Configuring Envoy as a Forward Proxy with AWS API Gateway IAM Authorization

[njeddi]

Hello,

We are working on a use case where we want to configure Envoy as a forward proxy to intercept all egress traffic with external authentication using AWS API Gateway (IAM authorization). However, when attempting to use the External Authorization (ExtAuthz) filter, we encounter a 403 error without any logs being traced in API Gateway’s CloudWatch logs.

Here’s the flow we are trying to achieve:

1- Incoming request (to access an external URL)
2- Envoy (acting as the forward proxy)
3- External Authorization (ExtAuthz) with AWS API Gateway IAM Authorizer
4- If authentication is successful, the request is forwarded to the internet.

Could you confirm if Envoy is capable of handling this scenario? Additionally, if anyone has experience with this configuration, could you please share any example setups or guidance?

Thank you for your help!

Best regards,