cfn-init seems to ignore --http-proxy value for msi packages

Hi,
I've got CNF template creating Windows 2016 machines with UserData looking like this:

 "<script>\n",
            
            "cfn-init.exe --verbose --stack ",
            { "Ref" : "AWS::StackId" }, 
            " --resource MyResource",
            " --region ", 
            { "Ref" : "AWS::Region" }, 
            " --http-proxy http://", { "Ref" : "Proxy" },
            " --https-proxy http://", { "Ref" : "Proxy" },
            "\n", [...]

and CloudFormation::Init part:

"installCloudWatch":{
                "packages" : {
                  "msi" : {
                    "cloudwatch-msi" : "https://s3.amazonaws.com/amazoncloudwatch-agent/windows/amd64/latest/amazon-cloudwatch-agent.msi"
                  }
                }
              },

Problem: cfn-init still fails to download the msi. Error in UserdataExecution.log:
Message: The errors from user scripts: Error occurred during build: Failed to retrieve https://s3.amazonaws.com/amazoncloudwatch-agent/windows/amd64/latest/amazon-cloudwatch-agent.msi: ('Connection aborted.', error(10060, 'A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond'))

I double checked that I can download the file using Powershell and --proxy flag, i.e.

Invoke-WebRequest -Uri https://s3.amazonaws.com/amazoncloudwatch-agent/windows/amd64/latest/amazon-cloudwatch-agent.msi -OutFile C:\Temp\agent.msi -Proxy
http://my-proxy:{proxy_port}

Important to note that signalling constructs (cfn-signal, ResourceSignal), which require internet access, work properly.

Edited by: dima-cnqr on Feb 4, 2019 8:49 AM