Plain HTTP was refused

Code: egress.plain_http

What happened

The request used plain HTTP where the box’s egress takes TLS only.

Awake’s answer says:

this box's egress carries TLS only here: use https

Why Awake does this

Every request a box sends leaves through the Egress Proxy, outside the box, which allows only what your org’s policy names and refuses the rest. The Egress Proxy says more.

What you can do

Use https. If your tool can’t, ask your Awake admin.

Most tools take https in place of http with no other change. Package managers and SDKs usually do on their own; check a tool’s configuration if it names an http URL.

Plain HTTP to a host your box may reach works where your org’s open egress setting is open, its default, unless your box’s posture is Offline. Your box takes https only, and gets this code, where:

• your org’s open egress setting is strict;
• your box’s posture is Offline;
• your org’s policy checks requests for secrets, such as access keys and tokens;
• Awake adds your org’s own credential to requests to the host: a credential travels over https alone.

If none of these fits, ask your Awake admin.

What your admin can do

In the console, an Org admin opens Admin → Policies → Access.

Access sets each box’s posture. A box under the Offline posture takes https only.

For every other posture, your org’s open egress setting, part of its policy, decides plain HTTP. Open, the default, lets a box use any protocol to the destinations it may reach, plain HTTP among them. Strict takes every box back to https only. An Org admin can switch a strict org to open. The console doesn’t show this setting yet, so for now an Org admin changes it through Awake’s API.

While your org’s policy checks requests for secrets, boxes take https only for web requests, whatever this setting says.

For agents

Tell the person what was refused and why, with this code, and don’t retry in a loop. Don’t try another host, encoding or route to get around a control.

Where Awake records it

The Egress Proxy records each refusal, never the request’s data. Org admins and security auditors read the records in the Audit log.

Related codes

• egress.not_allowed: The destination isn’t allowed
• egress.not_tls: A tunnel didn’t carry TLS

Still stuck

Ask your Awake admin. Give them the code, egress.plain_http, and when it happened.