SpringBoot集成Micrometer在AWS Lambda上报CloudWatch指标凭证加载失败如何解决

问题原因 #

你遇到的报错是因为Micrometer默认初始化CloudWatch客户端时使用的凭证提供者链未包含EnvironmentVariableCredentialsProvider，所以无法读取Lambda环境注入的AWS_ACCESS_KEY_ID、AWS_SECRET_ACCESS_KEY环境变量凭证。你完全可以自定义凭证提供者链，具体配置方法如下：

你可以在构建CloudWatchMeterRegistry实例时，手动指定自定义的AmazonCloudWatchAsync客户端，在客户端配置中加入需要的凭证提供者即可：

import com.amazonaws.auth.EnvironmentVariableCredentialsProvider;
import com.amazonaws.auth.AWSCredentialsProviderChain;
import com.amazonaws.auth.InstanceProfileCredentialsProvider;
import com.amazonaws.auth.profile.ProfileCredentialsProvider;
import com.amazonaws.services.cloudwatch.AmazonCloudWatchAsync;
import com.amazonaws.services.cloudwatch.AmazonCloudWatchAsyncClientBuilder;
import io.micrometer.cloudwatch.CloudWatchConfig;
import io.micrometer.cloudwatch.CloudWatchMeterRegistry;
import io.micrometer.core.instrument.Clock;

import java.time.Duration;

// 自定义凭证链，可按需调整优先级和包含的提供者
AWSCredentialsProviderChain customCredentialsChain = new AWSCredentialsProviderChain(
    // 优先从环境变量取凭证，适配Lambda环境
    new EnvironmentVariableCredentialsProvider(),
    // EC2/ECS容器凭证提供者，适配容器部署场景
    InstanceProfileCredentialsProvider.getInstance(),
    // 本地配置文件凭证，可选用于本地调试
    new ProfileCredentialsProvider()
);

// 构造自定义CloudWatch异步客户端
AmazonCloudWatchAsync cloudWatchClient = AmazonCloudWatchAsyncClientBuilder.standard()
    .withCredentials(customCredentialsChain)
    // 区域可从Lambda环境变量AWS_REGION读取，也可手动指定
    .withRegion(System.getenv().getOrDefault("AWS_REGION", "cn-north-1"))
    .build();

// 构造CloudWatch指标配置
CloudWatchConfig cloudWatchConfig = new CloudWatchConfig() {
    @Override
    public String get(String key) {
        return null;
    }
    @Override
    public Duration step() {
        // 指标上报周期，按需调整
        return Duration.ofMinutes(1);
    }
    @Override
    public String namespace() {
        // 自定义指标命名空间
        return "your-business-metric-namespace";
    }
};

// 生成自定义的MeterRegistry实例，直接使用即可
CloudWatchMeterRegistry registry = new CloudWatchMeterRegistry(cloudWatchConfig, Clock.SYSTEM, cloudWatchClient);

如果使用Spring Boot的Micrometer自动装配能力，只需要自定义一个AmazonCloudWatchAsync类型的Bean，Spring Boot会自动使用该Bean替换默认生成的CloudWatch客户端：

import com.amazonaws.auth.EnvironmentVariableCredentialsProvider;
import com.amazonaws.auth.AWSCredentialsProviderChain;
import com.amazonaws.auth.InstanceProfileCredentialsProvider;
import com.amazonaws.auth.profile.ProfileCredentialsProvider;
import com.amazonaws.services.cloudwatch.AmazonCloudWatchAsync;
import com.amazonaws.services.cloudwatch.AmazonCloudWatchAsyncClientBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class CloudWatchMetricsConfig {

    @Bean
    public AmazonCloudWatchAsync amazonCloudWatchAsync() {
        AWSCredentialsProviderChain customCredentialsChain = new AWSCredentialsProviderChain(
            new EnvironmentVariableCredentialsProvider(),
            InstanceProfileCredentialsProvider.getInstance(),
            new ProfileCredentialsProvider()
        );
        return AmazonCloudWatchAsyncClientBuilder.standard()
            .withCredentials(customCredentialsChain)
            .withRegion(System.getenv().getOrDefault("AWS_REGION", "cn-north-1"))
            .build();
    }
}

如果是专门部署在AWS Lambda环境，也可以将com.amazonaws.auth.LambdaContainerCredentialsProvider加入凭证链，可直接读取Lambda执行角色的凭证，无需手动配置密钥。

内容的提问来源于stack exchange，提问作者Ele