Custom CredentialsProvider using AWS Secrets Manager Client

[madocx]

So I need to retrieve db credentials from aws secrets manager for my react pg client. I can't inject them as environment variables because they're then visible to anyone in aws console.

This is simple enough for use cases where you just need to get access to a secret using the quarkus-amazon-secretsmanager extension. However, when trying to marry the use of this extension with the quarkus-reactive-pg-client extension I've hit a bit of a blocker.

Because the reactive-pg-client requires credentials be provided by config or a CredentialsProvider implementation, I've attempted to implement a custom CredentialsProvider using the SecretsManagerClient to retrieve them. Upon attempting to run the app, I get the below error. I understand this to mean that the CredentialsProvider is not only created during the STATIC_INIT phase, but its also executed during STATIC_INIT. Meanwhile the SecretsManagerClient is not created until RUNTIME_INIT.

Caused by: jakarta.enterprise.inject.CreationException: Synthetic bean instance for software.amazon.awssdk.services.secretsmanager.SecretsManagerClientBuilder not initialized yet: software_amazon_awssdk_services_secretsmanager_SecretsManagerClientBuilder_35edabeaf18440581dc996704efe9686730c9848 - a synthetic bean initialized during RUNTIME_INIT must not be accessed during STATIC_INIT - RUNTIME_INIT build steps that require access to synthetic beans initialized during RUNTIME_INIT should consume the SyntheticBeansRuntimeInitBuildItem at software.amazon.awssdk.services.secretsmanager.SecretsManagerClientBuilder_a118fcde320f8a3533a7b2646b0c2b196272f86f_Synthetic_Bean.createSynthetic(Unknown Source) ... 62 more

Does anyone have any suggestions how to resolve this? Seems like a chicken and egg scenario, but with no obvious solution.

[sberyozkin]

Can you try implementing a custom ConfigSource ?

[madocx]

Thanks for the suggestion! I can give this a shot tomorrow, but I'm afraid I'm going to run into the same chicken and egg scenario. I can annotate the custom ConfigSource as StaticInitSafe, but it won't actually be if it has any dependencies on the AWS Secrets Manager client. And of course the default credentials provider for the pg client will look to load the credentials from the config during the static init phase.

The more I've thought about this, I realized I'll either need to not use the Quarkus Secrets Manager extension (which will likely result in issues during native execution from my reading), or find a solution external to Quarkus. Perhaps I'll try using the AWS lambda layer extension they provide for SSM/secrets.

I guess the only other possibility would be if the Quarkus Secrets extension could be made static init safe, but I suspect if it could be it would be.

[sberyozkin]

Avoiding SecretsManagerClient may indeed help, especially if it can be easily replaced with Vertx Web Client and some GET request