Private VPCE: Cloudwatch agent POSTs failing with TLS/CN mismatch error

[aws]

Private VPCE: Cloudwatch agent POSTs failing with TLS/CN mismatch error

[pingleig]

Based on the code, we are using the default http client with default tls transport in aws go sdk, so there is no config for the insecure option.

https://github.com/aws/amazon-cloudwatch-agent/blob/master/plugins/outputs/cloudwatchlogs/cloudwatchlogs.go#L111-L116

	client := cloudwatchlogs.New(
		credentialConfig.Credentials(),
		&aws.Config{
			Endpoint: aws.String(c.EndpointOverride),
		},
	)

I feel it's a valid feature request to allow users to configure it, as long as they are aware of the potential problem of those configs.

I will bring it up to the team, but it is likely going to be bundled with other bigger feature/fixes, so there is no clear timeline...
If you do need it right away, the easiest way is to update those lines to pass a http client with transport that skips tls verify, and build the deb/docker image from source

[github-actions]

This issue was marked stale due to lack of activity.

[jhnlsn]

To close this one out for anyone that needs this info in the future. You need to set the AWS_CA_BUNDLE environment variable with your private CA bundle. See for more information: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html