Feature Request: Add support for configuring a proxy on a per client basis

[mcvayc]

Type: Feature

Is your feature request related to a problem? Please describe. None of the current properties allow a proxy to be configured for an AWS client.

When developing software behind a corporate proxy, autowired AWS Clients cannot access AWS services so the application cannot be tested locally without overriding the client bean and manually creating a client with a proxy configured.

Describe the solution you'd like I propose that the following properties be added:

spring.cloud.aws.proxy.host
spring.cloud.aws.proxy.port
spring.cloud.aws.proxy.username
spring.cloud.aws.proxy.password

spring.cloud.aws.dynamodb.proxy.enabled
spring.cloud.aws.s3.proxy.enabled
spring.cloud.aws.ses.proxy.enabled
spring.cloud.aws.sns.proxy.enabled
spring.cloud.aws.sqs.proxy.enabled
spring.cloud.aws.secretsmanager.proxy.enabled
spring.cloud.aws.parameterstore.proxy.enabled
spring.cloud.aws.cloudwatch.proxy.enabled

The value of spring.cloud.aws.<client-type>.proxy.enabled defaults to false.

If spring.cloud.aws.<client-type>.proxy.enabled is true then spring.cloud.aws.proxy.host and spring.cloud.aws.proxy.port are required. Otherwise they are optional.

The properties spring.cloud.aws.proxy.username and spring.cloud.aws.proxy.password are always optional.

if spring.cloud.aws.<client-type>.proxy.enabled is not defined, no proxy is set for that particular client.

Describe alternatives you've considered

Overriding the AWS client beans to create a client that has a proxy configured. This approach is requires coding and makes it more difficult to leverage the other configuration properties supported by spring-cloud-aws.

We also considered a design with a single set of properties for all AWS clients to share. With this design, setting the proxy would force all clients to use the proxy. Such a design is not preferred because some VPCs that do not have Internet access may have VPC Gateway Endpoints for DynamoDB and S3 but not have VPC Interface Endpoints enabled for services like CloudWatch, SNS, SQS, etc. For VPCs that have VPC Gateway Endpoints but which are not allowed to configure VPC Interface Endpoints or have Internet access, the S3 and DynamoDB clients would not need a proxy while the other AWS clients would require one.

Additional context I welcome any feedback on the design and I would be happy to create a PR to contribute this feature.

[maciejwalkowiak]

Is there a need for spring.cloud.aws.<client-type>.proxy.enabled properties? Wouldn't setting host and port be enough?

[mcvayc]

Is there a need for spring.cloud.aws.<client-type>.proxy.enabled properties? Wouldn't setting host and port be enough?

This is require because some clients might not need to use the proxy, like if a VPC endpoint is configured for DDB of S3, while others will still require a proxy.

[maciejwalkowiak]

Got it. Yes, totally makes sense, you're welcome to submit a PR. Do you still have time and will?

[consal]

Hello, in the original question, you mentioned overriding the default client to add the proxy settings is possible. I need help to make it work. I created the following class, but the settings are not picked up by @SqsListener.

@Configuration
class S3AwsClientConfigurerConfiguration {

    @Bean
    AwsClientCustomizer<SqsClientBuilder> sqsClientBuilderAwsClientConfigurer() {
        return new AwsClientClientConfigurerSQS();
    }

    static class AwsClientClientConfigurerSQS implements AwsClientCustomizer<SqsClientBuilder> {
        @Override
        public SdkHttpClient httpClient() {
            return ApacheHttpClient.builder()
                .proxyConfiguration(ProxyConfiguration.builder()
                    .endpoint(URI.create("http://myproxy.com:8080"))
                    .build())
                .build();
        }
    }
}