Foglight Redshift agent fails to authenticate using IAM credentials due to proxy misconfiguration (4381649)

1. Configue the Proxy in the JVM

Add these parameters to baseline.jvmargs.config:

-Dhttp.proxyHost=proxy.company.com
-Dhttp.proxyPort=8080 
-Dhttps.proxyHost=proxy.company.com 
-Dhttps.proxyPort=8080

If the proxy requires authentication:

-Dhttp.proxyUser=my_proxy_user
-Dhttp.proxyPassword=mypassword
-Dhttps.proxyUser=my_proxy_user
-Dhttps.proxyPassword=mypassword

Optional for Java 11+ with Basic Auth proxies:
-Djdk.http.auth.tunneling.disabledSchemes=
-Djdk.http.auth.proxying.disabledSchemes=
(Empty value means allow all schemes.)

Important:

• Include both http and https properties.
• Do not include http:// or https:// in *.proxyHost.
• Remove any spaces around = in all properties.

2. Test Proxy Connectivity

Run this Powershell test from the FglAM host

Invoke-WebRequest -Uri "https://sts.amazonaws.com" -Proxy "http://proxy.company.com:8080" -TimeoutSec 30 

Expected: StatusCode 200 or AWS error page.

3. Confirm Firewall Rules

Allow outbound HTTPS (443) to:

• sts.amazonaws.com
• redshift.<region>.amazonaws.com

Workarounds

• Bypass Proxy for AWS Domains
  
  -Dhttp.nonProxyHosts="sts.amazonaws.com|*.amazonaws.com"
• Move Agent to a network with direct AWS access
• Proxy Bypass or Firewall Exceptions for AWS endpoints