寻求适配Tomcat的AWS IAM认证Java数据库连接池

Great question—this is a common pain point when integrating AWS IAM Database Authentication with traditional connection pools that expect static credentials. Let’s break down the best solutions that fit your requirements (Tomcat context.xml support + automatic 15-minute credential rotation):

1. HikariCP + AWS JDBC Wrapper (Recommended) #

HikariCP is the most performant option, and when paired with the AWS JDBC Driver Wrapper, it handles IAM credential rotation automatically without custom code. The wrapper acts as a middleware between your connection pool and the MySQL driver, refreshing the temporary IAM password every 15 minutes behind the scenes.

Tomcat context.xml Configuration Example #

Add this resource definition to your Tomcat context.xml (adjust values to match your Aurora setup):

<Resource 
    name="jdbc/AuroraDB"
    auth="Container"
    type="com.zaxxer.hikari.HikariDataSource"
    driverClassName="software.amazon.jdbc.Driver"
    jdbcUrl="jdbc:aws:mysql://your-aurora-cluster-endpoint:3306/your-database?enableIamAuth=true"
    username="your-iam-principal-name"  <!-- e.g., the IAM user/role name allowed to connect -->
    maximumPoolSize="10"
    connectionTimeout="30000"
    dataSourceProperties="{
        'iamAuthCredentialsProviderClass': 'software.amazon.jdbc.auth.DefaultAwsCredentialsProviderChain'
    }"
/>

Key Details: #

• The software.amazon.jdbc.Driver wraps the standard MySQL driver and handles IAM auth logic.
• enableIamAuth=true tells the wrapper to use IAM credentials instead of static passwords.
• DefaultAwsCredentialsProviderChain pulls credentials from standard AWS sources (EC2 instance profile, environment variables, ~/.aws/credentials, etc.)—perfect for Tomcat running on AWS infrastructure.

2. Tomcat DBCP2 with Custom Credential Rotation (Alternative) #

If you prefer to stick with DBCP2, you can implement a custom ConnectionFactory to dynamically fetch IAM credentials when creating new connections. Here’s a high-level approach:

1. Create a custom class that implements org.apache.commons.dbcp2.ConnectionFactory:

   import software.amazon.awssdk.services.rds.RdsClient;
   import software.amazon.awssdk.services.rds.model.GenerateDbAuthTokenRequest;
   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
   public class IamAuthConnectionFactory implements org.apache.commons.dbcp2.ConnectionFactory {
       private final String dbEndpoint;
       private final int dbPort;
       private final String dbName;
       private final String iamUsername;
       private final RdsClient rdsClient;
   
       // Constructor to initialize dependencies
       public IamAuthConnectionFactory(String dbEndpoint, int dbPort, String dbName, String iamUsername) {
           this.dbEndpoint = dbEndpoint;
           this.dbPort = dbPort;
           this.dbName = dbName;
           this.iamUsername = iamUsername;
           this.rdsClient = RdsClient.create();
       }
   
       @Override
       public Connection createConnection() throws SQLException {
           // Generate temporary IAM password (valid for 15 minutes)
           String authToken = rdsClient.generateDbAuthToken(
               GenerateDbAuthTokenRequest.builder()
                   .hostname(dbEndpoint)
                   .port(dbPort)
                   .username(iamUsername)
                   .build()
           );
   
           // Use standard MySQL driver to create connection with the temporary token
           return DriverManager.getConnection(
               String.format("jdbc:mysql://%s:%d/%s", dbEndpoint, dbPort, dbName),
               iamUsername,
               authToken
           );
       }
   }
   

2. Configure DBCP2 in context.xml to use your custom factory:

   <Resource 
       name="jdbc/AuroraDB"
       auth="Container"
       type="org.apache.commons.dbcp2.BasicDataSource"
       factory="org.apache.commons.dbcp2.BasicDataSourceFactory"
       connectionFactoryClassName="com.yourpackage.IamAuthConnectionFactory"
       connectionFactoryProperties="{
           'dbEndpoint': 'your-aurora-endpoint',
           'dbPort': 3306,
           'dbName': 'your-database',
           'iamUsername': 'your-iam-principal-name'
       }"
       maxTotal="10"
       maxWaitMillis="30000"
   />
   

Critical Notes for Both Solutions: #

• Ensure the IAM principal (user/role) associated with your Tomcat server has the rds-db:connect permission for your Aurora cluster.
• For AWS JDBC Wrapper, include the required dependencies (software.amazon.jdbc:aws-jdbc-wrapper and AWS SDK v2 jars) in Tomcat’s lib directory or your application’s WEB-INF/lib.
• Test credential rotation by letting the app run for 15+ minutes and verifying connections still work without restarting Tomcat.

内容的提问来源于stack exchange，提问作者Tobias Tobiasen