How do I connect to my AWS DynamoDB instance from a Spring Java Elastic Beanstalk app?

Question

I am dabbling with DynamoDB and have written an application using Spring Boot.

I have developed it locally (on my own desktop) connecting to my own instance of DynamoDB also running locally. My connection info is held in a properties file in resources (included in the classpath).

I want to run it on Elastic Beanstalk in AWS to connect to a AWS-hosted DynamoDB instance.

What should I put in my properties file? or better yet, does AWS make it easy to have environment-specific properties? I would, for example, prefer to not have to hold my live instance access keys in a plain text file in source control. Or should I roll my own mechanism?

Answer 1

This question is really two questions: 1) How to connect a Java application to an AWS Dynamo DB instance and 2) How to securely manage credentials.

For 1 it is pretty straightforward, there is a java AWS SDK that provides an interface for connecting to Dynamo instances. The main way is to export some AWS credentials as environment variables, and then the AWS SDK will pick them up and authenticate automatically:

export AWS_ACCESS_KEY_ID=your_access_key_id
export AWS_SECRET_ACCESS_KEY=your_secret_access_key

Then you can instantiate a Dynamo client in your code:

AmazonDynamoDB client = AmazonDynamoDBClientBuilder.standard()
    .withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration(
        "http://localhost:8000",
        "us-west-2"))
    .build(); 

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/CodeSamples.Java.html

For 2, there is no one correct answer. I do agree with you that putting credentials in plain text in the repo is not a great way to go. There are several better ways. The basic idea is that you would encrypt the text file holding your secrets in the repo and then decrypt it when deploying. This decryption can be done manually or in some kind of deploy script. Look into AWS KMS services for AWS secrets management. Unfortunately your question is too open-ended to answer more concretely.