From 053a67fbedfc76e7d1e102951356048d49bc21eb Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Thu, 20 Apr 2023 18:02:05 +0200 Subject: [PATCH] Move AWS IAM authentication into nested class. Having the AWS IAM authentication code inside the method body creating AwsIamAuthentication causes class loading of the AwsCredentialsProvider class although the return type is ClientAuthentication. With the code moved to an inner class, we mitigate that issue without actually knowing why the JVM attempts to load AwsIamAuthentication even the method isn't used. Closes gh-786 --- .../config/EnvironmentVaultConfiguration.java | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java index ea2b1757..68cd650b 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java @@ -39,7 +39,6 @@ import org.springframework.vault.authentication.AppRoleAuthenticationOptions.App import org.springframework.vault.authentication.AppRoleAuthenticationOptions.RoleId; import org.springframework.vault.authentication.AppRoleAuthenticationOptions.SecretId; import org.springframework.vault.authentication.AwsEc2AuthenticationOptions.AwsEc2AuthenticationOptionsBuilder; -import org.springframework.vault.authentication.AwsIamAuthenticationOptions.AwsIamAuthenticationOptionsBuilder; import org.springframework.vault.authentication.AzureMsiAuthenticationOptions.AzureMsiAuthenticationOptionsBuilder; import org.springframework.vault.authentication.CubbyholeAuthenticationOptions.CubbyholeAuthenticationOptionsBuilder; import org.springframework.vault.authentication.KubernetesAuthenticationOptions.KubernetesAuthenticationOptionsBuilder; @@ -389,11 +388,7 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration im Assert.isTrue(StringUtils.hasText(role), "Vault AWS-IAM authentication: Role (vault.aws-iam.role) must not be empty"); - AwsIamAuthenticationOptionsBuilder builder = AwsIamAuthenticationOptions.builder() - .role(role) - .credentialsProvider(DefaultCredentialsProvider.create()); - - return new AwsIamAuthentication(builder.build(), restOperations()); + return AwsIam.doCreateIamAuthentication(role, restOperations()); } protected ClientAuthentication azureMsiAuthentication() { @@ -491,4 +486,18 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration im } + static class AwsIam { + + static ClientAuthentication doCreateIamAuthentication(String role, RestOperations restOperations) { + + AwsIamAuthenticationOptions.AwsIamAuthenticationOptionsBuilder builder = AwsIamAuthenticationOptions + .builder() + .role(role) + .credentialsProvider(DefaultCredentialsProvider.create()); + + return new AwsIamAuthentication(builder.build(), restOperations); + } + + } + }