可以通过 AWS 中的 secretmanagerid 检索或刷新密码，密码已按策略每五分钟轮换一次

Question

well that´s the question, It´s possible to retrieve or refresh a password by secretmanagerid in AWS?, the password has been rotated by a policy every five minutes. I don´t want to restart my microservice to retrieve the pass, I was looking for a solution and I found something like this:

<groupId>com.amazonaws.secretsmanager</groupId>

<artifactId>aws-secretsmanager-jdbc</artifactId>

<version>1.0.5</version>

spring:

datasource:

url: jdbc-secretsmanager:mysql://database-host:3306/rotate_db

username: secret/rotation

driver-class-name: com.amazonaws.secretsmanager.sql.AWSSecretsManagerMySQLDriver

But I don't want to use the configuration in the application.yml or.properties, I want to keep these values in the parameter store as secrets, currently my code looks like this:

@Bean
    public DataSource dataSource() {
        AwsSecrets secrets = getSecret();
        if(Objects.nonNull(secrets)){
            log.info("Getting parameters: host: {}, port: {}, Db: {}, user: {}, pass: {}", secrets.getHost(), secrets.getPort(), secrets.getDatabase(),secrets.getUsername(), secrets.getPassword());
            DataSource dataSource = DataSourceBuilder
                    .create()
                    .url("jdbc:postgresql://" + secrets.getHost() + ":" + secrets.getPort() + "/" + secrets.getDatabase())
                    .username(secrets.getUsername())
                    .password(secrets.getPassword())
                    .build();
            return new TracingDataSource(dataSource);
        }
        log.debug("Unable to get secrets");
        return null;
    }

    @Bean
    public Filter tracingFilter() {
        return new AWSXRayServletFilter("back-microservice");
    }


    private AwsSecrets getSecret() {

        AWSSecretsManager client = AWSSecretsManagerClientBuilder.standard()
                .withRegion(amazonRegion)
                .withCredentials(dynamoDBConfig.accountAmazonAWSCredentials())
                .build();

        String secret;
        GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest()
                .withSecretId(secretmanagerId);
        GetSecretValueResult getSecretValueResult = null;

        try {
            getSecretValueResult = client.getSecretValue(getSecretValueRequest);
        } catch (Exception e) {
            log.debug("Unable to get secrets values");
            throw e;
        }
        if (getSecretValueResult.getSecretString() != null) {
            secret = getSecretValueResult.getSecretString();
            return gson.fromJson(secret, AwsSecrets.class);
        }

        return null;
    }

Answer 1

Yes, it's possible to do. The exact implementation will vary by framework/ORM, but you would need to cache the credentials, but also check if a new password is needed every time a new connection is acquired.

In your code, you are setting the password once statically:

            DataSource dataSource = DataSourceBuilder
                    .create()
                    .url("jdbc:postgresql://" + secrets.getHost() + ":" + secrets.getPort() + "/" + secrets.getDatabase())
                    .username(secrets.getUsername())
                    .password(secrets.getPassword())
                    .build();

The getPassword() function is only ever called once when you build the datasource and is reused for additional connections from that data source. Instead, you need to retrieve (from cache/secretsmanger) every time a connection is created.

AWS provides a java caching client for AWS secretsmanager (clients for other languages are also available). You can adapt that into your data source to use that to retrieve the password for every connection . You can read the official guidance documentation on that here: Rotate database credentials without restarting containers .

In the context of Spring, that means implementing this pattern in your data source driver, which is exactly what the com.amazonaws.secretsmanager.sql.AWSSecretsManagerMySQLDriver class provides. Because you are rotating the secret so often, you probably want to configure the secret cache to refresh more often than the default of 1 hour or adjust your rotation frequency.

If you really need to be rotating the password that often and you're using RDS for your database, you might consider just using IAM-based authentication instead. I can't imagine why you would want to have a password that rotates so frequently, keeping in mind you are billed for secret retrieval API calls.