Testcontainers Amazon SecretsManager

[RealQbs]

Context:

My application is dependent on Amazon SecretsManager. On startup, LambdaSecurityProvider needs to fetch publicKey secret to setup JWTAuthContext.

@ApplicationScoped
@AllArgsConstructor
public class LambdaSecurityProvider {
    ...
    final SecretsManagerClient secretsManagerClient;
    final JWTAuthContextInfo jwtAuthContextInfo;
    ...

    void onStart(@Observes StartupEvent ignoredEv) {
        jwtAuthContextInfo.setPublicVerificationKey(getPublicKey());
    }

    private PublicKey getPublicKey() {
        ...
            String key = secretsManagerClient.getSecretValue(generateGetSecretValueRequest(secretId)).secretString();
            return generatePublicKey(key);
        ...
    }

So for local development i can run docker-compose that will provide the localstack instance with SecretsManager and predefined secrets. But when it comes to the tests I'd like to use Testcontainers - and here I have problems.

Here's my test:

@QuarkusTest
class ExampleControllerTest {

    private final JwtGenerator jwtGenerator = new JwtGenerator();

    @Test
    void callEndpointWithAuthSuccess() {
        String expectedResponse = "{\"message\":\"test\"}";

        given().contentType("application/json")
                .accept("application/json")
                .header("Authorization", jwtGenerator.generateToken(Collections.emptyList()))
                .when()
                .get("/example/test")
                .then()
                .statusCode(200)
                .body(equalTo(expectedResponse));
    }

Approach 1 - use "automaticly created" Testcontainers:

I set up dependencies and properties that runs localstack "automatically".
But in this case I don't know how to create secret on this docker container and the test ends with error
com.template.lambda.integration.exceptions.SecretsManagerException: Can not get secret: Secrets Manager can't find the specified secret.

Ofc i can do "secret checkup and creation" before every test, but that is not time and code efficient.

Approach 2 - use my own Testcontainer:

I turned off devservices and created a class that implements QuarkusTestResourceLifecycleManager and used it in the test with @QuarkusTestResource(value = SecurityManagerTestResource.class)

public class LocalStackTestResource implements QuarkusTestResourceLifecycleManager {

    LocalStackContainer localStackContainer;

    @Override
    public Map<String, String> start() {
        localStackContainer = new LocalStackContainer(DockerImageName.parse("localstack/localstack:3.0.1"))
                .withServices(LocalStackContainer.Service.SECRETSMANAGER)
                .withEnv("AWS_REGION", "us-east-1");
        localStackContainer.start();

        addSecrets();

        Map<String, String> conf = new HashMap<>();
        conf.put("quarkus.secretsmanager.endpoint-override", localStackContainer.getEndpoint().toString());
        return conf;

    }

    private void addSecrets() {
        SecretsManagerClient secretsManagerClient = SecretsManagerClient.builder()
                .endpointOverride(localStackContainer.getEndpoint())
                .region(Region.of(localStackContainer.getRegion()))
                .httpClient(ApacheHttpClient.builder().build())
                .credentialsProvider(StaticCredentialsProvider.create(
                        AwsBasicCredentials.create("test-key","test-secret")
                ))
                .build();
        secretsManagerClient.createSecret(builder -> builder.name("AUTH_PUBLICKEY").secretString("{\"publicKey\":\"MIIBIj...\"}"));
    }

    @Override
    public void stop() {
        localStackContainer.stop();
    }
}

But in this case SecretsManagerClient from LambdaSecurityProvider is not able to automatically get localstack address and it fails with 404 ( conf.put("quarkus.secretsmanager.endpoint-override:", localStackContainer.getEndpoint().toString()); is not effective).

Conclusions:

I have no idea how to proceed with this. Mby you could advice something?

[RealQbs]

Ok. Basically using approach 2 and adding System.setProperty("quarkus.secretsmanager.endpoint-override", localStackContainer.getEndpoint().toString()); fix the issue.

But there must be a better way to do secrets creation using just configuration and devservices. I saw a PR that addressed this issue but it was closed without merging. #saddog.jpg
I'll cc it's author, mby he will know more about this topic @scrocquesel