Retrieve multiple secrets in that have same keys

[jobas2007]

label:"component: secrets-manager"

** also did put on stack overflow - https://stackoverflow.com/questions/72264774/retrieve-multiple-aws-secrete-in-spring-boot-app-that-have-same-keys
Have a spring boot app (with starter parent at 2.4.8).

The app is connecting to multiple data sources, and the automated Jenkins job being used to create secrets across company does it such a way that although secrets names are different(per app/source) but they all have same value underneath - 'username' and 'password' text.

For example:

First secret would be '/secret/rds/dev/foo/foo_app_user' with value:

username : user1
password: pass1

second secret would be '/secret/snowflake/dev/hoo/hoo_app_user' with value:

username : user2
password: pass2

Trying to figure out how can they both be imported using spring config import, while still being able to be used distinctively in properties/yaml file (NOTE: already have tried with optional also)

`

spring:
    config:
         import: aws-secretsmanager:/secret/rds/dev/foo/foo_app_user,aws-secretsmanager:/secret/snowflake/dev/hoo/hoo_app_user

...

system:
   cache:
       username: ${username}
       password: ${password}

....

snowflake:
  datasource: 
     username: ${username}
     password: ${password}

[maciejwalkowiak]

This isn't currently possible and I am not sure if ever will be. Do other spring.config.import implementations support it?

[mdreem]

In my project we are facing the same issue and I think it is essential that this is possible somehow. Maybe I am understanding the Secretsmanager wrong, but it seems quite suggestive to have different secrets for e.g. different databases and then I still would like to just call the entries still "username" and "password". Currently they would be overridden and the secret name itself also lends itself to appear in the property.
Similar to the ParameterStore where this actually happens. It surely feels a bit different as there is the recursive search call.

As I need it anyway and in the worst case will probably implement an internal library to handle it, I tried to prototype something along the lines of the ParameterStore: mdreem@e987eb1

For this I added a parameter named "spring.cloud.aws.secretsmanager.prefix" that triggers the namespacing and also some stripping along the lines of the ParameterStore behavior.

It is not optimal yet, but maybe helpful to start a discussion, to see if there is a viable solution to this.

[abdelghanymarzouk]

Hi @jobas2007,

I'm facing the same problem, did you find a solution?

[maciejwalkowiak]

To summarize - the issue is that when multiple secrets containing JSON properties are imported, and same keys exist in both secret JSONs then value from one secret overwrites the other.

For example

• /secret/first-secret:

{ "username": "postgres" }

• /secret/second-secret:

{ "username": "root" }

I am thinking how this can be solved. We could add a prefix option:

spring:
    config:
         import: aws-secretsmanager:/secrets/first-secret?prefix=first,aws-secretsmanager:/secret/second-secret?prefix=second

Then they would be imported as:

first.username=postgres
second.username=root

What do you think about it? Perhaps there is more idiomatic way to do it with Spring Boot? @spencergibb @wilkinsona your suggestion would be appreciated.

[abdelghanymarzouk]

I think this is a very good idea.

[wilkinsona]

There's nothing built in to do this but there are some building blocks that you could use. The requirement seems somewhat similar to the support for configuring a system environment variable prefix that we added in Boot 2.5. You may be able to use org.springframework.boot.context.properties.source.ConfigurationPropertySource.withPrefix(String) that was introduced as part of those changes in your aws-secretsmanager implementation.

[maciejwalkowiak]

Thanks @wilkinsona!

[maciejwalkowiak]

We have PR ready #622

[maciejwalkowiak]

When @MatejNedic is back ;-) Jokes aside, we plan for making releases next week.

[abdelghanymarzouk]

Good to know :D thanks

[snigdhasjg]

Thanks folks, it got merged 😇

[abdelghanymarzouk]

thanks all, has it been released? or not yet?

[maciejwalkowiak]

Not yet. I recommend watching repository for releases it should happen in upcoming days.