Allow aws-cli to trust OS certificates

[joaocc]

Describe the feature

Allow aws-cli to trust certificates that are trusted by the OS.

Use Case

On organizations that deploy traffic inspecting firewalls/proxies, it is necessary to deploy custom trusted root certificates, either internal or external. In many cases (even of commercial software) the trusted roots are usually signed by entities that are not trusted by default.
Current mechanism requires setting env vars or providing variables.
While this is interesting in some scenarios, it doesn't permit deployment and management scenarios where IT departments can simply deploy the certificates to the machines under their management, as it requires all uses of aws-cli to be changed to have to manage the certificates and their configuration. Not permitting an easy centralisation, not only increases the cost and effort for effective deployment, but also opens up a set of security and compliance risks.
If aws-cli would allow trusting the OS certificates - either by default or by explicit config (via the usual env var, cli arg or config file), new use cases would be possible/easier/cheaper, while at the same time avoiding any kind of impact on existing users.

Proposed Solution

Option 1: trust OS certificates by default, with config option (env, flag, file) to revert to current behaviour
Option 2: add new config option (env, flag, file) to enable trusting OS certificates

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CLI version used

aws-cli/2.15.0

Environment details (OS name and version, etc.)

macOS, windows, linux

[tim-finnigan]

Thanks for the feature request. I'm going to transfer this to our cross-SDK repository since requests involving shared configurations or environment variables (like ca_bundle or AWS_CA_BUNDLE) must be considered across SDKs. If you or others can share more details on use cases and why this is needed please let us know. And others can 👍 this feature if interested.

[trickyearlobe]

Main reason this would be useful to me is that my organisation uses SSL intercept to inspect web traffic for malicious requests and data exfiltration (DLP).

This is done in most organisations at the network or proxy level (in my case, by ZScaler). The end user devices trust an internal root CA, and SSL certs for public internet hosts are generated on-the-fly to perform a MITM inspection of traffic.