The customer does not allow products like Layer 7 PAM to access the internet directly. Standing up another PAM appliance in the DMZ is unacceptable to the customer. Getting an exception to allow the PAM appliances direct access to the internet is highly undesired and could be rejected. The customer wants all such communication to go through a proxy. The customer is wanting CA PAM to manage AWS Console Administration users, but, as far as we can tell, that is only internet facing. Bottom line is the customer needs CA PAM to support going through an application proxy to connect to AWS to manage AWS Console Administration users.