fix(runtime-secrets): fetch the boot secret through the configured proxy

The Secrets Manager client used the SDK's Node handler, which ignores
HTTPS_PROXY, so a container whose only egress is a proxy could not load its
env and never booted. Under Bun with a proxy set, send through Bun's fetch,
which honors HTTPS_PROXY/HTTP_PROXY/NO_PROXY. apps/sim's awsRequestHandler
is out of reach for packages and the realtime bootstrap needs the same path.

Author: waleedlatif1

bun.lock

@@ -31,7 +31,8 @@
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "3.1150.0",
     "@sim/logger": "workspace:*",
-    "@sim/utils": "workspace:*"
+    "@sim/utils": "workspace:*",
+    "@smithy/fetch-http-handler": "5.8.0"
   },
   "devDependencies": {
     "@sim/tsconfig": "workspace:*",

packages/runtime-secrets/package.json

@@ -4,6 +4,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { backoffWithJitter } from '@sim/utils/retry'
+import { FetchHttpHandler } from '@smithy/fetch-http-handler'
 
 const logger = createLogger('RuntimeSecrets')
 
@@ -56,9 +57,11 @@ export async function loadRuntimeSecrets(): Promise<void> {
  * times, then throws, so a caller never proceeds on a partial or missing secret.
  */
 export async function fetchRuntimeSecrets(secretId: string): Promise<Record<string, string>> {
-  const client = new SecretsManagerClient(
-    process.env.AWS_REGION ? { region: process.env.AWS_REGION } : {}
-  )
+  const requestHandler = proxyAwareRequestHandler()
+  const client = new SecretsManagerClient({
+    ...(process.env.AWS_REGION ? { region: process.env.AWS_REGION } : {}),
+    ...(requestHandler ? { requestHandler } : {}),
+  })
   const entries = parseSecretJson(await fetchSecretString(client, secretId))
   return Object.fromEntries(
     Object.entries(entries).map(([key, value]) => [
@@ -68,6 +71,22 @@ export async function fetchRuntimeSecrets(secretId: string): Promise<Record<stri
   )
 }
 
+const PROXY_ENV = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy'] as const
+
+/**
+ * The SDK's default Node handler ignores `HTTPS_PROXY`, so a container whose only egress is a
+ * proxy could not fetch its config and would never boot. While a proxy is set under Bun (both
+ * container bootstraps run on Bun), requests go through Bun's `fetch`, which honors
+ * `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`. The app's `awsRequestHandler` lives in `apps/sim`,
+ * which packages cannot import, and the realtime bootstrap needs this path too. Undefined
+ * otherwise, leaving the SDK default in place.
+ */
+function proxyAwareRequestHandler(): FetchHttpHandler | undefined {
+  if (!process.versions.bun) return undefined
+  if (!PROXY_ENV.some((name) => process.env[name]?.trim())) return undefined
+  return new FetchHttpHandler()
+}
+
 async function fetchSecretString(client: SecretsManagerClient, secretId: string): Promise<string> {
   const response = await sendWithRetry(client, secretId)
   if (!response.SecretString) {

packages/runtime-secrets/src/index.ts

@@ -0,0 +1,58 @@
+import { execFile } from 'node:child_process'
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { fileURLToPath } from 'node:url'
+import { promisify } from 'node:util'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+
+const tunnels: string[] = []
+let proxy: Server
+let proxyUrl = ''
+
+beforeAll(async () => {
+  proxy = createServer((_req, res) => res.end())
+  proxy.on('connect', (req, socket) => {
+    socket.on('error', () => {})
+    tunnels.push(String(req.url))
+    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n')
+  })
+  await new Promise<void>((resolve) => proxy.listen(0, '127.0.0.1', resolve))
+  proxyUrl = `http://127.0.0.1:${(proxy.address() as AddressInfo).port}`
+})
+
+afterAll(async () => {
+  proxy.closeAllConnections()
+  await new Promise<void>((resolve) => proxy.close(() => resolve()))
+})
+
+describe('loadRuntimeSecrets under a proxy-only egress', () => {
+  it('reaches Secrets Manager through HTTPS_PROXY under the Bun runtime', async () => {
+    const entry = fileURLToPath(new URL('./index.ts', import.meta.url))
+    const run = promisify(execFile)(
+      'bun',
+      [
+        '--no-env-file',
+        '-e',
+        `await (await import(${JSON.stringify(entry)})).loadRuntimeSecrets()`,
+      ],
+      {
+        timeout: 20_000,
+        env: {
+          PATH: process.env.PATH,
+          HOME: process.env.HOME,
+          SIM_ENV_SECRET_ID: '/test/sim/env-vars',
+          AWS_REGION: 'us-east-1',
+          AWS_ACCESS_KEY_ID: 'AKIDEXAMPLE',
+          AWS_SECRET_ACCESS_KEY: 'secret',
+          AWS_CONFIG_FILE: '/dev/null',
+          AWS_SHARED_CREDENTIALS_FILE: '/dev/null',
+          AWS_ENDPOINT_URL_SECRETS_MANAGER: 'https://secrets.invalid',
+          HTTPS_PROXY: proxyUrl,
+          NO_PROXY: '',
+        },
+      }
+    )
+    await expect(run).rejects.toThrow(/Failed to fetch runtime secrets/)
+    expect(tunnels).toContain('secrets.invalid:443')
+  }, 30_000)
+})