=== Integrating your Spring Cloud application with the AWS Secrets Manager

Spring Cloud provides support for centralized configuration, which can be read and made available as a regular Spring
`PropertySource` when the application is started. The Secrets Manager Configuration module allows you to use this mechanism
with https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html[AWS Secrets Manager].

Simply add a dependency on the `spring-cloud-starter-aws-secrets-manager-config` starter module to activate the support.
The support is similar to the support provided for the Spring Cloud Config Server or Consul's key-value store:
secrets can be defined to be shared across all services or for a specific service and can be
profile-specific.

All secrets are retrieved from a common path prefix, which defaults to `/secret`. From there shared secrets are
retrieved from a path that defaults to `application` and service-specific secrets use a path that defaults to the
configured `spring.application.name`. You can use both dots and forward slashes to specify the names of secret keys.
Names of activated profiles will be appended to the path using a separator that defaults to an underscore.

That means that for a service called `my-service` the module by default would find and use the following secrets:
[cols="2*", options="header"]
|===
|Parameter key
|Description

|`/secret/application`
|Shared by all services that have the Configuration support enabled. Can be overridden with a service- or profile-specific property.

|`/secret/application_production`
|Shared by all services that have the Configuration support enabled and have a `production` Spring profile activated.
Can be overridden with a service-specific property.

|`/secret/my-service`
|Specific to the `my-service` service..

|`/secret/my-service_production`
|Specific to the `my-service` service when a `production` Spring profile is activated.
|===

You can configure the following settings in a Spring Cloud `bootstrap.properties` or `bootstrap.yml` file
(note that relaxed property binding is applied, so you don't have to use this exact syntax):
[cols="3*", options="header"]
|===
|Property
|Default
|Explanation

|`aws.secretsmanager.prefix`
|`/secret`
|Prefix indicating first level for every property loaded from the Secrets Manager.
Value must start with a forward slash followed by one or more valid path segments or be empty.

|`aws.secretsmanager.defaultContext`
|`application`
|Name of the context that defines properties shared across all services

|`aws.secretsmanager.profileSeparator`
|`_`
|String that separates an appended profile from the context name. Can only contain
dots, dashes, forward slashes, backward slashes and underscores next to alphanumeric characters.

|`aws.secretsmanager.failFast`
|`true`
|Indicates if an error while retrieving the secrets should fail starting the application.

|`aws.secretsmanager.name`
|the configured value for `spring.application.name`
|Name to use when constructing the path for the properties to look up for this specific service.

|`aws.secretsmanager.enabled`
|`true`
|Can be used to disable the Secrets Manager Configuration support even though the auto-configuration is on the classpath.

|`aws.secretsmanager.region`
|`eu-central-1`
|Can be used to set region for AWSSecretsManagerClient.
|===

In `spring-cloud` `2020.0.0` (aka Ilford), the bootstrap phase is no longer enabled by default. In order
enable it you need an additional dependency:

[source,xml,indent=0]
----
<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-bootstrap</artifactId>
  <version>{spring-cloud-version}</version>
</dependency>
----

==== Spring Boot Configuration Import Support
From Spring Cloud AWS 2.3.0 onwards, the Secrets Manager Configuration module additionally supports using
https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-files-importing[Spring Boot's (2.4.0+) application config import feature]
to load secrets from AWS Secrets Manager into a Spring application's Environment.

*Note* - This is the recommended approach for importing secrets from Spring Cloud AWS 2.3.0 onwards. Using the module's
Spring Cloud bootstrap PropertySource is now considered a legacy approach, and support for it will be withdrawn in
Spring Cloud AWS 3.0.

Importing secrets using this mechanism is enabled by using Boot's `spring.config.import` application
config property with a prefix of `aws-secretsmanager:`, and optionally specifying a list of the names of secrets to
import. The table below provides examples of supported property values and describes their behaviour.

[cols="2*", options="header"]
|===
|Property
|Description

|`spring.config.import=aws-secretsmanager:`
|Importing secrets based on spring.application.name property value for each active profile

|`spring.config.import=aws-secretsmanager:secret-key;other-secret-key`
|Importing secrets by individual keys

|`spring.config.import=optional:aws-secretsmanager:secret-key;other-secret-key`
|When `optional` is used the application will start even if the specified secret is not found.

|`spring.config.import=optional:aws-secretsmanager:other-config-key,aws-secretsmanager:required-config-key`
|Optional and required values can be separated by comma. List can be used as well.
|===

Spring Boot 2.4 changed the ways files are loaded which means profile loading has changed for spring-cloud-aws as well.
Link to Spring Boot reference docs about file specific loading: https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-features-external-config-files-profile-specific[Reference Docs]
Read more on the official https://spring.io/blog/2020/08/14/config-file-processing-in-spring-boot-2-4[Spring Blog]

==== IAM Permissions
Following IAM permissions are required by Spring Cloud AWS:

[cols="2"]
|===
|  Get secret value:
| `secretsmanager:GetSecretValue`


|===

Sample IAM policy granting access to Secret manager:

[source,json,indent=0]
----
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "yourArn"
        }
    ]
}
----
