如何从外部REST服务获取并管理AWS凭证（Spring Boot环境）

针对Vault轮换AWS密钥的场景，你需要实现动态可刷新的AWS凭证提供者，同时将S3客户端配置为Spring单例Bean，既避免重复创建客户端，又能自动获取最新密钥。以下是具体实现步骤：

1. 自定义可刷新的AWS凭证提供者 #

实现AWS SDK v1的AWSCredentialsProvider接口，内部缓存凭证并自动检查过期时间，必要时调用Vault API刷新密钥：

import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.BasicAWSCredentials;
import org.springframework.stereotype.Component;

import java.time.Instant;
import java.util.concurrent.locks.ReentrantLock;

@Component
public class VaultRefreshingAwsCredentialsProvider implements AWSCredentialsProvider {

    private AWSCredentials currentCredentials;
    private Instant expirationTime;
    private final ReentrantLock lock = new ReentrantLock();

    @Override
    public AWSCredentials getCredentials() {
        lock.lock();
        try {
            // 首次获取或凭证即将过期时刷新
            if (currentCredentials == null || Instant.now().isAfter(expirationTime)) {
                refreshCredentials();
            }
            return currentCredentials;
        } finally {
            lock.unlock();
        }
    }

    @Override
    public void refresh() {
        lock.lock();
        try {
            refreshCredentials();
        } finally {
            lock.unlock();
        }
    }

    private void refreshCredentials() {
        // 替换为你的Vault REST API调用逻辑，获取最新密钥
        String accessKey = fetchAccessKeyFromVault();
        String secretKey = fetchSecretKeyFromVault();
        
        this.currentCredentials = new BasicAWSCredentials(accessKey, secretKey);
        // 设置提前刷新时间（比如提前5分钟，避免刚好过期时调用失败）
        this.expirationTime = Instant.now().plusSeconds(3300);
    }

    // 实现Vault API获取Access Key
    private String fetchAccessKeyFromVault() {
        // 示例：用RestTemplate/WebClient调用Vault接口
        // return restTemplate.getForObject("/vault/aws/access-key", String.class);
        throw new UnsupportedOperationException("请实现Vault Access Key获取逻辑");
    }

    // 实现Vault API获取Secret Key
    private String fetchSecretKeyFromVault() {
        // 示例：用RestTemplate/WebClient调用Vault接口
        // return restTemplate.getForObject("/vault/aws/secret-key", String.class);
        throw new UnsupportedOperationException("请实现Vault Secret Key获取逻辑");
    }
}

2. 配置单例S3客户端Bean #

将S3客户端配置为Spring单例Bean，使用自定义的凭证提供者：

import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.regions.Regions;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class AwsS3Config {

    @Bean
    public AmazonS3 amazonS3(VaultRefreshingAwsCredentialsProvider credentialsProvider) {
        return AmazonS3ClientBuilder.standard()
                .withRegion(Regions.US_EAST_1)
                .withCredentials(credentialsProvider)
                .build();
    }
}

3. 异常重试处理（可选但推荐） #

当Vault提前轮换密钥导致凭证突然失效时，通过重试机制自动刷新凭证并重试请求：

第一步：添加重试依赖（pom.xml） #

<dependency>
    <groupId>org.springframework.retry</groupId>
    <artifactId>spring-retry</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-aop</artifactId>
</dependency>

第二步：配置重试模板 #

import com.amazonaws.SdkClientException;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.retry.annotation.EnableRetry;
import org.springframework.retry.backoff.FixedBackOffPolicy;
import org.springframework.retry.policy.SimpleRetryPolicy;
import org.springframework.retry.support.RetryTemplate;

import java.util.Collections;
import java.util.Map;

@Configuration
@EnableRetry
public class RetryConfig {

    @Bean
    public RetryTemplate retryTemplate() {
        RetryTemplate retryTemplate = new RetryTemplate();

        // 仅重试凭证相关的SDK异常
        SimpleRetryPolicy retryPolicy = new SimpleRetryPolicy();
        Map<Class<? extends Throwable>, Boolean> retryableExceptions = Collections.singletonMap(
                SdkClientException.class, true);
        retryPolicy.setRetryableExceptions(retryableExceptions);
        retryPolicy.setMaxAttempts(2); // 最多重试1次

        // 重试前等待1秒，避免频繁刷新
        FixedBackOffPolicy backOffPolicy = new FixedBackOffPolicy();
        backOffPolicy.setBackOffPeriod(1000);
        retryTemplate.setBackOffPolicy(backOffPolicy);

        return retryTemplate;
    }
}

第三步：在业务服务中使用重试 #

import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.SdkClientException;
import org.springframework.retry.annotation.Retryable;
import org.springframework.stereotype.Service;

@Service
public class S3Service {

    private final AmazonS3 amazonS3;
    private final VaultRefreshingAwsCredentialsProvider credentialsProvider;

    public S3Service(AmazonS3 amazonS3, VaultRefreshingAwsCredentialsProvider credentialsProvider) {
        this.amazonS3 = amazonS3;
        this.credentialsProvider = credentialsProvider;
    }

    @Retryable(value = SdkClientException.class)
    public void uploadObject(String bucketName, String key, byte[] content) {
        try {
            amazonS3.putObject(bucketName, key, content);
        } catch (SdkClientException e) {
            // 判断是否为凭证失效错误，是的话先刷新凭证
            if (isCredentialError(e.getMessage())) {
                credentialsProvider.refresh();
            }
            throw e; // 抛出异常触发重试
        }
    }

    private boolean isCredentialError(String errorMsg) {
        return errorMsg != null && (errorMsg.contains("InvalidAccessKeyId")
                || errorMsg.contains("SignatureDoesNotMatch")
                || errorMsg.contains("ExpiredToken"));
    }
}

核心优势 #

• 单例客户端：S3客户端仅初始化一次，避免重复创建开销
• 自动刷新：凭证提供者会自动检查过期时间，提前刷新密钥
• 异常容错：重试机制处理突发的密钥轮换场景，保证业务连续性

内容的提问来源于stack exchange，提问作者feco