Give a Boto3 Client an Explicit Proxy Map

Boto3 accepts an explicit proxy policy through botocore’s Config object:

import boto3
from botocore.config import Config

network = Config(proxies={
    'http': 'http://proxy.example:8080',
    'https': 'http://proxy.example:8080',
})
s3 = boto3.client('s3', config=network)

The map keys select the destination protocol. Its values describe the proxy endpoint. This example sends both HTTP and HTTPS service requests through one HTTP forward proxy. For a permitted public AWS endpoint test with no proxy account, an HTTP entry from the HTTP proxy list can supply those two URLs.

An https:// value would instead require a proxy listener that accepts a TLS connection from the client. Do not change the value’s scheme merely to match the HTTPS key.

Config.proxies overrides proxy selection from the HTTP_PROXY and HTTPS_PROXY environment variables for that client. Other clients can be constructed with their own Config objects; constructing this one does not change a process-wide environment variable.

Preserve any other required client options, such as region and retry policy, when incorporating this into an application. AWS credentials remain in the application’s normal credential configuration. No modification of EndpointCreator or another private botocore method is needed.

For a TLS connection to an HTTPS proxy, Config also has proxies_config options such as proxy_ca_bundle and proxy_client_cert. Those concern trust and client-certificate authentication on the proxy connection. They are separate from selecting the AWS service endpoint or signing AWS API requests.