验证使用不同IAM凭证连接两个AWS Neptune集群的方案是否正确

我需要从两个配置了不同IAM角色/用户的AWS Neptune端点获取数据，两个用户分别拥有独立的Access Key和Secret Key。根据AWS官方文档，需要将Access Key和Secret Key设置为系统属性。请问以下Java实现方式是否正确？

import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;
import com.amazonaws.neptune.auth.NeptuneNettyHttpSigV4Signer;
import com.amazonaws.neptune.auth.NeptuneSigV4SignerException;

 ...

System.setProperty("aws.accessKeyId","your-access-key1");
System.setProperty("aws.secretKey","your-secret-key1");

 ...

Cluster1 = Cluster.build((your cluster name1))
                 .enableSsl(true)
                 .handshakeInterceptor( r ->
                  {
                    try {
                      NeptuneNettyHttpSigV4Signer sigV4Signer =
                        new NeptuneNettyHttpSigV4Signer("(your region)", new DefaultAWSCredentialsProviderChain());
                      sigV4Signer.signRequest(r);
                    } catch (NeptuneSigV4SignerException e) {
                      throw new RuntimeException("Exception occurred while signing the request", e);
                    }
                    return r;
                  }
       
          ).create();
          
          
     ...

System.setProperty("aws.accessKeyId","your-access-key2");
System.setProperty("aws.secretKey","your-secret-key2");

 ...

Cluster2 = Cluster.build((your cluster name2))
                 .enableSsl(true)
                 .handshakeInterceptor( r ->
                  {
                    try {
                      NeptuneNettyHttpSigV4Signer sigV4Signer =
                        new NeptuneNettyHttpSigV4Signer("(your region)", new DefaultAWSCredentialsProviderChain());
                      sigV4Signer.signRequest(r);
                    } catch (NeptuneSigV4SignerException e) {
                      throw new RuntimeException("Exception occurred while signing the request", e);
                    }
                    return r;
                  }
       
          ).create();
              
          
          
try {
  Client client2 = Cluster2.connect();
  client2.submit("g.V().has('code','IAD')").all().get();
} catch (Exception e) {
  throw new RuntimeException("Exception occurred while connecting to cluster", e);
}

这种实现方式存在线程安全问题，并不正确，具体问题和改进方案如下：

问题核心 #

• 系统属性aws.accessKeyId和aws.secretKey是JVM全局共享的，修改后会影响所有依赖该属性的代码。后续Cluster1的请求可能会意外使用Cluster2的凭证，反之亦然，尤其在多线程场景下风险极高。
• DefaultAWSCredentialsProviderChain会优先读取全局系统属性，所以你的全局属性修改操作会导致两个签名器实例的凭证相互覆盖。

正确实现方案 #

放弃依赖全局系统属性，为每个Cluster创建独立的专属凭证提供者，确保凭证完全隔离：

import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.neptune.auth.NeptuneNettyHttpSigV4Signer;
import com.amazonaws.neptune.auth.NeptuneSigV4SignerException;

// 为Cluster1创建专属凭证
BasicAWSCredentials credentials1 = new BasicAWSCredentials("your-access-key1", "your-secret-key1");
AWSStaticCredentialsProvider provider1 = new AWSStaticCredentialsProvider(credentials1);

Cluster cluster1 = Cluster.build("your-cluster-name1")
        .enableSsl(true)
        .handshakeInterceptor(r -> {
            try {
                NeptuneNettyHttpSigV4Signer sigV4Signer =
                        new NeptuneNettyHttpSigV4Signer("your-region", provider1);
                sigV4Signer.signRequest(r);
            } catch (NeptuneSigV4SignerException e) {
                throw new RuntimeException("签名请求时发生异常", e);
            }
            return r;
        })
        .create();

// 为Cluster2创建专属凭证
BasicAWSCredentials credentials2 = new BasicAWSCredentials("your-access-key2", "your-secret-key2");
AWSStaticCredentialsProvider provider2 = new AWSStaticCredentialsProvider(credentials2);

Cluster cluster2 = Cluster.build("your-cluster-name2")
        .enableSsl(true)
        .handshakeInterceptor(r -> {
            try {
                NeptuneNettyHttpSigV4Signer sigV4Signer =
                        new NeptuneNettyHttpSigV4Signer("your-region", provider2);
                sigV4Signer.signRequest(r);
            } catch (NeptuneSigV4SignerException e) {
                throw new RuntimeException("签名请求时发生异常", e);
            }
            return r;
        })
        .create();

// 使用Cluster2连接并查询
try {
    Client client2 = cluster2.connect();
    client2.submit("g.V().has('code','IAD')").all().get();
} catch (Exception e) {
    throw new RuntimeException("连接集群时发生异常", e);
}

方案优势 #

• 每个Cluster的凭证完全独立，不存在相互干扰的风险，彻底避免线程安全问题
• 代码逻辑更直观，直接明确每个Cluster对应的凭证，无需依赖全局状态

内容的提问来源于stack exchange，提问作者Arpit Dongaonkar