如何在AWS中通过SecretManagerID免重启获取/刷新定期轮换的密码？

问题分析 #

你当前的dataSource() Bean仅在初始化时调用一次getSecret()获取密码，当Secrets Manager按策略完成密码轮换后，DataSource会持续使用旧密码，无法自动更新凭证。核心需求是实现不重启服务即可动态获取刷新后的密码，同时避免在配置文件中硬编码数据库连接相关配置，将关键参数（如SecretManager ID）存放在参数存储中。

改造方案 #

1. 基础依赖准备 #

若未引入Spring Cloud AWS相关组件，添加以下依赖（适配你的Spring版本）：

<dependency>
    <groupId>io.awspring.cloud</groupId>
    <artifactId>spring-cloud-starter-aws-secrets-manager-config</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-bootstrap</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

2. 从Parameter Store加载SecretManager ID #

步骤1：在AWS Parameter Store中存储密钥ID

在Parameter Store创建参数（例如/your-service/secretmanager-id），值为你的Secrets Manager密钥ID。

步骤2：配置加载参数

在bootstrap.yml中添加配置，仅加载Parameter Store中的密钥ID，不直接配置DataSource：

spring:
  cloud:
    aws:
      secretsmanager:
        enabled: false
      parameterstore:
        enabled: true
        prefix: /your-service
        name: secretmanager-id
  management:
    endpoints:
      web:
        exposure:
          include: refresh

3. 实现动态刷新的DataSource #

通过@RefreshScope标记DataSource Bean，触发刷新时会重新调用getSecret()获取最新密码：

import org.springframework.cloud.context.config.annotation.RefreshScope;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jdbc.datasource.DriverManagerDataSource;

@Configuration
public class DataSourceConfig {

    private final String secretmanagerId;
    private final String amazonRegion;
    private final DynamoDBConfig dynamoDBConfig;
    private final Gson gson;

    // 构造器注入从Parameter Store加载的secretmanagerId及其他依赖
    public DataSourceConfig(String secretmanagerId, String amazonRegion, DynamoDBConfig dynamoDBConfig, Gson gson) {
        this.secretmanagerId = secretmanagerId;
        this.amazonRegion = amazonRegion;
        this.dynamoDBConfig = dynamoDBConfig;
        this.gson = gson;
    }

    @Bean
    @RefreshScope
    public DataSource dataSource() {
        AwsSecrets secrets = getSecret();
        if (secrets == null) {
            throw new IllegalStateException("Failed to retrieve database secrets");
        }

        DriverManagerDataSource dataSource = new DriverManagerDataSource();
        dataSource.setUrl(String.format("jdbc:postgresql://%s:%s/%s", 
            secrets.getHost(), secrets.getPort(), secrets.getDatabase()));
        dataSource.setUsername(secrets.getUsername());
        dataSource.setPassword(secrets.getPassword());
        dataSource.setDriverClassName("org.postgresql.Driver");
        
        return new TracingDataSource(dataSource);
    }

    private AwsSecrets getSecret() {
        AWSSecretsManager client = AWSSecretsManagerClientBuilder.standard()
                .withRegion(amazonRegion)
                .withCredentials(dynamoDBConfig.accountAmazonAWSCredentials())
                .build();

        GetSecretValueRequest request = new GetSecretValueRequest().withSecretId(secretmanagerId);
        try {
            GetSecretValueResult result = client.getSecretValue(request);
            if (result.getSecretString() != null) {
                return gson.fromJson(result.getSecretString(), AwsSecrets.class);
            }
        } catch (Exception e) {
            throw new RuntimeException("Failed to fetch secrets from AWS Secrets Manager", e);
        }
        return null;
    }

    @Bean
    public Filter tracingFilter() {
        return new AWSXRayServletFilter("back-microservice");
    }
}

4. 触发密码刷新的方式 #

• 手动触发：调用Spring Actuator的POST /actuator/refresh端点，触发DataSource重新初始化并获取最新密码。
• 自动触发：配置AWS EventBridge监听Secrets Manager的密码轮换事件，当事件触发时调用你的微服务/actuator/refresh端点，实现全自动化刷新。

备选方案：无RefreshScope的自动刷新 #

若不想依赖Spring Cloud的RefreshScope，可自定义DataSource包装类，定期检查并刷新密码：

import javax.sql.DataSource;
import java.sql.Connection;
import java.sql.SQLException;
import java.time.Duration;
import java.time.Instant;

public class DynamicRefreshDataSource implements DataSource {

    private volatile DataSource targetDataSource;
    private Instant lastRefreshTime;
    private final Duration refreshInterval = Duration.ofMinutes(4); // 比轮换周期短1分钟，避免失效
    private final DataSourceConfig dataSourceConfig;

    public DynamicRefreshDataSource(DataSourceConfig dataSourceConfig) {
        this.dataSourceConfig = dataSourceConfig;
        this.targetDataSource = dataSourceConfig.dataSource();
        this.lastRefreshTime = Instant.now();
    }

    @Override
    public Connection getConnection() throws SQLException {
        checkAndRefresh();
        return targetDataSource.getConnection();
    }

    @Override
    public Connection getConnection(String username, String password) throws SQLException {
        checkAndRefresh();
        return targetDataSource.getConnection(username, password);
    }

    private void checkAndRefresh() {
        if (Instant.now().minus(refreshInterval).isAfter(lastRefreshTime)) {
            synchronized (this) {
                if (Instant.now().minus(refreshInterval).isAfter(lastRefreshTime)) {
                    this.targetDataSource = dataSourceConfig.dataSource();
                    this.lastRefreshTime = Instant.now();
                }
            }
        }
    }

    // 委托其他DataSource方法到targetDataSource
    @Override
    public <T> T unwrap(Class<T> iface) throws SQLException {
        return targetDataSource.unwrap(iface);
    }

    @Override
    public boolean isWrapperFor(Class<?> iface) throws SQLException {
        return targetDataSource.isWrapperFor(iface);
    }
}

修改DataSource Bean的创建逻辑：

@Bean
public DataSource dataSource() {
    return new DynamicRefreshDataSource(this);
}

注意事项 #

• 确保微服务拥有访问Secrets Manager和Parameter Store的IAM权限。
• 密码轮换后旧密码可能有短暂有效期，刷新间隔建议设置为略短于轮换周期，避免连接失败。
• 验证TracingDataSource包装后仍能正确传递AWS X-Ray追踪信息。

内容的提问来源于stack exchange，提问作者Abraham Macias