Repository: cdklabs/cdk-enterprise-iac (language: python)

Issue:
feat: allow for secure connection to a proxy using cfn-init
### Description

Currently [CloudFormationInit](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CloudFormationInit.html) doesn't support the `--http-proxy` or `--https-proxy` argument.

The proxy argument can include a password with should never be in plain text (e.g. `https://user:password@host:port`)

Because `@aws-cdk/aws-ec2` is a [dependency](https://github.com/aws/aws-cdk/blob/5eecb7b5e1a9335a453f5c5efd06b94e6fdc6ab3/packages/%40aws-cdk/aws-secretsmanager/package.json#L92) of [@aws-cdk/aws-secretsmanager](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager-readme.html), this can't be added natively to the `@aws-cdk/aws-ec2` where [CloudFormationInit](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CloudFormationInit.html) resides.

As a result, EC2 bootstrapping that leverages [Cloudformation helper scripts](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html) can be blocked when deploying in isolated networks that rely on proxies to broker traffic to the AWS control plane

### Use Case

Deployments into Isolated VPCs with limited network connectivity that rely on enterprise proxies to handle network traffic need the ability to set  the `--http-proxy` or `--https-proxy` argument when doing a [cfn-init](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html) or [cfn-signal](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-signal.html) command

### Proposed Solution

An aspect that can inject the `--http-proxy` or `--https-proxy` argument into the userdata generated when using [CloudFormationInit](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CloudFormationInit.html), allowing a [Secret](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.Secret.html) to be optionally used if a `--http-proxy` or `--https-proxy` argument requires a password for authentication

### Other information

_No response_

### Acknowledge

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change


Discussion / hints:

Fix patch:
diff --git a/.gitattributes b/.gitattributes
index a67b221..fb2716a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -19,5 +19,6 @@
 /API.md linguist-generated
 /LICENSE linguist-generated
 /package.json linguist-generated
+/test/integ/tsconfig.json linguist-generated
 /tsconfig.dev.json linguist-generated
 /yarn.lock linguist-generated
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index f23a5b0..f1d6224 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,13 @@ jspm_packages/
 .yarn-integrity
 .cache
 .vscode/
+*.d.ts
+*.generated.ts
+*.js
+*.js.map
+!**/*.integ.snapshot/**/asset.*/*.js
+!**/*.integ.snapshot/**/asset.*/*.d.ts
+!**/*.integ.snapshot/**/asset.*/**
 *.bak
 !/.projenrc.js
 /test-reports/
@@ -53,3 +60,4 @@ junit.xml
 .jsii
 tsconfig.json
 !/API.md
+!/test/integ/tsconfig.json
diff --git a/.projen/deps.json b/.projen/deps.json
index dfab406..6e22784 100644
--- a/.projen/deps.json
+++ b/.projen/deps.json
@@ -1,5 +1,15 @@
 {
   "dependencies": [
+    {
+      "name": "@aws-cdk/integ-runner",
+      "version": "^2",
+      "type": "build"
+    },
+    {
+      "name": "@aws-cdk/integ-tests-alpha",
+      "version": "2.41.0-alpha.0",
+      "type": "build"
+    },
     {
       "name": "@types/jest",
       "version": "^27",
diff --git a/.projen/files.json b/.projen/files.json
index 4aa4a94..36ee423 100644
--- a/.projen/files.json
+++ b/.projen/files.json
@@ -14,6 +14,7 @@
     ".projen/files.json",
     ".projen/tasks.json",
     "LICENSE",
+    "test/integ/tsconfig.json",
     "tsconfig.dev.json"
   ],
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
diff --git a/.projen/tasks.json b/.projen/tasks.json
index c39c413..08c8e9c 100644
--- a/.projen/tasks.json
+++ b/.projen/tasks.json
@@ -282,19 +282,19 @@
           "exec": "yarn upgrade npm-check-updates"
         },
         {
-          "exec": "npm-check-updates --dep dev --upgrade --target=minor --reject='aws-cdk-lib,constructs'"
+          "exec": "npm-check-updates --dep dev --upgrade --target=minor --reject='@aws-cdk/integ-tests-alpha,aws-cdk-lib,constructs'"
         },
         {
-          "exec": "npm-check-updates --dep optional --upgrade --target=minor --reject='aws-cdk-lib,constructs'"
+          "exec": "npm-check-updates --dep optional --upgrade --target=minor --reject='@aws-cdk/integ-tests-alpha,aws-cdk-lib,constructs'"
         },
         {
-          "exec": "npm-check-updates --dep peer --upgrade --target=minor --reject='aws-cdk-lib,constructs'"
+          "exec": "npm-check-updates --dep peer --upgrade --target=minor --reject='@aws-cdk/integ-tests-alpha,aws-cdk-lib,constructs'"
         },
         {
-          "exec": "npm-check-updates --dep prod --upgrade --target=minor --reject='aws-cdk-lib,constructs'"
+          "exec": "npm-check-updates --dep prod --upgrade --target=minor --reject='@aws-cdk/integ-tests-alpha,aws-cdk-lib,constructs'"
         },
         {
-          "exec": "npm-check-updates --dep bundle --upgrade --target=minor --reject='aws-cdk-lib,constructs'"
+          "exec": "npm-check-updates --dep bundle --upgrade --target=minor --reject='@aws-cdk/integ-tests-alpha,aws-cdk-lib,constructs'"
         },
         {
           "exec": "yarn install --check-files"
diff --git a/.projenrc.js b/.projenrc.js
index eefd613..f16a03d 100644
--- a/.projenrc.js
+++ b/.projenrc.js
@@ -2,8 +2,7 @@
 Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 SPDX-License-Identifier: Apache-2.0
 */
-const { awscdk, JsonPatch } = require('projen');
-const { GitlabConfiguration } = require('projen/lib/gitlab');
+const { awscdk, JsonPatch, JsonFile } = require('projen');
 const project = new awscdk.AwsCdkConstructLibrary({
   author: 'Taylor Ondrey',
   authorAddress: 'ondreyt@amazon.com',
@@ -11,8 +10,22 @@ const project = new awscdk.AwsCdkConstructLibrary({
   defaultReleaseBranch: 'main',
   name: '@cdklabs/cdk-enterprise-iac',
   repositoryUrl: 'https://github.com/cdklabs/cdk-enterprise-iac.git',
-  devDeps: ['eslint-plugin-security'],
-  gitignore: ['.vscode/', '*.bak'],
+  devDeps: [
+    'eslint-plugin-security',
+    '@aws-cdk/integ-tests-alpha@2.41.0-alpha.0',
+    '@aws-cdk/integ-runner@^2',
+  ],
+  gitignore: [
+    '.vscode/',
+    '*.d.ts',
+    '*.generated.ts',
+    '*.js',
+    '*.js.map',
+    '!**/*.integ.snapshot/**/asset.*/*.js',
+    '!**/*.integ.snapshot/**/asset.*/*.d.ts',
+    '!**/*.integ.snapshot/**/asset.*/**',
+    '*.bak',
+  ],
   eslintOptions: { prettier: true },
   autoApproveOptions: {
     allowedUsernames: ['cdklabs-automation'],
@@ -46,6 +59,7 @@ const project = new awscdk.AwsCdkConstructLibrary({
   },
   release: true,
 });
+
 project.package.addField('prettier', {
   singleQuote: true,
   semi: true,
@@ -68,4 +82,14 @@ const releaseWorkflow = project.tryFindObjectFile(
 releaseWorkflow.patch(
   JsonPatch.add('/jobs/release/container/options', '--group-add 121')
 );
+const integConfig = new JsonFile(project, 'test/integ/tsconfig.json', {
+  obj: {
+    extends: '../../tsconfig.dev.json',
+    include: ['./**/integ.*.ts'],
+  },
+});
+project.setScript(
+  'integ',
+  'npx tsc -p test/integ && npx integ-runner --update-on-failed'
+);
 project.synth();
diff --git a/API.md b/API.md
index d2dec92..dda04c0 100644
--- a/API.md
+++ b/API.md
@@ -386,6 +386,114 @@ The tree node.
 
 ## Structs <a name="Structs" id="Structs"></a>
 
+### AddCfnInitProxyProps <a name="AddCfnInitProxyProps" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps"></a>
+
+Properties for the proxy server to use with cfn helper commands.
+
+#### Initializer <a name="Initializer" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.Initializer"></a>
+
+```typescript
+import { AddCfnInitProxyProps } from '@cdklabs/cdk-enterprise-iac'
+
+const addCfnInitProxyProps: AddCfnInitProxyProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyHost">proxyHost</a></code> | <code>string</code> | host of your proxy. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyPort">proxyPort</a></code> | <code>number</code> | proxy port. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyCredentials">proxyCredentials</a></code> | <code>aws-cdk-lib.aws_secretsmanager.ISecret</code> | JSON secret containing `user` and `password` properties to use if your proxy requires credentials `http://user:password@host:port` could contain sensitive data, so using a Secret. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyType">proxyType</a></code> | <code><a href="#@cdklabs/cdk-enterprise-iac.ProxyType">ProxyType</a></code> | Proxy Type. |
+
+---
+
+##### `proxyHost`<sup>Required</sup> <a name="proxyHost" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyHost"></a>
+
+```typescript
+public readonly proxyHost: string;
+```
+
+- *Type:* string
+
+host of your proxy.
+
+---
+
+*Example*
+
+```typescript
+example.com
+```
+
+
+##### `proxyPort`<sup>Required</sup> <a name="proxyPort" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyPort"></a>
+
+```typescript
+public readonly proxyPort: number;
+```
+
+- *Type:* number
+
+proxy port.
+
+---
+
+*Example*
+
+```typescript
+8080
+```
+
+
+##### `proxyCredentials`<sup>Optional</sup> <a name="proxyCredentials" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyCredentials"></a>
+
+```typescript
+public readonly proxyCredentials: ISecret;
+```
+
+- *Type:* aws-cdk-lib.aws_secretsmanager.ISecret
+
+JSON secret containing `user` and `password` properties to use if your proxy requires credentials `http://user:password@host:port` could contain sensitive data, so using a Secret.
+
+Note that while the `user` and `password` won't be visible in the cloudformation template
+they **will** be in plain text inside your `UserData`
+
+---
+
+*Example*
+
+```typescript
+const secret = new Secret(stack, 'TestSecret', {
+ secretObjectValue: {
+   user: SecretValue,
+   password: SecretValue,
+ },
+});
+```
+
+
+##### `proxyType`<sup>Optional</sup> <a name="proxyType" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyType"></a>
+
+```typescript
+public readonly proxyType: ProxyType;
+```
+
+- *Type:* <a href="#@cdklabs/cdk-enterprise-iac.ProxyType">ProxyType</a>
+- *Default:* ProxyType.HTTP
+
+Proxy Type.
+
+---
+
+*Example*
+
+```typescript
+ProxyType.HTTPS
+```
+
+
 ### AddPermissionBoundaryProps <a name="AddPermissionBoundaryProps" id="@cdklabs/cdk-enterprise-iac.AddPermissionBoundaryProps"></a>
 
 Properties to pass to the AddPermissionBoundary.
@@ -972,6 +1080,57 @@ SubnetType | `aws-cdk:subnet-type` tag value
 
 ## Classes <a name="Classes" id="Classes"></a>
 
+### AddCfnInitProxy <a name="AddCfnInitProxy" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy"></a>
+
+- *Implements:* aws-cdk-lib.IAspect
+
+Add proxy configuration to Cloudformation helper functions.
+
+#### Initializers <a name="Initializers" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.Initializer"></a>
+
+```typescript
+import { AddCfnInitProxy } from '@cdklabs/cdk-enterprise-iac'
+
+new AddCfnInitProxy(props: AddCfnInitProxyProps)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.Initializer.parameter.props">props</a></code> | <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps">AddCfnInitProxyProps</a></code> | *No description.* |
+
+---
+
+##### `props`<sup>Required</sup> <a name="props" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.Initializer.parameter.props"></a>
+
+- *Type:* <a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps">AddCfnInitProxyProps</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.visit">visit</a></code> | All aspects can visit an IConstruct. |
+
+---
+
+##### `visit` <a name="visit" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.visit"></a>
+
+```typescript
+public visit(node: IConstruct): void
+```
+
+All aspects can visit an IConstruct.
+
+###### `node`<sup>Required</sup> <a name="node" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.visit.parameter.node"></a>
+
+- *Type:* constructs.IConstruct
+
+---
+
+
+
+
 ### AddLambdaEnvironmentVariables <a name="AddLambdaEnvironmentVariables" id="@cdklabs/cdk-enterprise-iac.AddLambdaEnvironmentVariables"></a>
 
 - *Implements:* aws-cdk-lib.IAspect
@@ -1286,3 +1445,31 @@ All aspects can visit an IConstruct.
 
 
 
+## Enums <a name="Enums" id="Enums"></a>
+
+### ProxyType <a name="ProxyType" id="@cdklabs/cdk-enterprise-iac.ProxyType"></a>
+
+Whether an http-proxy or https-proxy.
+
+#### Members <a name="Members" id="Members"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.ProxyType.HTTP">HTTP</a></code> | --http-proxy. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.ProxyType.HTTPS">HTTPS</a></code> | --https-proxy. |
+
+---
+
+##### `HTTP` <a name="HTTP" id="@cdklabs/cdk-enterprise-iac.ProxyType.HTTP"></a>
+
+-http-proxy.
+
+---
+
+
+##### `HTTPS` <a name="HTTPS" id="@cdklabs/cdk-enterprise-iac.ProxyType.HTTPS"></a>
+
+-https-proxy.
+
+---
+
diff --git a/README.md b/README.md
index bc33ddf..7ad92f7 100644
--- a/README.md
+++ b/README.md
@@ -463,6 +463,113 @@ The tree node.
 
 ## Structs <a name="Structs" id="Structs"></a>
 
+### AddCfnInitProxyProps <a name="AddCfnInitProxyProps" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps"></a>
+
+Properties for the proxy server to use with cfn helper commands.
+
+#### Initializer <a name="Initializer" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.Initializer"></a>
+
+```typescript
+import { AddCfnInitProxyProps } from '@cdklabs/cdk-enterprise-iac'
+
+const addCfnInitProxyProps: AddCfnInitProxyProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyHost">proxyHost</a></code> | <code>string</code> | host of your proxy. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyPort">proxyPort</a></code> | <code>number</code> | proxy port. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyCredentials">proxyCredentials</a></code> | <code>aws-cdk-lib.aws_secretsmanager.ISecret</code> | JSON secret containing `user` and `password` properties to use if your proxy requires credentials `http://user:password@host:port` could contain sensitive data, so using a Secret. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyType">proxyType</a></code> | <code><a href="#@cdklabs/cdk-enterprise-iac.ProxyType">ProxyType</a></code> | Proxy Type. |
+
+---
+
+##### `proxyHost`<sup>Required</sup> <a name="proxyHost" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyHost"></a>
+
+```typescript
+public readonly proxyHost: string;
+```
+
+- *Type:* string
+
+host of your proxy.
+
+---
+
+*Example*
+
+```typescript
+example.com
+```
+
+
+##### `proxyPort`<sup>Required</sup> <a name="proxyPort" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyPort"></a>
+
+```typescript
+public readonly proxyPort: number;
+```
+
+- *Type:* number
+
+proxy port.
+
+---
+
+*Example*
+
+```typescript
+8080
+```
+
+
+##### `proxyCredentials`<sup>Optional</sup> <a name="proxyCredentials" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyCredentials"></a>
+
+```typescript
+public readonly proxyCredentials: ISecret;
+```
+
+- *Type:* aws-cdk-lib.aws_secretsmanager.ISecret
+
+JSON secret containing `user` and `password` properties to use if your proxy requires credentials `http://user:password@host:port` could contain sensitive data, so using a Secret.
+
+Note that while the `user` and `password` won't be visible in the cloudformation tempalte
+they **will** be in plain text inside your `UserData`
+
+---
+
+*Example*
+
+```typescript
+const secret = new Secret(stack, 'TestSecret', {
+ secretObjectValue: {
+   user: SecretValue,
+   password: SecretValue,
+ },
+});
+```
+
+
+##### `proxyType`<sup>Optional</sup> <a name="proxyType" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps.property.proxyType"></a>
+
+```typescript
+public readonly proxyType: ProxyType;
+```
+
+- *Type:* <a href="#@cdklabs/cdk-enterprise-iac.ProxyType">ProxyType</a>
+- *Default:* ProxyType.HTTP
+
+Proxy Type.
+
+---
+
+*Example*
+
+```typescript
+ProxyType.HTTPS
+```
+
 ### AddPermissionBoundaryProps <a name="AddPermissionBoundaryProps" id="@cdklabs/cdk-enterprise-iac.AddPermissionBoundaryProps"></a>
 
 Properties to pass to the AddPermissionBoundary.
@@ -1049,6 +1156,55 @@ SubnetType | `aws-cdk:subnet-type` tag value
 
 ## Classes <a name="Classes" id="Classes"></a>
 
+
+### AddCfnInitProxy <a name="AddCfnInitProxy" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy"></a>
+
+- *Implements:* aws-cdk-lib.IAspect
+
+Add proxy configuration to Cloudformation helper functions.
+
+#### Initializers <a name="Initializers" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.Initializer"></a>
+
+```typescript
+import { AddCfnInitProxy } from '@cdklabs/cdk-enterprise-iac'
+
+new AddCfnInitProxy(props: AddCfnInitProxyProps)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.Initializer.parameter.props">props</a></code> | <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps">AddCfnInitProxyProps</a></code> | *No description.* |
+
+---
+
+##### `props`<sup>Required</sup> <a name="props" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.Initializer.parameter.props"></a>
+
+- *Type:* <a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxyProps">AddCfnInitProxyProps</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.visit">visit</a></code> | All aspects can visit an IConstruct. |
+
+---
+
+##### `visit` <a name="visit" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.visit"></a>
+
+```typescript
+public visit(node: IConstruct): void
+```
+
+All aspects can visit an IConstruct.
+
+###### `node`<sup>Required</sup> <a name="node" id="@cdklabs/cdk-enterprise-iac.AddCfnInitProxy.visit.parameter.node"></a>
+
+- *Type:* constructs.IConstruct
+
+---
+
 ### AddLambdaEnvironmentVariables <a name="AddLambdaEnvironmentVariables" id="@cdklabs/cdk-enterprise-iac.AddLambdaEnvironmentVariables"></a>
 
 - *Implements:* aws-cdk-lib.IAspect
@@ -1359,8 +1515,32 @@ All aspects can visit an IConstruct.
 
 ---
 
+## Enums <a name="Enums" id="Enums"></a>
+
+### ProxyType <a name="ProxyType" id="@cdklabs/cdk-enterprise-iac.ProxyType"></a>
+
+Whether an http-proxy or https-proxy.
+
+#### Members <a name="Members" id="Members"></a>
 
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.ProxyType.HTTP">HTTP</a></code> | --http-proxy. |
+| <code><a href="#@cdklabs/cdk-enterprise-iac.ProxyType.HTTPS">HTTPS</a></code> | --https-proxy. |
+
+---
 
+##### `HTTP` <a name="HTTP" id="@cdklabs/cdk-enterprise-iac.ProxyType.HTTP"></a>
 
+-http-proxy.
+
+---
+
+
+##### `HTTPS` <a name="HTTPS" id="@cdklabs/cdk-enterprise-iac.ProxyType.HTTPS"></a>
+
+-https-proxy.
+
+---
 
 </details>
diff --git a/package.json b/package.json
index 96a8e6a..6d95961 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,8 @@
     "unbump": "npx projen unbump",
     "upgrade": "npx projen upgrade",
     "watch": "npx projen watch",
-    "projen": "npx projen"
+    "projen": "npx projen",
+    "integ": "npx tsc -p test/integ && npx integ-runner --update-on-failed"
   },
   "author": {
     "name": "Taylor Ondrey",
@@ -37,6 +38,8 @@
     "organization": false
   },
   "devDependencies": {
+    "@aws-cdk/integ-runner": "^2",
+    "@aws-cdk/integ-tests-alpha": "2.41.0-alpha.0",
     "@types/jest": "^27",
     "@types/node": "^14",
     "@typescript-eslint/eslint-plugin": "^5",
diff --git a/src/index.ts b/src/index.ts
index 76334fa..8ca909f 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -7,5 +7,6 @@ export * from './patches/removeTags';
 export * from './patches/addLambdaEnvironmentVariables';
 export * from './patches/removePublicAccessBlockConfiguration';
 export * from './patches/setApiGatewayEndpointConfiguration';
+export * from './patches/addCfnInitProxy';
 export * from './constructs/populateProvidedVpc/populateProvidedVpc';
 export * from './constructs/ecsIsoServiceAutoscaler/ecsIsoServiceAutoscaler';
diff --git a/src/patches/addCfnInitProxy.ts b/src/patches/addCfnInitProxy.ts
new file mode 100644
index 0000000..be949bf
--- /dev/null
+++ b/src/patches/addCfnInitProxy.ts
@@ -0,0 +1,156 @@
+/*
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
+import { CfnResource, IAspect, Stack } from 'aws-cdk-lib';
+import { CfnLaunchConfiguration } from 'aws-cdk-lib/aws-autoscaling';
+import { CfnInstance } from 'aws-cdk-lib/aws-ec2';
+import { ISecret } from 'aws-cdk-lib/aws-secretsmanager';
+
+import { IConstruct } from 'constructs';
+
+/**
+ * Whether an http-proxy or https-proxy
+ */
+export enum ProxyType {
+  /**
+   * --http-proxy
+   */
+  'HTTP',
+  /**
+   * --https-proxy
+   */
+  'HTTPS',
+}
+
+/**
+ * Properties for the proxy server to use with cfn helper commands
+ */
+export interface AddCfnInitProxyProps {
+  /**
+   * host of your proxy
+   * @example example.com
+   */
+  readonly proxyHost: string;
+  /**
+   * proxy port
+   * @example 8080
+   */
+  readonly proxyPort: number;
+  /**
+   * Proxy Type
+   * @example ProxyType.HTTPS
+   * @default ProxyType.HTTP
+   */
+  readonly proxyType?: ProxyType;
+  /**
+   * JSON secret containing `user` and `password` properties to use if your proxy requires credentials
+   * `http://user:password@host:port` could contain sensitive data, so using a Secret.
+   *
+   * Note that while the `user` and `password` won't be visible in the cloudformation template
+   * they **will** be in plain text inside your `UserData`
+   *
+   * @example
+   * const secret = new Secret(stack, 'TestSecret', {
+      secretObjectValue: {
+        user: SecretValue,
+        password: SecretValue,
+      },
+    });
+   */
+  readonly proxyCredentials?: ISecret;
+}
+/**
+ * Add proxy configuration to Cloudformation helper functions
+ *
+ * @extends IAspect
+ */
+export class AddCfnInitProxy implements IAspect {
+  private readonly _proxyHost: string;
+  private readonly _proxyPort: number;
+  private readonly _proxyType?: ProxyType;
+  private readonly _proxyCredentials?: ISecret;
+  private readonly _initResourceTypes: string[];
+  private readonly _proxyValue: string[];
+
+  constructor(props: AddCfnInitProxyProps) {
+    this._proxyHost = props.proxyHost;
+    this._proxyPort = props.proxyPort;
+    this._proxyType = props.proxyType || ProxyType.HTTP;
+    this._proxyCredentials = props.proxyCredentials || undefined;
+    this._proxyValue = this.determineProxyValue();
+    this._initResourceTypes = [
+      'AWS::AutoScaling::LaunchConfiguration',
+      'AWS::EC2::Instance',
+    ];
+  }
+
+  public visit(node: IConstruct): void {
+    if (
+      node instanceof CfnResource &&
+      this._initResourceTypes.includes(node.cfnResourceType)
+    ) {
+      let userData;
+      if (node.cfnResourceType == CfnInstance.CFN_RESOURCE_TYPE_NAME) {
+        const instanceNode = node as CfnInstance;
+        userData = Stack.of(node).resolve(instanceNode.userData);
+      } else if (
+        node.cfnResourceType == CfnLaunchConfiguration.CFN_RESOURCE_TYPE_NAME
+      ) {
+        const launchConfigNode = node as CfnLaunchConfiguration;
+        userData = Stack.of(node).resolve(launchConfigNode.userData);
+      }
+
+      const commandList: string[] = userData['Fn::Base64']['Fn::Join'][1];
+
+      const resourceIndexes = this.indexOfList('--resource', commandList);
+
+      for (
+        let i = 0, j = 0;
+        i < resourceIndexes.length;
+        i++, j += this._proxyValue.length
+      ) {
+        const lineIdx = resourceIndexes[i] + j;
+        commandList.splice(lineIdx, 0, ...this._proxyValue);
+      }
+      node.addPropertyOverride('UserData.Fn::Base64.Fn::Join', [
+        '',
+        commandList,
+      ]);
+    }
+  }
+
+  private determineProxyValue(): string[] {
+    const result = [];
+    if (this._proxyType == ProxyType.HTTP) {
+      result.push(' --http-proxy http://');
+    } else {
+      result.push(' --https-proxy https://');
+    }
+
+    if (this._proxyCredentials) {
+      result.push(
+        `${this._proxyCredentials
+          .secretValueFromJson('user')
+          .unsafeUnwrap()}:${this._proxyCredentials
+          .secretValueFromJson('password')
+          .unsafeUnwrap()}@`
+      );
+    }
+    result.push(`${this._proxyHost}:${this._proxyPort}`);
+
+    return result;
+  }
+
+  private indexOfList(needle: string, haystack: string[]): number[] {
+    const result = [];
+    for (let idx = 0; idx < haystack.length; idx++) {
+      const command: any = haystack[idx];
+      if (command instanceof Object) continue;
+      if (command.indexOf(needle) >= 0) {
+        result.push(idx);
+      }
+    }
+    return result;
+  }
+}
diff --git a/yarn.lock b/yarn.lock
index a05df9a..ddc0f1d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10,6 +10,18 @@
     "@jridgewell/gen-mapping" "^0.1.0"
     "@jridgewell/trace-mapping" "^0.3.9"
 
+"@aws-cdk/integ-runner@^2":
+  version "2.47.0"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/integ-runner/-/integ-runner-2.47.0.tgz#175c68362448b192f086a3be6a1a7b0305669b35"
+  integrity sha512-BMeEXVmSrX2euD/ShLYZnl68RGq1IPijWICMZS7QKC2CzY12p/V0r9DO+8aNjJTmsMYr0T7yBZsNY5mDbLHmYg==
+  dependencies:
+    aws-cdk "2.47.0"
+
+"@aws-cdk/integ-tests-alpha@2.41.0-alpha.0":
+  version "2.41.0-alpha.0"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/integ-tests-alpha/-/integ-tests-alpha-2.41.0-alpha.0.tgz#86d01538c4aa19dadc9a8517235dd7ae4137f1ed"
+  integrity sha512-z3b2Mg2H3CabB7DnsAv3IvPjP3KSByqbw7m75V8sWRwrmR0Z7vaK208RnmtkO0eik+C6Zb578zMc07eFQ9gbBA==
+
 "@babel/code-frame@^7.0.0", "@babel/code-frame@^7.12.13", "@babel/code-frame@^7.18.6":
   version "7.18.6"
   resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.18.6.tgz#3b25d38c89600baa2dcc219edfa88a74eb2c427a"
@@ -1264,6 +1276,13 @@ aws-cdk-lib@2.41.0:
     semver "^7.3.7"
     yaml "1.10.2"
 
+aws-cdk@2.47.0:
+  version "2.47.0"
+  resolved "https://registry.yarnpkg.com/aws-cdk/-/aws-cdk-2.47.0.tgz#8bf6b46856cea1c67bca0a0bb4a069d48bc090c0"
+  integrity sha512-v0S98ddAQ6bbe3uc7UvoxcQGebeIxZBv9tqvfj1f6IpauWpodApgX7s0yJtGbRWIX120Z8eaO8m/M+BeGrpRDQ==
+  optionalDependencies:
+    fsevents "2.3.2"
+
 babel-jest@^27.5.1:
   version "27.5.1"
   resolved "https://registry.yarnpkg.com/babel-jest/-/babel-jest-27.5.1.tgz#a1bf8d61928edfefd21da27eb86a695bfd691444"
@@ -2679,7 +2698,7 @@ fs.realpath@^1.0.0:
   resolved "https://registry.yarnpkg.com/fs.realpath/-/fs.realpath-1.0.0.tgz#1504ad2523158caa40db4a2787cb01411994ea4f"
   integrity sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==
 
-fsevents@^2.3.2:
+fsevents@2.3.2, fsevents@^2.3.2:
   version "2.3.2"
   resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-2.3.2.tgz#8a526f78b8fdf4623b709e0b975c52c24c02fd1a"
   integrity sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==


Test patch:
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.assets.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.assets.json
new file mode 100644
index 0000000..f1a05d4
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.assets.json
@@ -0,0 +1,19 @@
+{
+  "version": "21.0.0",
+  "files": {
+    "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
+      "source": {
+        "path": "IntegTestDefaultTestDeployAssertE3E7D2A4.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.template.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.template.json
new file mode 100644
index 0000000..ad9d0fb
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.template.json
@@ -0,0 +1,36 @@
+{
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/cdk.out b/test/integ/patches/addCfnInitProxy.integ.snapshot/cdk.out
new file mode 100644
index 0000000..8ecc185
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/cdk.out
@@ -0,0 +1,1 @@
+{"version":"21.0.0"}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/integ-addCfnInitProxy-stack.assets.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/integ-addCfnInitProxy-stack.assets.json
new file mode 100644
index 0000000..1148408
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/integ-addCfnInitProxy-stack.assets.json
@@ -0,0 +1,19 @@
+{
+  "version": "21.0.0",
+  "files": {
+    "324bfdd585065ac3d5b6a59f8e430eaf2b7d6591773ffc2832e83705134e7a04": {
+      "source": {
+        "path": "integ-addCfnInitProxy-stack.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "324bfdd585065ac3d5b6a59f8e430eaf2b7d6591773ffc2832e83705134e7a04.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/integ-addCfnInitProxy-stack.template.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/integ-addCfnInitProxy-stack.template.json
new file mode 100644
index 0000000..c21a1af
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/integ-addCfnInitProxy-stack.template.json
@@ -0,0 +1,657 @@
+{
+ "Resources": {
+  "TestVpcE77CE678": {
+   "Type": "AWS::EC2::VPC",
+   "Properties": {
+    "CidrBlock": "10.0.0.0/16",
+    "EnableDnsHostnames": true,
+    "EnableDnsSupport": true,
+    "InstanceTenancy": "default",
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet1SubnetA7DB1EDF": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.0.0/18",
+    "MapPublicIpOnLaunch": true,
+    "Tags": [
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "Public"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Public"
+     },
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet1RouteTable4CBFF871": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet1RouteTableAssociation7D1DECD9": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPublicSubnet1RouteTable4CBFF871"
+    },
+    "SubnetId": {
+     "Ref": "TestVpcPublicSubnet1SubnetA7DB1EDF"
+    }
+   }
+  },
+  "TestVpcPublicSubnet1DefaultRoute6C0F0315": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPublicSubnet1RouteTable4CBFF871"
+    },
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "GatewayId": {
+     "Ref": "TestVpcIGW9DD53F70"
+    }
+   },
+   "DependsOn": [
+    "TestVpcVPCGWF1827B84"
+   ]
+  },
+  "TestVpcPublicSubnet1EIP4884338C": {
+   "Type": "AWS::EC2::EIP",
+   "Properties": {
+    "Domain": "vpc",
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet1NATGatewayA323E3EC": {
+   "Type": "AWS::EC2::NatGateway",
+   "Properties": {
+    "SubnetId": {
+     "Ref": "TestVpcPublicSubnet1SubnetA7DB1EDF"
+    },
+    "AllocationId": {
+     "Fn::GetAtt": [
+      "TestVpcPublicSubnet1EIP4884338C",
+      "AllocationId"
+     ]
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+     }
+    ]
+   },
+   "DependsOn": [
+    "TestVpcPublicSubnet1DefaultRoute6C0F0315",
+    "TestVpcPublicSubnet1RouteTableAssociation7D1DECD9"
+   ]
+  },
+  "TestVpcPublicSubnet2Subnet80A14523": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "AvailabilityZone": {
+     "Fn::Select": [
+      1,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.64.0/18",
+    "MapPublicIpOnLaunch": true,
+    "Tags": [
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "Public"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Public"
+     },
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet2RouteTable75B88314": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet2RouteTableAssociationB386A819": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPublicSubnet2RouteTable75B88314"
+    },
+    "SubnetId": {
+     "Ref": "TestVpcPublicSubnet2Subnet80A14523"
+    }
+   }
+  },
+  "TestVpcPublicSubnet2DefaultRoute054DAE0A": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPublicSubnet2RouteTable75B88314"
+    },
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "GatewayId": {
+     "Ref": "TestVpcIGW9DD53F70"
+    }
+   },
+   "DependsOn": [
+    "TestVpcVPCGWF1827B84"
+   ]
+  },
+  "TestVpcPublicSubnet2EIP83F7944C": {
+   "Type": "AWS::EC2::EIP",
+   "Properties": {
+    "Domain": "vpc",
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+     }
+    ]
+   }
+  },
+  "TestVpcPublicSubnet2NATGatewayA9858C31": {
+   "Type": "AWS::EC2::NatGateway",
+   "Properties": {
+    "SubnetId": {
+     "Ref": "TestVpcPublicSubnet2Subnet80A14523"
+    },
+    "AllocationId": {
+     "Fn::GetAtt": [
+      "TestVpcPublicSubnet2EIP83F7944C",
+      "AllocationId"
+     ]
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+     }
+    ]
+   },
+   "DependsOn": [
+    "TestVpcPublicSubnet2DefaultRoute054DAE0A",
+    "TestVpcPublicSubnet2RouteTableAssociationB386A819"
+   ]
+  },
+  "TestVpcPrivateSubnet1SubnetCC65D771": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.128.0/18",
+    "MapPublicIpOnLaunch": false,
+    "Tags": [
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "Private"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Private"
+     },
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1"
+     }
+    ]
+   }
+  },
+  "TestVpcPrivateSubnet1RouteTable469B0105": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1"
+     }
+    ]
+   }
+  },
+  "TestVpcPrivateSubnet1RouteTableAssociationFFD4DFF7": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPrivateSubnet1RouteTable469B0105"
+    },
+    "SubnetId": {
+     "Ref": "TestVpcPrivateSubnet1SubnetCC65D771"
+    }
+   }
+  },
+  "TestVpcPrivateSubnet1DefaultRoute32E7B814": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPrivateSubnet1RouteTable469B0105"
+    },
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "NatGatewayId": {
+     "Ref": "TestVpcPublicSubnet1NATGatewayA323E3EC"
+    }
+   }
+  },
+  "TestVpcPrivateSubnet2SubnetDE0C64A2": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "AvailabilityZone": {
+     "Fn::Select": [
+      1,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.192.0/18",
+    "MapPublicIpOnLaunch": false,
+    "Tags": [
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "Private"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Private"
+     },
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2"
+     }
+    ]
+   }
+  },
+  "TestVpcPrivateSubnet2RouteTableCEF29F7C": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2"
+     }
+    ]
+   }
+  },
+  "TestVpcPrivateSubnet2RouteTableAssociation18250AB4": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPrivateSubnet2RouteTableCEF29F7C"
+    },
+    "SubnetId": {
+     "Ref": "TestVpcPrivateSubnet2SubnetDE0C64A2"
+    }
+   }
+  },
+  "TestVpcPrivateSubnet2DefaultRouteA7EB6930": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "TestVpcPrivateSubnet2RouteTableCEF29F7C"
+    },
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "NatGatewayId": {
+     "Ref": "TestVpcPublicSubnet2NATGatewayA9858C31"
+    }
+   }
+  },
+  "TestVpcIGW9DD53F70": {
+   "Type": "AWS::EC2::InternetGateway",
+   "Properties": {
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestVpc"
+     }
+    ]
+   }
+  },
+  "TestVpcVPCGWF1827B84": {
+   "Type": "AWS::EC2::VPCGatewayAttachment",
+   "Properties": {
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    },
+    "InternetGatewayId": {
+     "Ref": "TestVpcIGW9DD53F70"
+    }
+   }
+  },
+  "TestInstanceInstanceSecurityGroupFC9BD332": {
+   "Type": "AWS::EC2::SecurityGroup",
+   "Properties": {
+    "GroupDescription": "integ-addCfnInitProxy-stack/TestInstance/InstanceSecurityGroup",
+    "SecurityGroupEgress": [
+     {
+      "CidrIp": "0.0.0.0/0",
+      "Description": "Allow all outbound traffic by default",
+      "IpProtocol": "-1"
+     }
+    ],
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestInstance"
+     }
+    ],
+    "VpcId": {
+     "Ref": "TestVpcE77CE678"
+    }
+   }
+  },
+  "TestInstanceInstanceRole73B579CC": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": {
+         "Fn::Join": [
+          "",
+          [
+           "ec2.",
+           {
+            "Ref": "AWS::URLSuffix"
+           }
+          ]
+         ]
+        }
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestInstance"
+     }
+    ]
+   }
+  },
+  "TestInstanceInstanceRoleDefaultPolicyB37E8251": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": [
+        "cloudformation:DescribeStackResource",
+        "cloudformation:SignalResource"
+       ],
+       "Effect": "Allow",
+       "Resource": {
+        "Ref": "AWS::StackId"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "TestInstanceInstanceRoleDefaultPolicyB37E8251",
+    "Roles": [
+     {
+      "Ref": "TestInstanceInstanceRole73B579CC"
+     }
+    ]
+   }
+  },
+  "TestInstanceInstanceProfileD0E25910": {
+   "Type": "AWS::IAM::InstanceProfile",
+   "Properties": {
+    "Roles": [
+     {
+      "Ref": "TestInstanceInstanceRole73B579CC"
+     }
+    ]
+   }
+  },
+  "TestInstance44016A9E16ad79d8fcd58511": {
+   "Type": "AWS::EC2::Instance",
+   "Properties": {
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "IamInstanceProfile": {
+     "Ref": "TestInstanceInstanceProfileD0E25910"
+    },
+    "ImageId": {
+     "Ref": "SsmParameterValueawsserviceamiamazonlinuxlatestamznamihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter"
+    },
+    "InstanceType": "r5.large",
+    "SecurityGroupIds": [
+     {
+      "Fn::GetAtt": [
+       "TestInstanceInstanceSecurityGroupFC9BD332",
+       "GroupId"
+      ]
+     }
+    ],
+    "SubnetId": {
+     "Ref": "TestVpcPrivateSubnet1SubnetCC65D771"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "integ-addCfnInitProxy-stack/TestInstance"
+     }
+    ],
+    "UserData": {
+     "Fn::Base64": {
+      "Fn::Join": [
+       "",
+       [
+        "#!/bin/bash\n# fingerprint: 43329d0e32962748\n(\n  set +e\n  /opt/aws/bin/cfn-init -v --region ",
+        {
+         "Ref": "AWS::Region"
+        },
+        " --stack ",
+        {
+         "Ref": "AWS::StackName"
+        },
+        " --http-proxy http://",
+        {
+         "Fn::Join": [
+          "",
+          [
+           "{{resolve:secretsmanager:",
+           {
+            "Ref": "TestSecret16AF87B1"
+           },
+           ":SecretString:user::}}:{{resolve:secretsmanager:",
+           {
+            "Ref": "TestSecret16AF87B1"
+           },
+           ":SecretString:password::}}@"
+          ]
+         ]
+        },
+        "example.com:8080",
+        " --resource TestInstance44016A9E16ad79d8fcd58511 -c default\n  /opt/aws/bin/cfn-signal -e 0 --region ",
+        {
+         "Ref": "AWS::Region"
+        },
+        " --stack ",
+        {
+         "Ref": "AWS::StackName"
+        },
+        " --http-proxy http://",
+        {
+         "Fn::Join": [
+          "",
+          [
+           "{{resolve:secretsmanager:",
+           {
+            "Ref": "TestSecret16AF87B1"
+           },
+           ":SecretString:user::}}:{{resolve:secretsmanager:",
+           {
+            "Ref": "TestSecret16AF87B1"
+           },
+           ":SecretString:password::}}@"
+          ]
+         ]
+        },
+        "example.com:8080",
+        " --resource TestInstance44016A9E16ad79d8fcd58511\n  cat /var/log/cfn-init.log >&2\n)"
+       ]
+      ]
+     }
+    }
+   },
+   "DependsOn": [
+    "TestInstanceInstanceRoleDefaultPolicyB37E8251",
+    "TestInstanceInstanceRole73B579CC"
+   ],
+   "CreationPolicy": {
+    "ResourceSignal": {
+     "Count": 1,
+     "Timeout": "PT2M"
+    }
+   },
+   "Metadata": {
+    "AWS::CloudFormation::Init": {
+     "configSets": {
+      "default": [
+       "config"
+      ]
+     },
+     "config": {
+      "packages": {
+       "yum": {
+        "python3": []
+       }
+      }
+     }
+    }
+   }
+  },
+  "TestSecret16AF87B1": {
+   "Type": "AWS::SecretsManager::Secret",
+   "Properties": {
+    "SecretString": "{\"user\":\"someUser\",\"password\":\"superSecret123\"}"
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete"
+  }
+ },
+ "Parameters": {
+  "SsmParameterValueawsserviceamiamazonlinuxlatestamznamihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter": {
+   "Type": "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>",
+   "Default": "/aws/service/ami-amazon-linux-latest/amzn-ami-hvm-x86_64-gp2"
+  },
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/integ.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/integ.json
new file mode 100644
index 0000000..1b36603
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/integ.json
@@ -0,0 +1,15 @@
+{
+  "version": "21.0.0",
+  "testCases": {
+    "IntegTest/DefaultTest": {
+      "stacks": [
+        "integ-addCfnInitProxy-stack"
+      ],
+      "regions": [
+        "us-east-1"
+      ],
+      "assertionStack": "IntegTest/DefaultTest/DeployAssert",
+      "assertionStackName": "IntegTestDefaultTestDeployAssertE3E7D2A4"
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/manifest.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/manifest.json
new file mode 100644
index 0000000..05d8be3
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/manifest.json
@@ -0,0 +1,285 @@
+{
+  "version": "21.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "integ-addCfnInitProxy-stack.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "integ-addCfnInitProxy-stack.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "integ-addCfnInitProxy-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "integ-addCfnInitProxy-stack.template.json",
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/324bfdd585065ac3d5b6a59f8e430eaf2b7d6591773ffc2832e83705134e7a04.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "integ-addCfnInitProxy-stack.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "integ-addCfnInitProxy-stack.assets"
+      ],
+      "metadata": {
+        "/integ-addCfnInitProxy-stack/TestVpc/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcE77CE678"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/Subnet": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet1SubnetA7DB1EDF"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/RouteTable": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet1RouteTable4CBFF871"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/RouteTableAssociation": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet1RouteTableAssociation7D1DECD9"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/DefaultRoute": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet1DefaultRoute6C0F0315"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/EIP": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet1EIP4884338C"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/NATGateway": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet1NATGatewayA323E3EC"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/Subnet": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet2Subnet80A14523"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/RouteTable": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet2RouteTable75B88314"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/RouteTableAssociation": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet2RouteTableAssociationB386A819"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/DefaultRoute": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet2DefaultRoute054DAE0A"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/EIP": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet2EIP83F7944C"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/NATGateway": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPublicSubnet2NATGatewayA9858C31"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/Subnet": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet1SubnetCC65D771"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/RouteTable": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet1RouteTable469B0105"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/RouteTableAssociation": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet1RouteTableAssociationFFD4DFF7"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/DefaultRoute": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet1DefaultRoute32E7B814"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/Subnet": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet2SubnetDE0C64A2"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/RouteTable": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet2RouteTableCEF29F7C"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/RouteTableAssociation": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet2RouteTableAssociation18250AB4"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/DefaultRoute": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcPrivateSubnet2DefaultRouteA7EB6930"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/IGW": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcIGW9DD53F70"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestVpc/VPCGW": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestVpcVPCGWF1827B84"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestInstance/InstanceSecurityGroup/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestInstanceInstanceSecurityGroupFC9BD332"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestInstance/InstanceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestInstanceInstanceRole73B579CC"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestInstance/InstanceRole/DefaultPolicy/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestInstanceInstanceRoleDefaultPolicyB37E8251"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestInstance/InstanceProfile": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestInstanceInstanceProfileD0E25910"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestInstance/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestInstance44016A9E16ad79d8fcd58511"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118.Parameter": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "SsmParameterValueawsserviceamiamazonlinuxlatestamznamihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/TestSecret/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestSecret16AF87B1"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/integ-addCfnInitProxy-stack/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "integ-addCfnInitProxy-stack"
+    },
+    "IntegTestDefaultTestDeployAssertE3E7D2A4.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "IntegTestDefaultTestDeployAssertE3E7D2A4.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "IntegTestDefaultTestDeployAssertE3E7D2A4": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "IntegTestDefaultTestDeployAssertE3E7D2A4.template.json",
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "IntegTestDefaultTestDeployAssertE3E7D2A4.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "IntegTestDefaultTestDeployAssertE3E7D2A4.assets"
+      ],
+      "metadata": {
+        "/IntegTest/DefaultTest/DeployAssert/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/IntegTest/DefaultTest/DeployAssert/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "IntegTest/DefaultTest/DeployAssert"
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/integ/patches/addCfnInitProxy.integ.snapshot/tree.json b/test/integ/patches/addCfnInitProxy.integ.snapshot/tree.json
new file mode 100644
index 0000000..74617ab
--- /dev/null
+++ b/test/integ/patches/addCfnInitProxy.integ.snapshot/tree.json
@@ -0,0 +1,984 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "constructs.Construct",
+          "version": "10.0.5"
+        }
+      },
+      "integ-addCfnInitProxy-stack": {
+        "id": "integ-addCfnInitProxy-stack",
+        "path": "integ-addCfnInitProxy-stack",
+        "children": {
+          "TestVpc": {
+            "id": "TestVpc",
+            "path": "integ-addCfnInitProxy-stack/TestVpc",
+            "children": {
+              "Resource": {
+                "id": "Resource",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::VPC",
+                  "aws:cdk:cloudformation:props": {
+                    "cidrBlock": "10.0.0.0/16",
+                    "enableDnsHostnames": true,
+                    "enableDnsSupport": true,
+                    "instanceTenancy": "default",
+                    "tags": [
+                      {
+                        "key": "Name",
+                        "value": "integ-addCfnInitProxy-stack/TestVpc"
+                      }
+                    ]
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.CfnVPC",
+                  "version": "2.41.0"
+                }
+              },
+              "PublicSubnet1": {
+                "id": "PublicSubnet1",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1",
+                "children": {
+                  "Subnet": {
+                    "id": "Subnet",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/Subnet",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Subnet",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "availabilityZone": {
+                          "Fn::Select": [
+                            0,
+                            {
+                              "Fn::GetAZs": ""
+                            }
+                          ]
+                        },
+                        "cidrBlock": "10.0.0.0/18",
+                        "mapPublicIpOnLaunch": true,
+                        "tags": [
+                          {
+                            "key": "aws-cdk:subnet-name",
+                            "value": "Public"
+                          },
+                          {
+                            "key": "aws-cdk:subnet-type",
+                            "value": "Public"
+                          },
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnet",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "Acl": {
+                    "id": "Acl",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/Acl",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.Resource",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTable": {
+                    "id": "RouteTable",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/RouteTable",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRouteTable",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTableAssociation": {
+                    "id": "RouteTableAssociation",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/RouteTableAssociation",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPublicSubnet1RouteTable4CBFF871"
+                        },
+                        "subnetId": {
+                          "Ref": "TestVpcPublicSubnet1SubnetA7DB1EDF"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnetRouteTableAssociation",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "DefaultRoute": {
+                    "id": "DefaultRoute",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/DefaultRoute",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Route",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPublicSubnet1RouteTable4CBFF871"
+                        },
+                        "destinationCidrBlock": "0.0.0.0/0",
+                        "gatewayId": {
+                          "Ref": "TestVpcIGW9DD53F70"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRoute",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "EIP": {
+                    "id": "EIP",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/EIP",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::EIP",
+                      "aws:cdk:cloudformation:props": {
+                        "domain": "vpc",
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnEIP",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "NATGateway": {
+                    "id": "NATGateway",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1/NATGateway",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::NatGateway",
+                      "aws:cdk:cloudformation:props": {
+                        "subnetId": {
+                          "Ref": "TestVpcPublicSubnet1SubnetA7DB1EDF"
+                        },
+                        "allocationId": {
+                          "Fn::GetAtt": [
+                            "TestVpcPublicSubnet1EIP4884338C",
+                            "AllocationId"
+                          ]
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnNatGateway",
+                      "version": "2.41.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.PublicSubnet",
+                  "version": "2.41.0"
+                }
+              },
+              "PublicSubnet2": {
+                "id": "PublicSubnet2",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2",
+                "children": {
+                  "Subnet": {
+                    "id": "Subnet",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/Subnet",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Subnet",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "availabilityZone": {
+                          "Fn::Select": [
+                            1,
+                            {
+                              "Fn::GetAZs": ""
+                            }
+                          ]
+                        },
+                        "cidrBlock": "10.0.64.0/18",
+                        "mapPublicIpOnLaunch": true,
+                        "tags": [
+                          {
+                            "key": "aws-cdk:subnet-name",
+                            "value": "Public"
+                          },
+                          {
+                            "key": "aws-cdk:subnet-type",
+                            "value": "Public"
+                          },
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnet",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "Acl": {
+                    "id": "Acl",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/Acl",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.Resource",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTable": {
+                    "id": "RouteTable",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/RouteTable",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRouteTable",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTableAssociation": {
+                    "id": "RouteTableAssociation",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/RouteTableAssociation",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPublicSubnet2RouteTable75B88314"
+                        },
+                        "subnetId": {
+                          "Ref": "TestVpcPublicSubnet2Subnet80A14523"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnetRouteTableAssociation",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "DefaultRoute": {
+                    "id": "DefaultRoute",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/DefaultRoute",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Route",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPublicSubnet2RouteTable75B88314"
+                        },
+                        "destinationCidrBlock": "0.0.0.0/0",
+                        "gatewayId": {
+                          "Ref": "TestVpcIGW9DD53F70"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRoute",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "EIP": {
+                    "id": "EIP",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/EIP",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::EIP",
+                      "aws:cdk:cloudformation:props": {
+                        "domain": "vpc",
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnEIP",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "NATGateway": {
+                    "id": "NATGateway",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2/NATGateway",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::NatGateway",
+                      "aws:cdk:cloudformation:props": {
+                        "subnetId": {
+                          "Ref": "TestVpcPublicSubnet2Subnet80A14523"
+                        },
+                        "allocationId": {
+                          "Fn::GetAtt": [
+                            "TestVpcPublicSubnet2EIP83F7944C",
+                            "AllocationId"
+                          ]
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PublicSubnet2"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnNatGateway",
+                      "version": "2.41.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.PublicSubnet",
+                  "version": "2.41.0"
+                }
+              },
+              "PrivateSubnet1": {
+                "id": "PrivateSubnet1",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1",
+                "children": {
+                  "Subnet": {
+                    "id": "Subnet",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/Subnet",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Subnet",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "availabilityZone": {
+                          "Fn::Select": [
+                            0,
+                            {
+                              "Fn::GetAZs": ""
+                            }
+                          ]
+                        },
+                        "cidrBlock": "10.0.128.0/18",
+                        "mapPublicIpOnLaunch": false,
+                        "tags": [
+                          {
+                            "key": "aws-cdk:subnet-name",
+                            "value": "Private"
+                          },
+                          {
+                            "key": "aws-cdk:subnet-type",
+                            "value": "Private"
+                          },
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnet",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "Acl": {
+                    "id": "Acl",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/Acl",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.Resource",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTable": {
+                    "id": "RouteTable",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/RouteTable",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRouteTable",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTableAssociation": {
+                    "id": "RouteTableAssociation",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/RouteTableAssociation",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPrivateSubnet1RouteTable469B0105"
+                        },
+                        "subnetId": {
+                          "Ref": "TestVpcPrivateSubnet1SubnetCC65D771"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnetRouteTableAssociation",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "DefaultRoute": {
+                    "id": "DefaultRoute",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet1/DefaultRoute",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Route",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPrivateSubnet1RouteTable469B0105"
+                        },
+                        "destinationCidrBlock": "0.0.0.0/0",
+                        "natGatewayId": {
+                          "Ref": "TestVpcPublicSubnet1NATGatewayA323E3EC"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRoute",
+                      "version": "2.41.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.PrivateSubnet",
+                  "version": "2.41.0"
+                }
+              },
+              "PrivateSubnet2": {
+                "id": "PrivateSubnet2",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2",
+                "children": {
+                  "Subnet": {
+                    "id": "Subnet",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/Subnet",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Subnet",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "availabilityZone": {
+                          "Fn::Select": [
+                            1,
+                            {
+                              "Fn::GetAZs": ""
+                            }
+                          ]
+                        },
+                        "cidrBlock": "10.0.192.0/18",
+                        "mapPublicIpOnLaunch": false,
+                        "tags": [
+                          {
+                            "key": "aws-cdk:subnet-name",
+                            "value": "Private"
+                          },
+                          {
+                            "key": "aws-cdk:subnet-type",
+                            "value": "Private"
+                          },
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnet",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "Acl": {
+                    "id": "Acl",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/Acl",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.Resource",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTable": {
+                    "id": "RouteTable",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/RouteTable",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRouteTable",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "RouteTableAssociation": {
+                    "id": "RouteTableAssociation",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/RouteTableAssociation",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPrivateSubnet2RouteTableCEF29F7C"
+                        },
+                        "subnetId": {
+                          "Ref": "TestVpcPrivateSubnet2SubnetDE0C64A2"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSubnetRouteTableAssociation",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "DefaultRoute": {
+                    "id": "DefaultRoute",
+                    "path": "integ-addCfnInitProxy-stack/TestVpc/PrivateSubnet2/DefaultRoute",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Route",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "TestVpcPrivateSubnet2RouteTableCEF29F7C"
+                        },
+                        "destinationCidrBlock": "0.0.0.0/0",
+                        "natGatewayId": {
+                          "Ref": "TestVpcPublicSubnet2NATGatewayA9858C31"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnRoute",
+                      "version": "2.41.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.PrivateSubnet",
+                  "version": "2.41.0"
+                }
+              },
+              "IGW": {
+                "id": "IGW",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/IGW",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::InternetGateway",
+                  "aws:cdk:cloudformation:props": {
+                    "tags": [
+                      {
+                        "key": "Name",
+                        "value": "integ-addCfnInitProxy-stack/TestVpc"
+                      }
+                    ]
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.CfnInternetGateway",
+                  "version": "2.41.0"
+                }
+              },
+              "VPCGW": {
+                "id": "VPCGW",
+                "path": "integ-addCfnInitProxy-stack/TestVpc/VPCGW",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::VPCGatewayAttachment",
+                  "aws:cdk:cloudformation:props": {
+                    "vpcId": {
+                      "Ref": "TestVpcE77CE678"
+                    },
+                    "internetGatewayId": {
+                      "Ref": "TestVpcIGW9DD53F70"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.CfnVPCGatewayAttachment",
+                  "version": "2.41.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.aws_ec2.Vpc",
+              "version": "2.41.0"
+            }
+          },
+          "TestInstance": {
+            "id": "TestInstance",
+            "path": "integ-addCfnInitProxy-stack/TestInstance",
+            "children": {
+              "InstanceSecurityGroup": {
+                "id": "InstanceSecurityGroup",
+                "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceSecurityGroup",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceSecurityGroup/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SecurityGroup",
+                      "aws:cdk:cloudformation:props": {
+                        "groupDescription": "integ-addCfnInitProxy-stack/TestInstance/InstanceSecurityGroup",
+                        "securityGroupEgress": [
+                          {
+                            "cidrIp": "0.0.0.0/0",
+                            "description": "Allow all outbound traffic by default",
+                            "ipProtocol": "-1"
+                          }
+                        ],
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestInstance"
+                          }
+                        ],
+                        "vpcId": {
+                          "Ref": "TestVpcE77CE678"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_ec2.CfnSecurityGroup",
+                      "version": "2.41.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.SecurityGroup",
+                  "version": "2.41.0"
+                }
+              },
+              "InstanceRole": {
+                "id": "InstanceRole",
+                "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": {
+                                  "Fn::Join": [
+                                    "",
+                                    [
+                                      "ec2.",
+                                      {
+                                        "Ref": "AWS::URLSuffix"
+                                      }
+                                    ]
+                                  ]
+                                }
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "integ-addCfnInitProxy-stack/TestInstance"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_iam.CfnRole",
+                      "version": "2.41.0"
+                    }
+                  },
+                  "DefaultPolicy": {
+                    "id": "DefaultPolicy",
+                    "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceRole/DefaultPolicy",
+                    "children": {
+                      "Resource": {
+                        "id": "Resource",
+                        "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceRole/DefaultPolicy/Resource",
+                        "attributes": {
+                          "aws:cdk:cloudformation:type": "AWS::IAM::Policy",
+                          "aws:cdk:cloudformation:props": {
+                            "policyDocument": {
+                              "Statement": [
+                                {
+                                  "Action": [
+                                    "cloudformation:DescribeStackResource",
+                                    "cloudformation:SignalResource"
+                                  ],
+                                  "Effect": "Allow",
+                                  "Resource": {
+                                    "Ref": "AWS::StackId"
+                                  }
+                                }
+                              ],
+                              "Version": "2012-10-17"
+                            },
+                            "policyName": "TestInstanceInstanceRoleDefaultPolicyB37E8251",
+                            "roles": [
+                              {
+                                "Ref": "TestInstanceInstanceRole73B579CC"
+                              }
+                            ]
+                          }
+                        },
+                        "constructInfo": {
+                          "fqn": "aws-cdk-lib.aws_iam.CfnPolicy",
+                          "version": "2.41.0"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_iam.Policy",
+                      "version": "2.41.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_iam.Role",
+                  "version": "2.41.0"
+                }
+              },
+              "InstanceProfile": {
+                "id": "InstanceProfile",
+                "path": "integ-addCfnInitProxy-stack/TestInstance/InstanceProfile",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::IAM::InstanceProfile",
+                  "aws:cdk:cloudformation:props": {
+                    "roles": [
+                      {
+                        "Ref": "TestInstanceInstanceRole73B579CC"
+                      }
+                    ]
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_iam.CfnInstanceProfile",
+                  "version": "2.41.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "integ-addCfnInitProxy-stack/TestInstance/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::Instance",
+                  "aws:cdk:cloudformation:props": {
+                    "availabilityZone": {
+                      "Fn::Select": [
+                        0,
+                        {
+                          "Fn::GetAZs": ""
+                        }
+                      ]
+                    },
+                    "iamInstanceProfile": {
+                      "Ref": "TestInstanceInstanceProfileD0E25910"
+                    },
+                    "imageId": {
+                      "Ref": "SsmParameterValueawsserviceamiamazonlinuxlatestamznamihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter"
+                    },
+                    "instanceType": "r5.large",
+                    "securityGroupIds": [
+                      {
+                        "Fn::GetAtt": [
+                          "TestInstanceInstanceSecurityGroupFC9BD332",
+                          "GroupId"
+                        ]
+                      }
+                    ],
+                    "subnetId": {
+                      "Ref": "TestVpcPrivateSubnet1SubnetCC65D771"
+                    },
+                    "tags": [
+                      {
+                        "key": "Name",
+                        "value": "integ-addCfnInitProxy-stack/TestInstance"
+                      }
+                    ],
+                    "userData": {
+                      "Fn::Base64": {
+                        "Fn::Join": [
+                          "",
+                          [
+                            "#!/bin/bash\n# fingerprint: 43329d0e32962748\n(\n  set +e\n  /opt/aws/bin/cfn-init -v --region ",
+                            {
+                              "Ref": "AWS::Region"
+                            },
+                            " --stack ",
+                            {
+                              "Ref": "AWS::StackName"
+                            },
+                            " --resource TestInstance44016A9E16ad79d8fcd58511 -c default\n  /opt/aws/bin/cfn-signal -e 0 --region ",
+                            {
+                              "Ref": "AWS::Region"
+                            },
+                            " --stack ",
+                            {
+                              "Ref": "AWS::StackName"
+                            },
+                            " --resource TestInstance44016A9E16ad79d8fcd58511\n  cat /var/log/cfn-init.log >&2\n)"
+                          ]
+                        ]
+                      }
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_ec2.CfnInstance",
+                  "version": "2.41.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.aws_ec2.Instance",
+              "version": "2.41.0"
+            }
+          },
+          "SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118.Parameter": {
+            "id": "SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118.Parameter",
+            "path": "integ-addCfnInitProxy-stack/SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118.Parameter",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.CfnParameter",
+              "version": "2.41.0"
+            }
+          },
+          "SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118": {
+            "id": "SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118",
+            "path": "integ-addCfnInitProxy-stack/SsmParameterValue:--aws--service--ami-amazon-linux-latest--amzn-ami-hvm-x86_64-gp2:C96584B6-F00A-464E-AD19-53AFF4B05118",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.Resource",
+              "version": "2.41.0"
+            }
+          },
+          "TestSecret": {
+            "id": "TestSecret",
+            "path": "integ-addCfnInitProxy-stack/TestSecret",
+            "children": {
+              "Resource": {
+                "id": "Resource",
+                "path": "integ-addCfnInitProxy-stack/TestSecret/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::SecretsManager::Secret",
+                  "aws:cdk:cloudformation:props": {
+                    "secretString": "{\"user\":\"someUser\",\"password\":\"superSecret123\"}"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_secretsmanager.CfnSecret",
+                  "version": "2.41.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.aws_secretsmanager.Secret",
+              "version": "2.41.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "aws-cdk-lib.Stack",
+          "version": "2.41.0"
+        }
+      },
+      "IntegTest": {
+        "id": "IntegTest",
+        "path": "IntegTest",
+        "children": {
+          "DefaultTest": {
+            "id": "DefaultTest",
+            "path": "IntegTest/DefaultTest",
+            "children": {
+              "Default": {
+                "id": "Default",
+                "path": "IntegTest/DefaultTest/Default",
+                "constructInfo": {
+                  "fqn": "constructs.Construct",
+                  "version": "10.0.5"
+                }
+              },
+              "DeployAssert": {
+                "id": "DeployAssert",
+                "path": "IntegTest/DefaultTest/DeployAssert",
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.Stack",
+                  "version": "2.41.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/integ-tests-alpha.IntegTestCase",
+              "version": "2.41.0-alpha.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/integ-tests-alpha.IntegTest",
+          "version": "2.41.0-alpha.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "aws-cdk-lib.App",
+      "version": "2.41.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/integ/patches/integ.addCfnInitProxy.ts b/test/integ/patches/integ.addCfnInitProxy.ts
new file mode 100644
index 0000000..2b17591
--- /dev/null
+++ b/test/integ/patches/integ.addCfnInitProxy.ts
@@ -0,0 +1,50 @@
+/*
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import { App, Aspects, Duration, SecretValue, Stack } from 'aws-cdk-lib';
+import {
+  CloudFormationInit,
+  InitPackage,
+  Instance,
+  InstanceClass,
+  InstanceSize,
+  InstanceType,
+  MachineImage,
+  Vpc,
+} from 'aws-cdk-lib/aws-ec2';
+import { Secret } from 'aws-cdk-lib/aws-secretsmanager';
+import { AddCfnInitProxy } from '../../../src/patches/addCfnInitProxy';
+
+const app = new App();
+const stack = new Stack(app, 'integ-addCfnInitProxy-stack');
+const vpc = new Vpc(stack, 'TestVpc');
+new Instance(stack, 'TestInstance', {
+  machineImage: MachineImage.latestAmazonLinux(),
+  instanceType: InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE),
+  vpc,
+  init: CloudFormationInit.fromElements(InitPackage.yum('python3')),
+  initOptions: {
+    timeout: Duration.minutes(2),
+    ignoreFailures: true, // Ignoring due to fake proxy not being real
+  },
+});
+const secret = new Secret(stack, 'TestSecret', {
+  secretObjectValue: {
+    user: SecretValue.unsafePlainText('someUser'),
+    password: SecretValue.unsafePlainText('superSecret123'),
+  },
+});
+Aspects.of(stack).add(
+  new AddCfnInitProxy({
+    proxyHost: 'example.com',
+    proxyPort: 8080,
+    proxyCredentials: secret,
+  })
+);
+
+new IntegTest(app, 'IntegTest', {
+  testCases: [stack],
+  regions: ['us-east-1'],
+});
diff --git a/test/integ/tsconfig.json b/test/integ/tsconfig.json
new file mode 100644
index 0000000..ca5af49
--- /dev/null
+++ b/test/integ/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.dev.json",
+  "include": [
+    "./**/integ.*.ts"
+  ],
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+}
diff --git a/test/patches/addCfnInitProxy.test.ts b/test/patches/addCfnInitProxy.test.ts
new file mode 100644
index 0000000..5db90fc
--- /dev/null
+++ b/test/patches/addCfnInitProxy.test.ts
@@ -0,0 +1,177 @@
+/*
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
+import { Aspects, CfnElement, SecretValue, Stack } from 'aws-cdk-lib';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+import { AutoScalingGroup, Signals } from 'aws-cdk-lib/aws-autoscaling';
+import {
+  CloudFormationInit,
+  InitPackage,
+  Instance,
+  InstanceClass,
+  InstanceSize,
+  InstanceType,
+  MachineImage,
+  Vpc,
+} from 'aws-cdk-lib/aws-ec2';
+import { CfnSecret, Secret } from 'aws-cdk-lib/aws-secretsmanager';
+import { IConstruct } from 'constructs';
+import { AddCfnInitProxy, ProxyType } from '../../src/patches/addCfnInitProxy';
+
+let stack: Stack;
+
+beforeEach(() => {
+  stack = new Stack();
+});
+
+describe('Adding cfn-init proxy values to EC2 instance', () => {
+  test('http proxy with no password needed', () => {
+    const vpc = new Vpc(stack, 'TestVpc');
+    new Instance(stack, 'TestInstance', {
+      machineImage: MachineImage.latestAmazonLinux(),
+      instanceType: InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE),
+      vpc,
+      init: CloudFormationInit.fromElements(InitPackage.yum('python3')),
+    });
+    Aspects.of(stack).add(
+      new AddCfnInitProxy({
+        proxyHost: 'example.com',
+        proxyPort: 8080,
+      })
+    );
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::EC2::Instance', {
+      UserData: {
+        'Fn::Base64': {
+          'Fn::Join': [
+            '',
+            Match.arrayWith([
+              ' --http-proxy http://',
+              'example.com:8080',
+              ' --http-proxy http://',
+              'example.com:8080',
+            ]),
+          ],
+        },
+      },
+    });
+  });
+  test('https proxy with no password needed', () => {
+    const vpc = new Vpc(stack, 'TestVpc');
+    new Instance(stack, 'TestInstance', {
+      machineImage: MachineImage.latestAmazonLinux(),
+      instanceType: InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE),
+      vpc,
+      init: CloudFormationInit.fromElements(InitPackage.yum('python3')),
+    });
+    Aspects.of(stack).add(
+      new AddCfnInitProxy({
+        proxyHost: 'example.com',
+        proxyPort: 8080,
+        proxyType: ProxyType.HTTPS,
+      })
+    );
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::EC2::Instance', {
+      UserData: {
+        'Fn::Base64': {
+          'Fn::Join': [
+            '',
+            Match.arrayWith([
+              ' --https-proxy https://',
+              'example.com:8080',
+              ' --https-proxy https://',
+              'example.com:8080',
+            ]),
+          ],
+        },
+      },
+    });
+  });
+  test('Proxy with password', () => {
+    const vpc = new Vpc(stack, 'TestVpc');
+    new Instance(stack, 'TestInstance', {
+      machineImage: MachineImage.latestAmazonLinux(),
+      instanceType: InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE),
+      vpc,
+      init: CloudFormationInit.fromElements(InitPackage.yum('python3')),
+    });
+    const secret = new Secret(stack, 'TestSecret', {
+      secretObjectValue: {
+        user: SecretValue.unsafePlainText('someUser'),
+        password: SecretValue.unsafePlainText('superSecret123'),
+      },
+    });
+    Aspects.of(stack).add(
+      new AddCfnInitProxy({
+        proxyHost: 'example.com',
+        proxyPort: 8080,
+        proxyCredentials: secret,
+      })
+    );
+    const template = Template.fromStack(stack);
+    const secretConstruct = secret.node.findAll().find((x: IConstruct) => {
+      return x instanceof CfnSecret;
+    });
+    template.hasResourceProperties('AWS::EC2::Instance', {
+      UserData: {
+        'Fn::Base64': {
+          'Fn::Join': [
+            '',
+            Match.arrayWith([
+              ' --http-proxy http://',
+              {
+                'Fn::Join': [
+                  '',
+                  Match.arrayEquals([
+                    '{{resolve:secretsmanager:',
+                    { Ref: stack.getLogicalId(secretConstruct as CfnElement) },
+                    ':SecretString:user::}}:{{resolve:secretsmanager:',
+                    { Ref: stack.getLogicalId(secretConstruct as CfnElement) },
+                    ':SecretString:password::}}@',
+                  ]),
+                ],
+              },
+            ]),
+          ],
+        },
+      },
+    });
+  });
+});
+
+describe('Adding cfn-init proxy values to EC2 launch config', () => {
+  test('http proxy with no password needed', () => {
+    const vpc = new Vpc(stack, 'TestVpc');
+    new AutoScalingGroup(stack, 'TestAutoscalingGroup', {
+      vpc,
+      machineImage: MachineImage.latestAmazonLinux(),
+      instanceType: InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE),
+      init: CloudFormationInit.fromElements(InitPackage.yum('python3')),
+      signals: Signals.waitForAll(),
+    });
+    Aspects.of(stack).add(
+      new AddCfnInitProxy({
+        proxyHost: 'example.com',
+        proxyPort: 8080,
+      })
+    );
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::AutoScaling::LaunchConfiguration', {
+      UserData: {
+        'Fn::Base64': {
+          'Fn::Join': [
+            '',
+            Match.arrayWith([
+              ' --http-proxy http://',
+              'example.com:8080',
+              ' --http-proxy http://',
+              'example.com:8080',
+            ]),
+          ],
+        },
+      },
+    });
+  });
+});