com.amazonaws.secretsmanager.caching.SecretCache Java Examples

protected SecretCache createSecretCache(
    String awsAccessKey,
    String awsSecretKey,
    String region,
    int cacheSize,
    long cacheTTL
) {
  AWSCredentialsProvider credentials = getCredentialsProvider(awsAccessKey, awsSecretKey);
  AWSSecretsManagerClientBuilder clientBuilder = AWSSecretsManagerClientBuilder
      .standard()
      .withRegion(region)
      .withCredentials(credentials);

  SecretCacheConfiguration cacheConf = new SecretCacheConfiguration()
      .withMaxCacheSize(cacheSize)
      .withCacheItemTTL(cacheTTL)
      .withClient(clientBuilder.build());

  return new SecretCache(cacheConf);
}
 

@Test
public void testInitDefaultConfigs() throws Exception {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);

  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(0, issues.size());

  Mockito.verify(secretManager, Mockito.times(1)).createSecretCache(
      awsAccessKey,
      awsSecretKey,
      region,
      SecretCacheConfiguration.DEFAULT_MAX_CACHE_SIZE,
      SecretCacheConfiguration.DEFAULT_CACHE_ITEM_TTL
  );
}
 

private AWSSecretsManagerCredentialStore setupNominalAWSSecretsManagerCredentialStore(
    SecretCache secretCache, String nameKeySeparator
) {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);
  if (nameKeySeparator != null) {
    Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.NAME_KEY_SEPARATOR_PROP)).thenReturn(
        nameKeySeparator);
  }

  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(0, issues.size());

  return secretManager;
}
 

@Test
public void testGetAlwaysRefresh() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  String credName = "credName";
  String credKey = "credKey";
  String credValue = "credValue";
  Mockito.when(secretCache.getSecretString(credName)).thenReturn(createJSONString(credKey, credValue));
  Mockito.verify(secretCache, Mockito.times(0)).refreshNow(credName);
  CredentialValue credentialValue = secretManager.get(
      "",
      credName + "&" + credKey,
      AWSSecretsManagerCredentialStore.ALWAYS_REFRESH_OPTION + "=true"
  );
  Mockito.verify(secretCache, Mockito.times(1)).refreshNow(credName);
  Assert.assertEquals(credValue, credentialValue.get());
  Mockito.verify(secretCache, Mockito.times(2)).refreshNow(credName);
}
 

@Test
public void testGetOtherSeparatorWithNonDefault() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache, "|");

  String credName = "credName";
  String credKey = "credKey";
  String credValue = "credValue";
  Mockito.when(secretCache.getSecretString(credName)).thenReturn(createJSONString(credKey, credValue));
  CredentialValue credentialValue = secretManager.get(
      "",
      credName + "|" + credKey,
      null
  );
  Assert.assertEquals(credValue, credentialValue.get());
  Mockito.verify(secretCache, Mockito.times(0)).refreshNow(credName);

  credentialValue = secretManager.get(
      "",
      credName + "]" + credKey,
      AWSSecretsManagerCredentialStore.SEPARATOR_OPTION + "=]"
  );
  Assert.assertEquals(credValue, credentialValue.get());
  Mockito.verify(secretCache, Mockito.times(0)).refreshNow(credName);
}
 

@Test
public void testGetOtherSeparator() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  String credName = "credName";
  String credKey = "credKey";
  String credValue = "credValue";
  Mockito.when(secretCache.getSecretString(credName)).thenReturn(createJSONString(credKey, credValue));
  CredentialValue credentialValue = secretManager.get(
      "",
      credName + "|" + credKey,
      AWSSecretsManagerCredentialStore.SEPARATOR_OPTION + "=|"
  );
  Assert.assertEquals(credValue, credentialValue.get());
  Mockito.verify(secretCache, Mockito.times(0)).refreshNow(credName);
}
 

@Test
public void testInitResourceNotFoundException() throws Exception {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);

  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerException exception = new ResourceNotFoundException("message");
  exception.setErrorCode("ResourceNotFoundException");
  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache, exception);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(0, issues.size());  // ResourceNotFoundException should be ignored at initialization.
}
 

@Test
public void testInitAccessDeniedException() throws Exception {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);

  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerException exception = new AWSSecretsManagerException("message");
  exception.setErrorCode("AccessDeniedException");
  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache, exception);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(0, issues.size());  // AccessDeniedException should be ignored at initialization.
}
 

@Test
public void testInitIncorrectAWSKeys() throws Exception {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);

  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerException exception = new AWSSecretsManagerException("message");
  exception.setErrorCode("IncompleteSignature");
  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache, exception);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(1, issues.size());
  Mockito.verify(context, Mockito.times(1)).createConfigIssue(
      Errors.AWS_SECRETS_MANAGER_CRED_STORE_01,
      exception.getMessage(),
      exception
  );
}
 

@Test
public void testInitIncorrectRegion() throws Exception {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);

  SecretCache secretCache = Mockito.mock(SecretCache.class);
  SdkClientException exception = new SdkClientException("message");
  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache, exception);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(1, issues.size());
  Mockito.verify(context, Mockito.times(1)).createConfigIssue(
      Errors.AWS_SECRETS_MANAGER_CRED_STORE_01,
      exception.getMessage(),
      exception
  );
}
 

/**
 * Gets the username failure invalid content test.
 *
 * @return the username failure invalid content test
 * @throws Exception the exception
 */
@Test(expected=RuntimeException.class)
public void getUsernameFailureInvalidContentTest() throws Exception {
	assertNotNull(new SecretCredentialsManagerImpl(null, "true", null, null) {
		
		@Override
		protected SecretCache getSecretCache() {
			return new SecretCache(Mockito.mock(AWSSecretsManager.class)) {
								 
				@Override
				public String getSecretString(final String secretId) {
					return "{ \"wrongusernamefield\" : \"username\" }";
				}
			};
		}
	}.getUsername());
}
 

/**
 * Gets the username success test.
 *
 * @return the username success test
 * @throws Exception the exception
 */
@Test
public void getUsernameSuccessTest() throws Exception {
	assertNotNull(new SecretCredentialsManagerImpl(null, "true", null, null) {
		
		@Override
		protected SecretCache getSecretCache() {
			return new SecretCache(Mockito.mock(AWSSecretsManager.class)) {
								 
				@Override
				public String getSecretString(final String secretId) {
					return "{ \"username\" : \"username\" }";
				}
			};
		}
	}.getUsername());
}
 

/**
 * Gets the password success test.
 *
 * @return the password success test
 * @throws Exception the exception
 */
@Test
public void getPasswordSuccessTest() throws Exception {
	final SecretCredentialsManagerImpl secretCredentialsManagerImpl = new SecretCredentialsManagerImpl(null, "true", null, null) {
		
		@Override
		protected SecretCache getSecretCache() {
			return new SecretCache(Mockito.mock(AWSSecretsManager.class)) {
								 
				@Override
				public String getSecretString(final String secretId) {
					return "{ \"password\" : \"password\", \"username\" : \"username\" }";
				}
			};
		}
	};
	assertNotNull(secretCredentialsManagerImpl.getUsername());
	assertNotNull(secretCredentialsManagerImpl.getPassword());
}
 

/**
 * Constructs the driver setting the properties from the properties file using system properties as defaults.
 * Sets the secret cache to the cache that was passed in.
 *
 * @param cache                                             Secret cache to use to retrieve secrets
 */
protected AWSSecretsManagerDriver(SecretCache cache) {

    final Config config = Config.loadMainConfig();

    String vpcEndpointUrl = config.getStringPropertyWithDefault(PROPERTY_PREFIX+"."+PROPERTY_VPC_ENDPOINT_URL, null);
    String vpcEndpointRegion = config.getStringPropertyWithDefault(PROPERTY_PREFIX+"."+PROPERTY_VPC_ENDPOINT_REGION, null);

    if (vpcEndpointUrl == null || vpcEndpointUrl.isEmpty() || vpcEndpointRegion == null || vpcEndpointRegion.isEmpty()) {
        this.secretCache = cache;
    } else {
        AWSSecretsManagerClientBuilder builder = AWSSecretsManagerClientBuilder.standard();
        builder.setEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration(vpcEndpointUrl, vpcEndpointRegion));

        this.secretCache = new SecretCache(builder);
    }

    setProperties();
    AWSSecretsManagerDriver.register(this);
}
 

/**
 * Gets the username exception test.
 *
 * @return the username exception test
 * @throws Exception the exception
 */
@Test(expected=RuntimeException.class)
public void getUsernameExceptionTest() throws Exception {
	new SecretCredentialsManagerImpl(null, "true", null, null) {
		
		protected SecretCache getSecretCache() {
			throw new DecryptionFailureException(null);
		}
	}.getUsername();
}
 

private AWSSecretsManagerCredentialStore createAWSSecretsManagerCredentialStore(
    SecretCache secretCache,
    Exception verifyException
) {
  AWSSecretsManagerCredentialStore credentialStore = Mockito.spy(new AWSSecretsManagerCredentialStore());
  Mockito.when(credentialStore.createSecretCache(
      Mockito.anyString(),
      Mockito.anyString(),
      Mockito.anyString(),
      Mockito.anyInt(),
      Mockito.anyLong()
  )).thenReturn(secretCache);
  Mockito.when(secretCache.getSecretString("test-AWSSecretsManagerCredentialStore")).thenThrow(verifyException);
  return credentialStore;
}
 

@Test
public void testInit() throws Exception {
  String region = "us-west-2";
  String awsAccessKey = "access-key";
  String awsSecretKey = "secret-key";
  int cacheSize = 20;
  long cacheTTL = 1000L;

  CredentialStore.Context context = Mockito.mock(CredentialStore.Context.class);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_REGION_PROP)).thenReturn(region);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_ACCESS_KEY_PROP)).thenReturn(awsAccessKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.AWS_SECRET_KEY_PROP)).thenReturn(awsSecretKey);
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.CACHE_MAX_SIZE_PROP)).thenReturn(
      Integer.toString(cacheSize));
  Mockito.when(context.getConfig(AWSSecretsManagerCredentialStore.CACHE_TTL_MILLIS_PROP)).thenReturn(
      Long.toString(cacheTTL));

  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = createAWSSecretsManagerCredentialStore(secretCache);
  List<CredentialStore.ConfigIssue> issues = secretManager.init(context);
  Assert.assertEquals(0, issues.size());

  Mockito.verify(secretManager, Mockito.times(1)).createSecretCache(
      awsAccessKey,
      awsSecretKey,
      region,
      cacheSize,
      cacheTTL
  );
}
 

@Test
public void testDestroy() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  Mockito.verify(secretCache, Mockito.times(0)).close();
  secretManager.destroy();
  Mockito.verify(secretCache, Mockito.times(1)).close();
}
 

@Test
public void testGetCredentialMissingSeparator() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  try {
    secretManager.get("", "a", null);
    Assert.fail("Expected a StageException");
  } catch (IllegalArgumentException e) {
    // expected
  }
}
 

@Test
public void testGetCredentialNotFound() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  String credName = "credName";
  String credKey = "credKey";
  Mockito.when(secretCache.getSecretString(credName)).thenReturn(null);
  try {
    secretManager.get("", credName + "&" + credKey, null);
    Assert.fail("Expected a StageException");
  } catch (StageException e) {
    Assert.assertEquals(Errors.AWS_SECRETS_MANAGER_CRED_STORE_02, e.getErrorCode());
  }
}
 

@Test
public void testGetCredentialNotFound2() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  String credName = "credName";
  String credKey = "credKey";
  Mockito.when(secretCache.getSecretString(credName)).thenThrow(new ResourceNotFoundException(""));
  try {
    secretManager.get("", credName + "&" + credKey, null);
    Assert.fail("Expected a StageException");
  } catch (StageException e) {
    Assert.assertEquals(Errors.AWS_SECRETS_MANAGER_CRED_STORE_03, e.getErrorCode());
  }
}
 

@Test
public void testGetKeyNotFound() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  String credName = "credName";
  String credKey = "credKey";
  Mockito.when(secretCache.getSecretString(credName)).thenReturn(createJSONString("foo", "bar"));
  try {
    secretManager.get("", credName + "&" + credKey, null);
    Assert.fail("Expected a StageException");
  } catch (StageException e) {
    Assert.assertEquals(Errors.AWS_SECRETS_MANAGER_CRED_STORE_04, e.getErrorCode());
  }
}
 

@Test
public void testGet() throws Exception {
  SecretCache secretCache = Mockito.mock(SecretCache.class);
  AWSSecretsManagerCredentialStore secretManager = setupNominalAWSSecretsManagerCredentialStore(secretCache);

  String credName = "credName";
  String credKey = "credKey";
  String credValue = "credValue";
  Mockito.when(secretCache.getSecretString(credName)).thenReturn(createJSONString(credKey, credValue));
  CredentialValue credentialValue = secretManager.get("", credName + "&" + credKey, null);
  Assert.assertEquals(credValue, credentialValue.get());
  Mockito.verify(secretCache, Mockito.times(0)).refreshNow(credName);
}
 

private AWSSecretsManagerCredentialStore setupNominalAWSSecretsManagerCredentialStore(SecretCache secretCache) {
  return setupNominalAWSSecretsManagerCredentialStore(secretCache, null);
}
 

private AWSSecretsManagerCredentialStore createAWSSecretsManagerCredentialStore(SecretCache secretCache) {
  return createAWSSecretsManagerCredentialStore(secretCache, new ResourceNotFoundException(""));
}
 

/**
 * Constructs the driver setting the properties from the properties file using system properties as defaults.
 * Uses the passed in SecretCache.
 *
 * @param cache                                             Secret cache to use to retrieve secrets
 */
public AWSSecretsManagerOracleDriver(SecretCache cache) {
    super(cache);
}
 

/**
 * Constructs the driver setting the properties from the properties file using system properties as defaults.
 * Uses the passed in SecretCache.
 *
 * @param cache                                             Secret cache to use to retrieve secrets
 */
public AWSSecretsManagerMSSQLServerDriver(SecretCache cache) {
    super(cache);
}
 

/**
 * Constructs the driver setting the properties from the properties file using system properties as defaults.
 * Instantiates the secret cache with default options.
 */
protected AWSSecretsManagerDriver() {
    this(new SecretCache());
}
 

/**
 * Constructs the driver setting the properties from the properties file using system properties as defaults.
 * Instantiates the secret cache with the passed in client builder.
 *
 * @param builder                                           Builder used to instantiate cache
 */
protected AWSSecretsManagerDriver(AWSSecretsManagerClientBuilder builder) {
    this(new SecretCache(builder));
}
 

/**
 * Constructs the driver setting the properties from the properties file using system properties as defaults.
 * Instantiates the secret cache with the provided AWS Secrets Manager client.
 *
 * @param client                                            AWS Secrets Manager client to instantiate cache
 */
protected AWSSecretsManagerDriver(AWSSecretsManager client) {
    this(new SecretCache(client));
}