Merge pull request #34 from folio-org/EDGAPIUTL-30-aws2

EDGAPIUTL-30: Sunflower 2025 R1 - Migrate AWS SDK from 1.x to 2.x

Author: julianladisch

README.md

@@ -21,12 +21,14 @@ Only intended for _development purposes_.  Credentials are defined in plain text
 
 #### AwsParamStore ####
 
-Retrieves credentials from Amazon Web Services Systems Manager (AWS SSM), more specifically the Parameter Store, where they're stored encrypted using a KMS key.  `src.main/resources/aws_ss.properties`
+Retrieves credentials from Amazon Web Services Systems Manager (AWS SSM), more specifically the Parameter Store, where they're stored encrypted using a KMS key.
 
 **Key:** `<salt>_<tenantId>_<username>`
 
 e.g. Key=`ab73kbw90e_diku_diku`
 
+You can set the HTTP endpoint to use for retrieving AWS credentials: Use the system property `ecsCredentialsEndpoint` (for example `http://example.com`). The path is taken from the `ecsCredentialsPath` system property, or from the `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` environment variable (standard on ECS containers). You also need to set the system properties `region` to the AWS region and `useIAM` to `false`.
+
 #### VaultStore ####
 
 Retrieves credentials from a Vault (https://vaultproject.io).  This was added as a more generic alternative for those not using AWS.  `src/main/resources/vault.properties`

pom.xml

@@ -20,7 +20,7 @@
     <java.version>21</java.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <vault.version>6.2.0</vault.version>
-    <aws-java-sdk.version>1.12.671</aws-java-sdk.version>
+    <aws-java-sdk.version>2.30.31</aws-java-sdk.version>
     <versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
     <maven-enforcer-plugin.version>3.5.0</maven-enforcer-plugin.version>
     <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
@@ -87,8 +87,8 @@
     </dependency>
     <!-- Only needed for AwsParamStore -->
     <dependency>
-      <groupId>com.amazonaws</groupId>
-      <artifactId>aws-java-sdk-ssm</artifactId>
+      <groupId>software.amazon.awssdk</groupId>
+      <artifactId>ssm</artifactId>
       <version>${aws-java-sdk.version}</version>
     </dependency>
     <dependency>

src/main/java/org/folio/edge/api/utils/security/AwsParamStore.java

@@ -1,24 +1,18 @@
 package org.folio.edge.api.utils.security;
 
-import static org.folio.common.utils.tls.FipsChecker.ENABLED;
-import static org.folio.common.utils.tls.FipsChecker.getApprovedSecureRandomSafe;
-import static org.folio.common.utils.tls.FipsChecker.isInBouncycastleApprovedOnlyMode;
-
-import com.amazonaws.ClientConfigurationFactory;
-import com.amazonaws.SdkClientException;
-import com.amazonaws.auth.AWSCredentialsProvider;
-import com.amazonaws.auth.ContainerCredentialsProvider;
-import com.amazonaws.auth.EnvironmentVariableCredentialsProvider;
-import com.amazonaws.auth.SystemPropertiesCredentialsProvider;
-import com.amazonaws.internal.CredentialsEndpointProvider;
-import com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagement;
-import com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClientBuilder;
-import com.amazonaws.services.simplesystemsmanagement.model.GetParameterRequest;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.util.Properties;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.ContainerCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.EnvironmentVariableCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.SystemPropertyCredentialsProvider;
+import software.amazon.awssdk.core.SdkSystemSetting;
+import software.amazon.awssdk.regions.Region;
+import software.amazon.awssdk.services.ssm.SsmClient;
+import software.amazon.awssdk.services.ssm.SsmClientBuilder;
+import software.amazon.awssdk.services.ssm.model.GetParameterRequest;
+import software.amazon.awssdk.services.ssm.model.ParameterNotFoundException;
+import java.util.Properties;
 
 public class AwsParamStore extends SecureStore {
 
@@ -30,15 +24,17 @@ public class AwsParamStore extends SecureStore {
   public static final String PROP_USE_IAM = "useIAM";
   public static final String PROP_ECS_CREDENTIALS_PATH = "ecsCredentialsPath";
   public static final String PROP_ECS_CREDENTIALS_ENDPOINT = "ecsCredentialsEndpoint";
+  public static final String PROP_AWS_CONTAINER_CREDENTIALS_RELATIVE_URI =
+      SdkSystemSetting.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.property();
+  public static final String ENV_AWS_CONTAINER_CREDENTIALS_RELATIVE_URI =
+      SdkSystemSetting.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.toString();
 
   public static final String DEFAULT_USE_IAM = "true";
 
   private String region;
   private boolean useIAM;
-  private String ecsCredEndpoint;
-  private String ecsCredPath;
 
-  protected AWSSimpleSystemsManagement ssm;
+  protected SsmClient ssm;
 
   public AwsParamStore(Properties properties) {
     super(properties);
@@ -47,100 +43,89 @@ public AwsParamStore(Properties properties) {
     if (properties != null) {
       region = properties.getProperty(PROP_REGION);
       useIAM = Boolean.parseBoolean(properties.getProperty(PROP_USE_IAM, DEFAULT_USE_IAM));
-      ecsCredEndpoint = properties.getProperty(PROP_ECS_CREDENTIALS_ENDPOINT);
-      ecsCredPath = properties.getProperty(PROP_ECS_CREDENTIALS_PATH);
     }
 
-    AWSSimpleSystemsManagementClientBuilder builder = AWSSimpleSystemsManagementClientBuilder.standard();
-
-    if (ENABLED.equals(isInBouncycastleApprovedOnlyMode())) {
-      var clientConfigurationFactory = new ClientConfigurationFactory();
-      var clientConfiguration = clientConfigurationFactory.getConfig();
-      var secureRandom = getApprovedSecureRandomSafe();
-      clientConfiguration.setSecureRandom(secureRandom);
-      builder.setClientConfiguration(clientConfiguration);
-
-      logger.info("SecureRandom used for AwsParamStore: {}", secureRandom);
-    }
+    SsmClientBuilder builder = SsmClient.builder();
 
     if (region != null) {
-      builder.withRegion(region);
+      builder.region(Region.of(region));
     }
 
     if (useIAM) {
       logger.info("Using IAM");
     } else {
-      AWSCredentialsProvider credProvider;
-      try {
-        credProvider = new EnvironmentVariableCredentialsProvider();
-        credProvider.getCredentials();
-      } catch (Exception e) {
-        try {
-          credProvider = new SystemPropertiesCredentialsProvider();
-          credProvider.getCredentials();
-        } catch (Exception e2) {
-          credProvider = new ContainerCredentialsProvider(
-              new ECSCredentialsEndpointProvider(ecsCredEndpoint, ecsCredPath));
-          credProvider.getCredentials();
-        }
-      }
-      logger.info("Using {}", credProvider.getClass().getName());
-      builder.withCredentials(credProvider);
+      var credProvider = getAwsCredentialsProvider();
+      builder.credentialsProvider(credProvider);
     }
 
     ssm = builder.build();
   }
 
-  @Override
-  public String get(String clientId, String tenant, String username) throws NotFoundException {
-    String key = String.format("%s_%s_%s", clientId, tenant, username);
-    GetParameterRequest req = new GetParameterRequest()
-      .withName(key)
-      .withWithDecryption(true);
-
+  private AwsCredentialsProvider getAwsCredentialsProvider() {
     try {
-      return ssm.getParameter(req).getParameter().getValue();
+      logger.debug("Trying EnvironmentVariableCredentialsProvider");
+      var credProvider = EnvironmentVariableCredentialsProvider.create();
+      credProvider.resolveCredentials();
+      logger.info("Using EnvironmentVariableCredentialsProvider");
+      return credProvider;
     } catch (Exception e) {
-      throw new NotFoundException(e);
+      // ignore, try next
     }
+    try {
+      logger.debug("Trying SystemPropertyCredentialsProvider");
+      var credProvider = SystemPropertyCredentialsProvider.create();
+      credProvider.resolveCredentials();
+      logger.info("Using SystemPropertyCredentialsProvider");
+      return credProvider;
+    } catch (Exception e) {
+      // ignore, try next
+    }
+    logger.debug("Trying ContainerCredentialsProvider");
+    var credProvider = ContainerCredentialsProvider.builder().endpoint(endpoint()).build();
+    credProvider.resolveCredentials();
+    logger.info("Using ContainerCredentialsProvider");
+    return credProvider;
   }
 
-  protected static class ECSCredentialsEndpointProvider extends CredentialsEndpointProvider {
-    public static final String ECS_CREDENTIALS_PATH_VAR = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
+  private String endpoint() {
+    if (properties == null) {
+      return null;
+    }
 
-    public final String ecsCredEndpoint;
-    public final String ecsCredPath;
+    var endpoint = properties.getProperty(PROP_ECS_CREDENTIALS_ENDPOINT);
+    if (endpoint == null) {
+      return null;
+    }
 
-    public ECSCredentialsEndpointProvider(String ecsCredEndpoint, String ecsCredPath) {
-      this.ecsCredEndpoint = ecsCredEndpoint;
-      this.ecsCredPath = ecsCredPath;
+    var path = properties.getProperty(PROP_ECS_CREDENTIALS_PATH);
+    if (path != null) {
+      System.setProperty(PROP_AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, path);
     }
 
-    @Override
-    public URI getCredentialsEndpoint() {
-      String path = ecsCredPath;
-      if (path == null) {
-        path = System.getenv(ECS_CREDENTIALS_PATH_VAR);
-      }
-      if (path == null) {
-        throw new SdkClientException(
-            "No credentials path was provided and the environment variable " + ECS_CREDENTIALS_PATH_VAR + " is empty");
-      }
-
-      try {
-        return new URI(ecsCredEndpoint + path);
-      } catch (URISyntaxException e) {
-        throw new SdkClientException(e);
-      }
+    return endpoint;
+  }
+
+  @Override
+  public String get(String clientId, String tenant, String username) throws NotFoundException {
+    String key = String.format("%s_%s_%s", clientId, tenant, username);
+    GetParameterRequest req = GetParameterRequest.builder()
+      .name(key)
+      .withDecryption(true)
+      .build();
+
+    try {
+      return ssm.getParameter(req).parameter().value();
+    } catch (ParameterNotFoundException e) {
+      throw new NotFoundException(e);
     }
   }
 
   public String getRegion() {
     return region;
   }
 
-  public Boolean getUseIAM() {
+  public boolean getUseIAM() {
     return useIAM;
   }
 
-}
+}