SpringCloud/spring-cloud-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for the AWS Systems Manager Parameter Store

Browse Source 
Fixes gh-1598
Fixes gh-850
This commit is contained in:
Iulian Antohe
2021-07-27 17:01:38 -04:00
committed by spencergibb
parent 64a28c476d
commit 39cb1a2104
16 changed files with 1506 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
docs/src/main/asciidoc/spring-cloud-config.adoc
View File

@@ -337,7 +337,7 @@ To correct the above error the RSA key must be converted to PEM format. An examp
Spring Cloud Config Server also supports https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html[AWS CodeCommit] authentication.
AWS CodeCommit uses an authentication helper when using Git from the command line.
This helper is not used with the JGit library, so a JGit CredentialProvider for AWS CodeCommit is created if the Git URI matches the AWS CodeCommit pattern.
AWS CodeCommit URIs follow this pattern:
AWS CodeCommit URIs follow this pattern:
```bash
https//git-codecommit.${AWS_REGION}.amazonaws.com/v1/repos/${repo}.
@@ -834,6 +834,18 @@ secret value =
----
===== AWS Parameter Store
When using AWS Parameter Store as a backend, you can share configuration with all applications by placing properties within the `/application` hierarchy.
For example, if you add parameters with the following names, all applications using the config server will have the properties `foo.bar` and `fred.baz` available to them:
[source]
----
/config/application/foo.bar
/config/application-default/fred.baz
----
==== JDBC Backend
Spring Cloud Config Server supports JDBC (relational database) as a backend for configuration properties.
@@ -932,6 +944,99 @@ Configuration files are stored in your bucket as `{application}-{profile}.proper
NOTE: When no profile is specified `default` will be used.
==== AWS Parameter Store Backend
Spring Cloud Config Server supports AWS Parameter Store as a backend for configuration properties. You can enable this feature by adding a dependency to the link:https://github.com/aws/aws-sdk-java/tree/master/aws-java-sdk-ssm[AWS Java SDK for SSM].
[source,xml,indent=0]
.pom.xml
----
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-ssm</artifactId>
</dependency>
----
The following configuration uses the AWS SSM client to access parameters.
[source,yaml]
----
spring:
profiles:
active: awsparamstore
cloud:
config:
server:
awsparamstore:
region: eu-west-2
endpoint: https://ssm.eu-west-2.amazonaws.com
origin: aws:parameter:
prefix: /config/service
profileSeparator: _
recursive: true
decryptValues: true
maxResults: 5
----
The following table describes the AWS Parameter Store configuration properties.
.AWS Parameter Store Configuration Properties
|===
|Property Name |Required |Default Value |Remarks
|*region*
|no
|
|The region to be used by the AWS Parameter Store client. If it's not explicitly set, the SDK tries to determine the region to use by using the link:https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-region-selection.html#default-region-provider-chain[Default Region Provider Chain].
|*endpoint*
|no
|
|The URL of the entry point for the AWS SSM client. This can be used to specify an alternate endpoint for the API requests.
|*origin*
|no
|`aws:ssm:parameter:`
|The prefix that is added to the property source's name to show their provenance.
|*prefix*
|no
|`/config`
|Prefix indicating L1 level in the parameter hierarchy for every property loaded from the AWS Parameter Store.
|*profileSeparator*
|no
|`-`
|String that separates an appended profile from the context name.
|*recursive*
|no
|`true`
|Flag to indicate the retrieval of all AWS parameters within a hierarchy.
|*decryptValues*
|no
|`true`
|Flag to indicate the retrieval of all AWS parameters with their value decrypted.
|*maxResults*
|no
|`10`
|The maximum number of items to return for an AWS Parameter Store API call.
|===
AWS Parameter Store API credentials are determined using the link:https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html#credentials-default[Default Credential Provider Chain].
Versioned parameters are already supported with the default behaviour of returning the latest version.
[NOTE]
====
- When no application is specified `application` is the default, and when no profile is specified `default` is used.
- Valid values for `awsparamstore.prefix` must start with a forward slash followed by one or more valid path segments or be empty.
- Valid values for `awsparamstore.profileSeparator` can only contain dots, dashes and underscores.
- Valid values for `awsparamstore.maxResults` must be within the *[1, 10]* range.
====
==== AWS Secrets Manager Backend
Spring Cloud Config Server supports link:https://aws.amazon.com/secrets-manager/[AWS Secrets Manager] as a backend for configuration properties.