From 4ae3121899e6536c78e8b9a93c07ab5efa8f8e42 Mon Sep 17 00:00:00 2001 From: Vamshidher Reddy Jannapu Reddy Date: Tue, 20 Oct 2026 23:01:23 -0500 Subject: [PATCH 1/2] fix(cli): custom CA bundle is ignored unless AWS_CA_BUNDLE is set Fixes #1545 The CLI only read a custom CA bundle from `--ca-bundle-path`/`caBundlePath` or `AWS_CA_BUNDLE`. The AWS CLI (botocore) also uses the `ca_bundle` setting of the active profile in the shared ini files and falls back to `REQUESTS_CA_BUNDLE`. Behind a TLS-intercepting proxy, a setup that works for `aws sso login` therefore failed in the CDK CLI with "self-signed certificate in certificate chain" on SSO.GetRoleCredentials. Resolve the bundle in botocore's order: explicit configuration, then `AWS_CA_BUNDLE`, then the profile's `ca_bundle` (credentials file over config file, read with `@smithy/shared-ini-file-loader`; profile from `--profile`, `AWS_PROFILE`, `AWS_DEFAULT_PROFILE`, `default`, as `AwsCliCompatible` already does), then `REQUESTS_CA_BUNDLE`. The chosen source is logged at debug level. The bundle already reaches the SSO and SSO-OIDC clients through the request handler's agent, so no other wiring changes are needed. --- packages/aws-cdk/lib/cli/cli-config.ts | 2 +- .../aws-cdk/lib/cli/cli-type-registry.json | 2 +- packages/aws-cdk/lib/cli/cli.ts | 1 + .../lib/cli/parse-command-line-arguments.ts | 2 +- packages/aws-cdk/lib/cli/proxy-agent.ts | 65 +++++++-- packages/aws-cdk/lib/cli/user-input.ts | 2 +- packages/aws-cdk/test/cli/proxy-agent.test.ts | 138 +++++++++++++++++- 7 files changed, 197 insertions(+), 15 deletions(-) diff --git a/packages/aws-cdk/lib/cli/cli-config.ts b/packages/aws-cdk/lib/cli/cli-config.ts index ed80c5a48..25d5d70fd 100644 --- a/packages/aws-cdk/lib/cli/cli-config.ts +++ b/packages/aws-cdk/lib/cli/cli-config.ts @@ -35,7 +35,7 @@ export async function makeConfig(): Promise { 'profile': { type: 'string', desc: 'Use the indicated AWS profile as the default environment', requiresArg: true }, 'region': { type: 'string', desc: 'Use the indicated AWS region as the default region', requiresArg: true }, 'proxy': { type: 'string', desc: 'Use the indicated proxy. Will read from HTTPS_PROXY environment variable if not specified', requiresArg: true }, - 'ca-bundle-path': { type: 'string', desc: 'Path to CA certificate to use when validating HTTPS requests. Will read from AWS_CA_BUNDLE environment variable if not specified', requiresArg: true }, + 'ca-bundle-path': { type: 'string', desc: 'Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable', requiresArg: true }, 'ec2creds': { type: 'boolean', alias: 'i', default: undefined, desc: 'Force trying to fetch EC2 instance credentials. Default: guess EC2 instance status' }, 'version-reporting': { type: 'boolean', desc: 'Disable CLI telemetry and do not include the "AWS::CDK::Metadata" resource in synthesized templates (enabled by default)', default: undefined, alias: 'telemetry' }, 'path-metadata': { type: 'boolean', desc: 'Include "aws:cdk:path" CloudFormation metadata for each resource (enabled by default)', default: undefined }, diff --git a/packages/aws-cdk/lib/cli/cli-type-registry.json b/packages/aws-cdk/lib/cli/cli-type-registry.json index cd1903738..b43775d1e 100644 --- a/packages/aws-cdk/lib/cli/cli-type-registry.json +++ b/packages/aws-cdk/lib/cli/cli-type-registry.json @@ -87,7 +87,7 @@ }, "ca-bundle-path": { "type": "string", - "desc": "Path to CA certificate to use when validating HTTPS requests. Will read from AWS_CA_BUNDLE environment variable if not specified", + "desc": "Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable", "requiresArg": true }, "ec2creds": { diff --git a/packages/aws-cdk/lib/cli/cli.ts b/packages/aws-cdk/lib/cli/cli.ts index b27a7493c..362a62496 100644 --- a/packages/aws-cdk/lib/cli/cli.ts +++ b/packages/aws-cdk/lib/cli/cli.ts @@ -135,6 +135,7 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise): any { .option('ca-bundle-path', { default: undefined, type: 'string', - desc: 'Path to CA certificate to use when validating HTTPS requests. Will read from AWS_CA_BUNDLE environment variable if not specified', + desc: 'Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable', requiresArg: true, }) .option('ec2creds', { diff --git a/packages/aws-cdk/lib/cli/proxy-agent.ts b/packages/aws-cdk/lib/cli/proxy-agent.ts index 0864fd256..a259d8d66 100644 --- a/packages/aws-cdk/lib/cli/proxy-agent.ts +++ b/packages/aws-cdk/lib/cli/proxy-agent.ts @@ -1,4 +1,5 @@ import * as path from 'node:path'; +import { loadSharedConfigFiles } from '@smithy/shared-ini-file-loader'; import * as fs from 'fs-extra'; import { ProxyAgent, proxies } from 'proxy-agent'; import { ToolkitError } from '../api-private-error'; @@ -63,9 +64,17 @@ interface ProxyAgentOptions { /** * A path to a certificate bundle that contains a cert to be trusted. * - * @default No certificate bundle + * @default - resolved from the environment and the shared AWS config files, the same way the AWS CLI does */ readonly caBundlePath?: string; + + /** + * The AWS profile whose `ca_bundle` setting is consulted when no CA bundle is configured explicitly + * or through `AWS_CA_BUNDLE`. + * + * @default - `AWS_PROFILE`, then `AWS_DEFAULT_PROFILE`, then `default` + */ + readonly profile?: string; } /** @@ -123,7 +132,7 @@ export class ProxyAgentProvider { ? () => Promise.resolve(proxyAddress) : undefined; - const caBundlePath = await this.resolveCABundlePath(normalizeNetworkSetting(options.caBundlePath)); + const caBundlePath = await this.resolveCABundlePath(normalizeNetworkSetting(options.caBundlePath), options.profile); return { agent: new ProxyAgent({ @@ -139,15 +148,17 @@ export class ProxyAgentProvider { * * Absolute because the path is handed to the detached sender, which runs from a different cwd. */ - private async resolveCABundlePath(bundlePath?: string): Promise { - const configured = bundlePath || this.caBundlePathFromEnvironment(); + private async resolveCABundlePath(bundlePath?: string, profile?: string): Promise { + const configured = bundlePath + ? { path: bundlePath, source: '--ca-bundle-path (caBundlePath setting)' } + : await this.caBundlePathFromEnvironment(profile); if (!configured) { return undefined; } try { - const resolved = path.resolve(configured); - await this.ioHelper.defaults.debug(`Using CA bundle path: ${resolved}`); + const resolved = path.resolve(configured.path); + await this.ioHelper.defaults.debug(`Using CA bundle path from ${configured.source}: ${resolved}`); return fs.pathExistsSync(resolved) ? resolved : undefined; } catch (e: any) { await this.ioHelper.defaults.debug(String(e)); @@ -168,15 +179,49 @@ export class ProxyAgentProvider { } /** - * Find and return a CA certificate bundle path to be passed into the SDK. + * Find a CA certificate bundle path the same way the AWS CLI does when none is given explicitly. + * + * The order mirrors botocore: the `AWS_CA_BUNDLE` environment variable, then the `ca_bundle` setting + * of the active profile in the shared credentials/config files, then the `REQUESTS_CA_BUNDLE` + * environment variable. + * + * The profile is picked the way `AwsCliCompatible` in toolkit-lib picks it: `--profile`, then + * `AWS_PROFILE`, then `AWS_DEFAULT_PROFILE`, then `default`. */ - private caBundlePathFromEnvironment(): string | undefined { + private async caBundlePathFromEnvironment(profile?: string): Promise<{ path: string; source: string } | undefined> { if (process.env.aws_ca_bundle) { - return process.env.aws_ca_bundle; + return { path: process.env.aws_ca_bundle, source: 'aws_ca_bundle' }; } if (process.env.AWS_CA_BUNDLE) { - return process.env.AWS_CA_BUNDLE; + return { path: process.env.AWS_CA_BUNDLE, source: 'AWS_CA_BUNDLE' }; + } + + const profileName = profile || process.env.AWS_PROFILE || process.env.AWS_DEFAULT_PROFILE || 'default'; + const profileCaBundle = await this.caBundlePathFromProfile(profileName); + if (profileCaBundle) { + return { path: profileCaBundle, source: `ca_bundle of profile '${profileName}'` }; + } + + if (process.env.REQUESTS_CA_BUNDLE) { + return { path: process.env.REQUESTS_CA_BUNDLE, source: 'REQUESTS_CA_BUNDLE' }; } return undefined; } + + /** + * The `ca_bundle` setting of a profile in the shared ini files. + * + * The credentials file is consulted before the config file because botocore merges the credentials + * file over the config file, and that is also the order `AwsCliCompatible` uses for the region. + */ + private async caBundlePathFromProfile(profile: string): Promise { + try { + const { credentialsFile, configFile } = await loadSharedConfigFiles({ ignoreCache: true }); + const caBundle = credentialsFile?.[profile]?.ca_bundle ?? configFile?.[profile]?.ca_bundle; + return typeof caBundle === 'string' && caBundle ? caBundle : undefined; + } catch (e: any) { + await this.ioHelper.defaults.debug(`Could not read ca_bundle from the AWS config files: ${e}`); + return undefined; + } + } } diff --git a/packages/aws-cdk/lib/cli/user-input.ts b/packages/aws-cdk/lib/cli/user-input.ts index 33368a483..534c1672d 100644 --- a/packages/aws-cdk/lib/cli/user-input.ts +++ b/packages/aws-cdk/lib/cli/user-input.ts @@ -284,7 +284,7 @@ export interface GlobalOptions { readonly proxy?: string; /** - * Path to CA certificate to use when validating HTTPS requests. Will read from AWS_CA_BUNDLE environment variable if not specified + * Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable * * @default - undefined */ diff --git a/packages/aws-cdk/test/cli/proxy-agent.test.ts b/packages/aws-cdk/test/cli/proxy-agent.test.ts index c662d5bc8..ca0d0a0a8 100644 --- a/packages/aws-cdk/test/cli/proxy-agent.test.ts +++ b/packages/aws-cdk/test/cli/proxy-agent.test.ts @@ -1,6 +1,8 @@ +import * as os from 'node:os'; import * as path from 'node:path'; +import * as fs from 'fs-extra'; import { normalizeNetworkSetting, ProxyAgentProvider, validateProxyAddress } from '../../lib/cli/proxy-agent'; -import { TestIoHost } from '../_helpers/io-host'; +import { expectIoMsg, TestIoHost } from '../_helpers/io-host'; describe('validateProxyAddress', () => { test.each([ @@ -49,6 +51,140 @@ describe('ProxyAgentProvider', () => { }); }); +describe('CA bundle resolution', () => { + const ENV_VARS = [ + 'aws_ca_bundle', 'AWS_CA_BUNDLE', 'REQUESTS_CA_BUNDLE', 'SSL_CERT_FILE', + 'AWS_CONFIG_FILE', 'AWS_SHARED_CREDENTIALS_FILE', 'AWS_PROFILE', 'AWS_DEFAULT_PROFILE', + ]; + let savedEnv: Record; + let tmpDir: string; + let ioHost: TestIoHost; + const bundles: Record = {}; + + beforeEach(() => { + savedEnv = Object.fromEntries(ENV_VARS.map((name) => [name, process.env[name]])); + ENV_VARS.forEach((name) => delete process.env[name]); + + tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cdk-ca-bundle-')); + for (const name of ['explicit', 'aws-env', 'default-profile', 'named-profile', 'credentials-file', 'requests-env']) { + bundles[name] = path.join(tmpDir, `${name}.pem`); + fs.writeFileSync(bundles[name], `-----BEGIN CERTIFICATE-----\n${name}\n-----END CERTIFICATE-----\n`); + } + + const configFile = path.join(tmpDir, 'config'); + fs.writeFileSync(configFile, [ + '[default]', + `ca_bundle = ${bundles['default-profile']}`, + '', + '[profile named]', + `ca_bundle = ${bundles['named-profile']}`, + '', + '[profile no-bundle]', + 'region = us-east-1', + '', + ].join('\n')); + process.env.AWS_CONFIG_FILE = configFile; + // Keep the developer's own ~/.aws/credentials out of the picture; a test that needs one writes it. + process.env.AWS_SHARED_CREDENTIALS_FILE = path.join(tmpDir, 'no-credentials'); + + ioHost = new TestIoHost('debug'); + }); + + afterEach(() => { + for (const [name, value] of Object.entries(savedEnv)) { + if (value === undefined) { + delete process.env[name]; + } else { + process.env[name] = value; + } + } + fs.removeSync(tmpDir); + }); + + async function resolveBundle(options: { caBundlePath?: string; profile?: string } = {}) { + const { caBundlePath } = await new ProxyAgentProvider(ioHost.asHelper('deploy')).create(options); + return caBundlePath; + } + + test('an explicit caBundlePath wins over everything else', async () => { + process.env.AWS_CA_BUNDLE = bundles['aws-env']; + process.env.REQUESTS_CA_BUNDLE = bundles['requests-env']; + + await expect(resolveBundle({ caBundlePath: bundles.explicit, profile: 'named' })).resolves.toBe(bundles.explicit); + expect(ioHost.notifySpy).toHaveBeenCalledWith(expectIoMsg(expect.stringContaining('from --ca-bundle-path'), 'debug')); + }); + + test('AWS_CA_BUNDLE wins over the profile ca_bundle and REQUESTS_CA_BUNDLE', async () => { + process.env.AWS_CA_BUNDLE = bundles['aws-env']; + process.env.REQUESTS_CA_BUNDLE = bundles['requests-env']; + + await expect(resolveBundle({ profile: 'named' })).resolves.toBe(bundles['aws-env']); + expect(ioHost.notifySpy).toHaveBeenCalledWith(expectIoMsg(`Using CA bundle path from AWS_CA_BUNDLE: ${bundles['aws-env']}`, 'debug')); + }); + + test('the ca_bundle of the profile passed in wins over REQUESTS_CA_BUNDLE', async () => { + process.env.REQUESTS_CA_BUNDLE = bundles['requests-env']; + + await expect(resolveBundle({ profile: 'named' })).resolves.toBe(bundles['named-profile']); + expect(ioHost.notifySpy).toHaveBeenCalledWith( + expectIoMsg(`Using CA bundle path from ca_bundle of profile 'named': ${bundles['named-profile']}`, 'debug'), + ); + }); + + test('a ca_bundle in the credentials file wins over the one in the config file, like botocore', async () => { + const credentialsFile = path.join(tmpDir, 'credentials'); + fs.writeFileSync(credentialsFile, ['[named]', `ca_bundle = ${bundles['credentials-file']}`, ''].join('\n')); + process.env.AWS_SHARED_CREDENTIALS_FILE = credentialsFile; + + await expect(resolveBundle({ profile: 'named' })).resolves.toBe(bundles['credentials-file']); + }); + + test('the profile falls back to AWS_PROFILE', async () => { + process.env.AWS_PROFILE = 'named'; + + await expect(resolveBundle()).resolves.toBe(bundles['named-profile']); + }); + + test('the profile falls back to AWS_DEFAULT_PROFILE', async () => { + process.env.AWS_DEFAULT_PROFILE = 'named'; + + await expect(resolveBundle()).resolves.toBe(bundles['named-profile']); + }); + + test('the profile falls back to the default profile', async () => { + await expect(resolveBundle()).resolves.toBe(bundles['default-profile']); + }); + + test('REQUESTS_CA_BUNDLE is used when the profile has no ca_bundle', async () => { + process.env.REQUESTS_CA_BUNDLE = bundles['requests-env']; + + await expect(resolveBundle({ profile: 'no-bundle' })).resolves.toBe(bundles['requests-env']); + expect(ioHost.notifySpy).toHaveBeenCalledWith( + expectIoMsg(`Using CA bundle path from REQUESTS_CA_BUNDLE: ${bundles['requests-env']}`, 'debug'), + ); + }); + + test('REQUESTS_CA_BUNDLE is used when there is no config file', async () => { + process.env.AWS_CONFIG_FILE = path.join(tmpDir, 'does-not-exist'); + process.env.REQUESTS_CA_BUNDLE = bundles['requests-env']; + + await expect(resolveBundle()).resolves.toBe(bundles['requests-env']); + }); + + test('no CA bundle when nothing is configured', async () => { + process.env.AWS_CONFIG_FILE = path.join(tmpDir, 'does-not-exist'); + + await expect(resolveBundle()).resolves.toBeUndefined(); + }); + + test('SSL_CERT_FILE is not consulted, matching the AWS CLI', async () => { + process.env.SSL_CERT_FILE = bundles['requests-env']; + process.env.AWS_CONFIG_FILE = path.join(tmpDir, 'does-not-exist'); + + await expect(resolveBundle()).resolves.toBeUndefined(); + }); +}); + describe('normalizeNetworkSetting', () => { test('keeps an empty string, which means "go direct" and is NOT the same as unconfigured', () => { // The whole point of normalizing: a truthiness check here would turn an explicit `--proxy ''` From 2d759d7d009887621a969d12d7efdd391001a7e2 Mon Sep 17 00:00:00 2001 From: moneytools Date: Mon, 2 Nov 2026 13:22:31 -0600 Subject: [PATCH 2/2] chore(cli): drop AWS CLI comparisons from code comments and help text --- packages/aws-cdk/lib/cli/cli-config.ts | 2 +- packages/aws-cdk/lib/cli/cli-type-registry.json | 2 +- .../aws-cdk/lib/cli/parse-command-line-arguments.ts | 2 +- packages/aws-cdk/lib/cli/proxy-agent.ts | 10 +++++----- packages/aws-cdk/lib/cli/user-input.ts | 2 +- packages/aws-cdk/test/cli/proxy-agent.test.ts | 4 ++-- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/packages/aws-cdk/lib/cli/cli-config.ts b/packages/aws-cdk/lib/cli/cli-config.ts index 25d5d70fd..25a40f7ac 100644 --- a/packages/aws-cdk/lib/cli/cli-config.ts +++ b/packages/aws-cdk/lib/cli/cli-config.ts @@ -35,7 +35,7 @@ export async function makeConfig(): Promise { 'profile': { type: 'string', desc: 'Use the indicated AWS profile as the default environment', requiresArg: true }, 'region': { type: 'string', desc: 'Use the indicated AWS region as the default region', requiresArg: true }, 'proxy': { type: 'string', desc: 'Use the indicated proxy. Will read from HTTPS_PROXY environment variable if not specified', requiresArg: true }, - 'ca-bundle-path': { type: 'string', desc: 'Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable', requiresArg: true }, + 'ca-bundle-path': { type: 'string', desc: 'Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved from the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable', requiresArg: true }, 'ec2creds': { type: 'boolean', alias: 'i', default: undefined, desc: 'Force trying to fetch EC2 instance credentials. Default: guess EC2 instance status' }, 'version-reporting': { type: 'boolean', desc: 'Disable CLI telemetry and do not include the "AWS::CDK::Metadata" resource in synthesized templates (enabled by default)', default: undefined, alias: 'telemetry' }, 'path-metadata': { type: 'boolean', desc: 'Include "aws:cdk:path" CloudFormation metadata for each resource (enabled by default)', default: undefined }, diff --git a/packages/aws-cdk/lib/cli/cli-type-registry.json b/packages/aws-cdk/lib/cli/cli-type-registry.json index b43775d1e..af774a241 100644 --- a/packages/aws-cdk/lib/cli/cli-type-registry.json +++ b/packages/aws-cdk/lib/cli/cli-type-registry.json @@ -87,7 +87,7 @@ }, "ca-bundle-path": { "type": "string", - "desc": "Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable", + "desc": "Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved from the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable", "requiresArg": true }, "ec2creds": { diff --git a/packages/aws-cdk/lib/cli/parse-command-line-arguments.ts b/packages/aws-cdk/lib/cli/parse-command-line-arguments.ts index d1dc01c64..e9ef9d12e 100644 --- a/packages/aws-cdk/lib/cli/parse-command-line-arguments.ts +++ b/packages/aws-cdk/lib/cli/parse-command-line-arguments.ts @@ -107,7 +107,7 @@ export function parseCommandLineArguments(args: Array): any { .option('ca-bundle-path', { default: undefined, type: 'string', - desc: 'Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable', + desc: 'Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved from the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable', requiresArg: true, }) .option('ec2creds', { diff --git a/packages/aws-cdk/lib/cli/proxy-agent.ts b/packages/aws-cdk/lib/cli/proxy-agent.ts index a259d8d66..bc390ed9a 100644 --- a/packages/aws-cdk/lib/cli/proxy-agent.ts +++ b/packages/aws-cdk/lib/cli/proxy-agent.ts @@ -64,7 +64,7 @@ interface ProxyAgentOptions { /** * A path to a certificate bundle that contains a cert to be trusted. * - * @default - resolved from the environment and the shared AWS config files, the same way the AWS CLI does + * @default - resolved from the environment and the shared AWS config files */ readonly caBundlePath?: string; @@ -179,9 +179,9 @@ export class ProxyAgentProvider { } /** - * Find a CA certificate bundle path the same way the AWS CLI does when none is given explicitly. + * Find a CA certificate bundle path when none is given explicitly. * - * The order mirrors botocore: the `AWS_CA_BUNDLE` environment variable, then the `ca_bundle` setting + * The order is: the `AWS_CA_BUNDLE` environment variable, then the `ca_bundle` setting * of the active profile in the shared credentials/config files, then the `REQUESTS_CA_BUNDLE` * environment variable. * @@ -211,8 +211,8 @@ export class ProxyAgentProvider { /** * The `ca_bundle` setting of a profile in the shared ini files. * - * The credentials file is consulted before the config file because botocore merges the credentials - * file over the config file, and that is also the order `AwsCliCompatible` uses for the region. + * The credentials file is consulted before the config file, the same order `AwsCliCompatible` + * uses for the region. */ private async caBundlePathFromProfile(profile: string): Promise { try { diff --git a/packages/aws-cdk/lib/cli/user-input.ts b/packages/aws-cdk/lib/cli/user-input.ts index 534c1672d..94d5edb72 100644 --- a/packages/aws-cdk/lib/cli/user-input.ts +++ b/packages/aws-cdk/lib/cli/user-input.ts @@ -284,7 +284,7 @@ export interface GlobalOptions { readonly proxy?: string; /** - * Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved like the AWS CLI does: the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable + * Path to CA certificate to use when validating HTTPS requests. If not specified, it is resolved from the AWS_CA_BUNDLE environment variable, then the ca_bundle setting of the AWS profile, then the REQUESTS_CA_BUNDLE environment variable * * @default - undefined */ diff --git a/packages/aws-cdk/test/cli/proxy-agent.test.ts b/packages/aws-cdk/test/cli/proxy-agent.test.ts index ca0d0a0a8..d3e32d679 100644 --- a/packages/aws-cdk/test/cli/proxy-agent.test.ts +++ b/packages/aws-cdk/test/cli/proxy-agent.test.ts @@ -131,7 +131,7 @@ describe('CA bundle resolution', () => { ); }); - test('a ca_bundle in the credentials file wins over the one in the config file, like botocore', async () => { + test('a ca_bundle in the credentials file wins over the one in the config file', async () => { const credentialsFile = path.join(tmpDir, 'credentials'); fs.writeFileSync(credentialsFile, ['[named]', `ca_bundle = ${bundles['credentials-file']}`, ''].join('\n')); process.env.AWS_SHARED_CREDENTIALS_FILE = credentialsFile; @@ -177,7 +177,7 @@ describe('CA bundle resolution', () => { await expect(resolveBundle()).resolves.toBeUndefined(); }); - test('SSL_CERT_FILE is not consulted, matching the AWS CLI', async () => { + test('SSL_CERT_FILE is not consulted', async () => { process.env.SSL_CERT_FILE = bundles['requests-env']; process.env.AWS_CONFIG_FILE = path.join(tmpDir, 'does-not-exist');