Proxying the AWS CLI through Burp Suite

The AWS CLI validates TLS certificates against its own CA bundle, so Burp Suite’s self-signed CA is rejected by default. Rather than disabling verification (which generates noisy warnings), append Burp’s CA to the system certificate bundle and point the AWS CLI at the merged file.

Setup

1. Download Burp’s CA certificate from http://127.0.0.1:8080/cert (save as ~/Downloads/burp-suite.pem).

2. Merge with the system CA bundle:

   mkdir -p $HOME/.aws
   cat /etc/ssl/certs/ca-certificates.crt $HOME/Downloads/burp-suite.pem > $HOME/.aws/cert.pem

   On macOS with Homebrew, the system bundle lives at $(brew --prefix)/etc/ca-certificates/cert.pem.

3. Point the AWS CLI at the merged bundle in ~/.aws/config:

   [default]
   ca_bundle = /home/username/.aws/cert.pem

   The AWS CLI config file does not expand $HOME or ~ — use the full absolute path.

4. Create a proxied alias in ~/.bashrc or ~/.zshrc:

   alias aws-burp="env HTTP_PROXY=127.0.0.1:8080 HTTPS_PROXY=127.0.0.1:8080 $(which aws | head -1)"

Restart the shell. All aws-burp calls now route through Burp Suite with valid TLS — requests appear in the HTTP history for inspection, modification, and replay. This is useful for understanding what API calls a tool makes, testing IAM policy boundaries, or capturing request signing details. See aws-sigv4-api-flooding for an example of what raw AWS API traffic looks like when manipulated.

Sources

• Using an HTTP proxy for the AWS CLI — AWS Documentation
• Configuration and credential file settings in the AWS CLI — AWS Documentation
• Installing Burp’s CA certificate — PortSwigger

Related: burp-suite-firefox, owasp-zap, aws-sigv4-api-flooding, burp-suite-aws-signer-extension