Spring Boot中无法认证AWS OpenSearch集群问题排查

问题背景 #

我正在使用Java、Spring Boot及AWS SDK对接AWS上的OpenSearch集群，尝试通过手动指定accessKeyId和secretAccessKey进行请求签名，但系统始终无法识别到配置的凭证，报错信息如下：

software.amazon.awssdk.core.exception.SdkClientException:
Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(),EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider(profileName=default),ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider():Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILEor the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider(profileName=default): Expected an '=' sign defining a property on line 4, ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Failed toload credentials from IMDS.]

我的配置类代码如下：

@Configuration
public class PostsOpenSearchRestClientConfiguration {
    private String opensearchEndpoint = "https://search-posts-a1b2c3d4e5f6g7.us-east-1.es.amazonaws.com";
    private int opensearchPort = 9200;
    private String scheme = "https";
    private String region = "us-east-1";
    private String myServiceName = "es";
    private String opensearchClusterUsername = "myUser";
    private String opensearchClusterPassword = "myPass";

    
    private String accessKeyId = "abcdefxxxxx";
    private String secretAccessKey = "123xxxxxxxxxxx";

    @Bean
    public OpenSearchClient myOpensearchClient(){
        final BasicAWSCredentials myCredentialsProvider = new BasicAWSCredentials(accessKeyId, secretAccessKey);
        SdkHttpClient httpClient = ApacheHttpClient.builder().build();
        OpenSearchTransport transport = new AwsSdk2Transport(httpClient, opensearchEndpoint, Region.US_EAST_1, AwsSdk2TransportOptions.builder().build());
        return new OpenSearchClient(transport);
    }
}

错误原因 #

你创建了BasicAWSCredentials对象，但没有将其传递给AwsSdk2Transport的凭证配置项。此时AWS SDK仍会使用默认的凭证提供者链去查找凭证，完全忽略了你手动创建的凭证对象，这就是报错的核心原因。

修复方案 #

将BasicAWSCredentials包装为StaticCredentialsProvider，并在AwsSdk2TransportOptions中指定该凭证提供者，让SDK使用你手动配置的凭证。

修改后的完整配置类：

@Configuration
public class PostsOpenSearchRestClientConfiguration {
    private String opensearchEndpoint = "https://search-posts-a1b2c3d4e5f6g7.us-east-1.es.amazonaws.com";
    private String region = "us-east-1";

    private String accessKeyId = "abcdefxxxxx";
    private String secretAccessKey = "123xxxxxxxxxxx";

    @Bean
    public OpenSearchClient myOpensearchClient(){
        // 将硬编码的凭证包装为StaticCredentialsProvider
        AwsCredentialsProvider credentialsProvider = StaticCredentialsProvider.create(
                BasicAWSCredentials.create(accessKeyId, secretAccessKey)
        );

        SdkHttpClient httpClient = ApacheHttpClient.builder().build();
        
        // 在TransportOptions中指定凭证提供者
        AwsSdk2TransportOptions transportOptions = AwsSdk2TransportOptions.builder()
                .credentialsProvider(credentialsProvider)
                .build();

        OpenSearchTransport transport = new AwsSdk2Transport(
                httpClient,
                opensearchEndpoint,
                Region.of(region),
                transportOptions
        );

        return new OpenSearchClient(transport);
    }
}

额外提示 #

• 禁止硬编码凭证：生产环境中绝对不要硬编码accessKey和secret，建议通过Spring配置文件、环境变量或AWS Secrets Manager加载。
• 优先使用IAM角色：如果应用部署在EC2、EKS或其他AWS托管服务上，推荐使用IAM实例角色/服务账号角色，SDK会自动获取凭证，无需手动配置。
• 验证凭证权限：确保你的凭证拥有es:*相关的IAM权限，否则即使认证通过也会出现权限不足的错误。

内容的提问来源于stack exchange，提问作者abc