AWS IAM与spring-session-data-redis集成问题及解决

问题场景 #

• 本地环境（localhost:6397）下，spring-session-data-redis运行正常
• 上游环境采用AWS托管的Redis实例，需通过IAM认证访问
• 需实现将AWS IAM凭证集成到spring-session-data-redis项目中

尝试过的解决方案 #

方案1：基于Lettuce官方文档配置 #

创建了LettuceConfig配置类，代码能成功创建Redis连接，但spring-session-data-redis并未注入该连接。代码如下：

public class LettuceConfig {

@Value("${redis.host}")
String redisHost;
@Value("${redis.port}")
int redisPort;

@Value("${redis.userid}")
String userId;
@Value("${redis.replication.group.id}")
String replicationGroupId;
@Value("${redis.region}")
String region;

@Bean(destroyMethod = "shutdown")
ClientResources clientResources() {
    return DefaultClientResources.create();
}

@Bean(destroyMethod = "shutdown")
@Primary
RedisClient redisClient(ClientResources clientResources) {
    RedisURI redisURI = RedisURI.builder()
            .withHost(redisHost)
            .withPort(redisPort)
            .withSsl(true)
            .withAuthentication(getCredentialsProvider())
            .build();

    return RedisClient.create(clientResources, redisURI);
}

@Bean(destroyMethod = "close")
StatefulRedisConnection<String, String> connection(RedisClient redisClient) {
    log.info("Redis-Host in LettuceConfig:" + redisHost);
    return redisClient.connect();
}


public RedisCredentialsProvider getCredentialsProvider() {

    AwsCredentialsProvider awsCredentialsProvider = DefaultCredentialsProvider.create();
    IAMAuthTokenRequest iamAuthTokenRequest = new IAMAuthTokenRequest(this.userId, this.replicationGroupId, this.region);

    // Create a Redis credentials provider using IAM credentials.
    return new RedisIAMAuthCredentialsProvider(
            this.userId, iamAuthTokenRequest, awsCredentialsProvider);

}

方案2：参考Spring Data Redis GitHub Issue配置 #

创建ClusterSessionConfig配置类，运行时出现命令超时（基础设施安全组已配置，可通过VPN使用redis-cli连接，但开发环境无法连接）。代码如下：

@Configuration
public class ClusterSessionConfig extends AbstractHttpSessionApplicationInitializer {

    @Value("${redis.host}")
    String redisHost;
    @Value("${redis.port}")
    int redisPort;

    @Value("${redis.userid}")
    String userId;
    @Value("${redis.replication.group.id}")
    String replicationGroupId;
    @Value("${redis.region}")
    String region;

   @Bean
   public LettuceConnectionFactory lettuceConnectionFactory() {
       RedisURI redisURI = RedisURI.builder()
           .withHost(redisHost)
           .withPort(redisPort)
           .withSsl(true)
           .withTimeout(Duration.ofSeconds(10))
           .build();
   LettuceClientConfiguration lettuceClientConfiguration = LettuceClientConfiguration.builder().redisCredentialsProviderFactory(new IAMCredentialsProviderFactory(userId,replicationGroupId,region)).commandTimeout(Duration.ofSeconds(30)).build();
   return new LettuceConnectionFactory(LettuceConnectionFactory.createRedisConfiguration(redisURI),lettuceClientConfiguration);
   }
}

最终解决方法 #

• 必须为LettuceClientConfiguration显式配置SSL
• 使用RedisClusterClient而非RedisStandaloneClient，因为AWS Redis无法适配单机版客户端

内容的提问来源于stack exchange，提问作者noircc