本地Java调用AWS Secrets Manager时凭证加载失败求助

本地Java环境编写测试代码访问AWS Secrets Manager存储的凭证，已通过aws sts get-caller-identity验证本地存在有效会话，且在IntelliJ终端执行aws secretsmanager get-secret-value --secret-id some-id可成功获取密钥值，但使用以下AWS SDK代码调用时失败：

var client = SecretsManagerClient.builder()
        .region(Region.of(region))
        .build();

var getSecretValueRequest = GetSecretValueRequest.builder()
        .secretId(secretName)
        .build();

var getSecretValueResponse = client.getSecretValue(getSecretValueRequest); 

错误信息 #

software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(profilesAndSectionsMap=[{default=Profile(name=default, properties=[output, sso_session, aws_access_key_id, aws_secret_access_key, region, sso_role_name, sso_account_id])}, {my-sso=Profile(name=my-sso, properties=[sso_region, sso_start_url, sso_registration_scopes])}])), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(profilesAndSectionsMap=[{default=Profile(name=default, properties=[output, sso_session, aws_access_key_id, aws_secret_access_key, region, sso_role_name, sso_account_id])}, {my-sso=Profile(name=my-sso, properties=[sso_region, sso_start_url, sso_registration_scopes])}])): To use Sso related properties in the 'default' profile, the 'sso' service module must be on the class path., ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Failed to load credentials from IMDS.]

    at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:111)
    at software.amazon.awssdk.auth.credentials.AwsCredentialsProviderChain.resolveCredentials(AwsCredentialsProviderChain.java:117)
    at software.amazon.awssdk.auth.credentials.internal.LazyAwsCredentialsProvider.resolveCredentials(LazyAwsCredentialsProvider.java:45)
    at software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider.resolveCredentials(DefaultCredentialsProvider.java:123)
    at software.amazon.awssdk.core.internal.util.MetricUtils.measureDuration(MetricUtils.java:50)
    at software.amazon.awssdk.awscore.internal.authcontext.AwsCredentialsAuthorizationStrategy.resolveCredentials(AwsCredentialsAuthorizationStrategy.java:100)
    at software.amazon.awssdk.awscore.internal.authcontext.AwsCredentialsAuthorizationStrategy.addCredentialsToExecutionAttributes(AwsCredentialsAuthorizationStrategy.java:77)
    at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.invokeInterceptorsAndCreateExecutionContext(AwsExecutionContextBuilder.java:120)
    at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.invokeInterceptorsAndCreateExecutionContext(AwsSyncClientHandler.java:69)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:78)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:179)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76)
    at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
    at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:56)
    at software.amazon.awssdk.services.secretsmanager.DefaultSecretsManagerClient.getSecretValue(DefaultSecretsManagerClient.java:983)

核心原因 #

错误日志中明确提示：To use Sso related properties in the 'default' profile, the 'sso' service module must be on the class path.，说明本地AWS CLI使用SSO会话完成身份验证，但Java SDK缺少处理SSO凭证的依赖模块，导致无法识别SSO类型的配置。

解决步骤 #

1. 添加AWS SSO相关依赖 #

根据项目构建工具，添加对应的依赖：

• Maven：在pom.xml中加入

<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>sso</artifactId>
    <version>${aws.sdk.version}</version>
</dependency>
<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>ssooidc</artifactId>
    <version>${aws.sdk.version}</version>
</dependency>

• Gradle：在build.gradle中加入

implementation 'software.amazon.awssdk:sso:<aws-sdk-version>'
implementation 'software.amazon.awssdk:ssooidc:<aws-sdk-version>'

注意替换占位符为当前项目使用的AWS SDK版本，确保与Secrets Manager依赖版本一致。

2. 确认本地SSO会话有效性 #

执行aws sso login重新验证SSO会话，确保~/.aws/credentials和~/.aws/config中的default配置正确关联SSO会话信息。

3. 可选：显式指定凭证提供者 #

若自动凭证链仍未生效，可在代码中显式指定ProfileCredentialsProvider：

var client = SecretsManagerClient.builder()
        .region(Region.of(region))
        .credentialsProvider(ProfileCredentialsProvider.create())
        .build();

内容的提问来源于stack exchange，提问作者raah