependency, the best-effort config read correctly logs and falls back on failure without changing existing falsy semantics, and the new test suite exercises every precedence step plus negative cases while restoring all mutated env vars and temp files. No issues found on this change.

🔴 0 blocking · 🟡 0 recommended · ⚪ 0 optional

---

Generated automatically. React 👍 or 👎 to tell us whether this review helped, so we can improve these reviews.