Parameter Store and Secret Manager Integration with Spring Boot

We need to securely store and share sensitive credentials, passwords, and configuration information separately from our source code in Parameter Store in Secrets Manager and access these from Spring Boot. This article demonstrates how to integrate these AWS services into Spring Boot’s configuration ecosystem, extending Spring’s powerful capabilities into the cloud while maintaining the framework’s inherent simplicity.

To implement this integration, you’ll need two additional projects:

Spring Cloud
Spring Cloud AWS (formerly part of Spring Cloud but now maintained as a separate project)

Getting Started

For this tutorial, I’m using Gradle in the sample project, though Maven works equally well. The integration depends on your Spring Boot version – I’m using 3.4.3. Here are the relevant portions of the build.gradle file:

ext {
    set('springCloudVersion', "2024.0.0")
    set('springCloudAwsVersion', "3.3.0")
}

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-actuator'
    implementation 'org.springframework.cloud:spring-cloud-starter'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
    implementation(platform("software.amazon.awssdk:bom:2.29.6"))
    implementation platform("io.awspring.cloud:spring-cloud-aws-dependencies:${springCloudAwsVersion}")
    implementation 'io.awspring.cloud:spring-cloud-aws-starter-parameter-store'
    implementation 'io.awspring.cloud:spring-cloud-aws-starter-secrets-manager'
    implementation 'org.projectlombok:lombok'
    testImplementation 'org.projectlombok:lombok'
    annotationProcessor 'org.projectlombok:lombok'
    testAnnotationProcessor 'org.projectlombok:lombok'
}

dependencyManagement {
    imports {
       mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
    }
}

Please consult this page for compatibility matrix for spring boot, spring cloud, spring cloud aws, and the aws sdk: https://github.com/awspring/spring-cloud-aws?tab=readme-ov-file#compatibility-with-spring-project-versions

I am using 3.3.0 for Spring Cloud AWS, 2024.0.0 for Spring Cloud, and Spring Boot 3.4.3 for this article. This combination uses the 2.X version of the AWS SDK.

AWS Security

Once this application is deployed into ECS, EKS, or other AWS service, you will have to ensure the appropriate IAM roles are configured. For local development, make sure you have a valid AWS session token. Please consult https://docs.awspring.io/spring-cloud-aws/docs/3.2.0/reference/html/index.html#defaultcredentialsprovider for the various options.

Spring Configuration Setup

Edit your application.properties, application.yml or whatever spring confg file you are using. Here is the configuration I am using. You can adapt it suit your own needs:

ssmparams.basepath=/blog/
secretsmanager.basepath=blog/
spring.config.import=optional:aws-secretsmanager:${secretsmanager.basepath},optional:aws-parameterstore:${ssmparams.basepath}

You will place your secrets under the secretsmanager.basepath and the parameter store entries under the ssmparms.basepath. If you need multiple paths, you can add as many as you need in the spring.config.import entry. The scope of how Spring Boot manages the configuration is a vast topic. Please consult https://docs.spring.io/spring-boot/reference/features/external-config.html for reference.

Putting It Together

Once you have the configuration setup, the parameter store and / or secrets manager values set, and your security token, you can retrieve the values through environment.getProperty(“key”) or @Value to populate a property. Here is a very simple controller and service to retrieve and populate an endpoint with the values and keys:

Controller:

@RestController
@RequestMapping("/api/configs")
class ConfigController {
  private final ConfigService configService;

  public ConfigController(ConfigService configService) {
    this.configService = configService;
  }

@GetMapping
  public Map<String, String> getConfig() {
    return configService.getConfigs();
  }
}

Service:

@Service
@RequiredArgsConstructor
public class ConfigService {
  private final Environment environment;

  public Map<String, String> getConfigs(){
    Map<String, String> configs = new HashMap<>();
    var key1 = "key1";
    var key2 = "parameterstorekey";
    var key3 = "application.property.value";
    configs.put(key1, environment.getProperty(key1));
    configs.put(key2, environment.getProperty(key2));
    configs.put(key3, environment.getProperty(key3));

    return configs;
  }
}

Next Steps

Spring Cloud AWS provides many integrations into various AWS Services like S3, Dynamo, SQS, and SNS. You can build off this template to use any other services you need to extend your application’s capabilities.