If it is as simple as a permission issue, check out placing the CA pem file to some thing less restrictive like so: When you've got proxy additional to the ec2 devices and it can be in private subnet with a S3 vpc-endpoint hooked up. I had been getting the https://iam99778641.blogsvila.com/29310543/iam997-options