如何调用AWS Secrets Manager密钥在Java/.Net代码中读取Amazon DynamoDB数据

关于Secret Manager生成的示例代码的适用性 #

自带的示例代码仅适用于「从Secrets Manager拉取密钥明文」这个环节，不能直接完成读DynamoDB的全流程。你需要先通过示例代码拉取到密钥的JSON字符串，自行解析出访问密钥和秘密密钥后，再用这两个值初始化DynamoDB客户端，才能执行后续的表读取操作。

Java实现方案 #

前置依赖 #

需要先在项目中引入AWS SDK相关依赖（以Maven为例）：

<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>secretsmanager</artifactId>
    <version>2.x.x</version>
</dependency>
<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>dynamodb</artifactId>
    <version>2.x.x</version>
</dependency>
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.x.x</version>
</dependency>

实现步骤 #

• 首先确保代码运行环境具备secretsmanager:GetSecretValue权限，否则无法拉取密钥
• 拉取密钥并解析，初始化DynamoDB客户端：

// 初始化Secrets Manager客户端
SecretsManagerClient secretsClient = SecretsManagerClient.create();
GetSecretValueRequest valueRequest = GetSecretValueRequest.builder()
    .secretId("dynamodbtesting")
    .build();
GetSecretValueResponse valueResponse = secretsClient.getSecretValue(valueRequest);
String secretJson = valueResponse.secretString();

// 解析JSON获取密钥
ObjectMapper mapper = new ObjectMapper();
JsonNode node = mapper.readTree(secretJson);
String accessKey = node.get("aws_access_key_id").asText();
String secretKey = node.get("aws_secret_access_key").asText();

// 初始化DynamoDB客户端
AwsCredentials credentials = AwsBasicCredentials.create(accessKey, secretKey);
DynamoDbClient dynamoClient = DynamoDbClient.builder()
    .credentialsProvider(StaticCredentialsProvider.create(credentials))
    .region(Region.US_EAST_1) // 替换为你的实际区域
    .build();

// 后续执行读表操作，示例：扫描表
ScanRequest scanRequest = ScanRequest.builder()
    .tableName("你的表名")
    .build();
ScanResponse scanResponse = dynamoClient.scan(scanRequest);
// 处理返回结果即可

.Net实现方案 #

前置依赖 #

先安装对应NuGet包：

Install-Package AWSSDK.SecretsManager
Install-Package AWSSDK.DynamoDBv2
Install-Package Newtonsoft.Json

实现步骤 #

• 确保运行环境具备secretsmanager:GetSecretValue权限
• 拉取密钥、初始化DynamoDB客户端示例：

// 初始化Secrets Manager客户端
var secretsClient = new AmazonSecretsManagerClient(RegionEndpoint.USEast1); // 替换为实际区域
var secretRequest = new GetSecretValueRequest
{
    SecretId = "dynamodbtesting"
};
var secretResponse = await secretsClient.GetSecretValueAsync(secretRequest);
string secretJson = secretResponse.SecretString;

// 解析JSON获取密钥
dynamic secretObj = JsonConvert.DeserializeObject(secretJson);
string accessKey = secretObj.aws_access_key_id;
string secretKey = secretObj.aws_secret_access_key;

// 初始化DynamoDB客户端
var dynamoCredentials = new BasicAWSCredentials(accessKey, secretKey);
var dynamoClient = new AmazonDynamoDBClient(dynamoCredentials, RegionEndpoint.USEast1); // 替换为实际区域

// 后续读表示例：扫描表
var scanRequest = new ScanRequest
{
    TableName = "你的表名"
};
var scanResponse = await dynamoClient.ScanAsync(scanRequest);
// 处理返回结果即可

注意事项 #

• 拉取到的密钥不要打印到日志、不要持久化存储到本地，用完即可销毁，避免泄露
• 更推荐的实践是直接给代码运行的身份（如EC2实例角色、Lambda执行角色、ECS任务角色）配置DynamoDB访问权限，无需额外存储IAM用户密钥到Secrets Manager，安全性更高

内容的提问来源于stack exchange，提问作者kaka