[aws-lambda-nodejs] Using NodeJSFunction construct behind corporate firewall

[lukemerryDHCS]

Attempting to synthesize or deploy a project containing a NodeJSFunction construct fails due to a https packet inspection certificate in use on my organization's corporate network. Typically when working with Docker containers, we have to either provide the proxy certificate to whatever CLI tools are running in the container, or set the tool to not validate certificates, but since this is abstracted away by the construct, I can't figure out a way to provide it or set npm's strict-ssl parameter to false within the docker container.

Use Case

Building a CDK project that contains a NodeJSLambda construct from behind a corporate https inspection firewall.

Proposed Solution

Add a way to set strict-ssl to false or provide a CA in the docker container used to build the lambda. Since CDK respects the value of AWS_CA_BUNDLE environment variable, perhaps there is a way to make it work transparently using this certificate?

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[eladb]

@jogold wdyt?

[jogold]

@eladb we can easily support this like this I think:

ARG STRICT_SSL=true
ENV npm_config_strict_ssl=$STRICT_SSL

then

new lambda.NodejsFunction(this, 'my-handler', {
  buildArgs: {
    STRICT_SSL: 'false',
  },
});

@lukemerryDHCS using a HTTPS proxy is not a solution for you?

new lambda.NodejsFunction(this, 'my-handler', {
  buildArgs: {
    HTTPS_PROXY: 'https://127.0.0.1:3001',
  },
});

[lukemerryDHCS]

@jogold I don't think so. My organization decrypts and reencrypts everything with a self-signed certificate, but as far as I'm aware there is not a proxy available. We typically have to set each command line tool (npm, .net core cli, git, etc) to trust the self-signed cert, and docker is always an extra headache since it has to be done inside the running container as well.

[lukemerryDHCS]

Another approach that I think could be useful would be to provide a parameter to override the build image. This could be a nice way of getting around this problem while also adding more versatility to the construct.

[jogold]

@eladb what do you say? add an option to disable SSL validation or to override the build image?

[hoegertn]

I would prefer the custom build image.

1. There will be other requests that we would need to handle then
2. disabling SSL is a nightmare from a security POV and I would not introduce this to the world for some corner case.