Contact Us 1-800-596-4880
  1. Homepage
  2. Amazon Secrets Manager Properties Provider (1.2)

  3. Amazon Secrets Manager Properties Provider Reference

All Connectors

Amazon Secrets Manager Properties Provider 1.2 Reference

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your secrets from Amazon Secrets Manager cloud service before your Mule app runs.

Configuration

Default Configuration for Amazon Secrets Manager Properties Provider.

Name Type Description Default Value Required

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Expiration Policy

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the instance expires at the exact moment that it becomes eligible. Mule purges the instances as appropriate.

x

AWS Secrets Manager Region

String

AWS Secrets Manager region, for example, us-east-2.

x

AWS Access Key

String

AWS access key ID.

AWS Secret Key a

String

AWS secret key ID.

Custom Endpoint URL

String

Custom endpoint URL that overrides the default regional AWS Secrets Manager endpoint. Use this field to route Secrets Manager calls through an AWS VPC interface endpoint (AWS PrivateLink) or to a local testing service such as LocalStack, for example, http://localhost:4566. When unset, the connector uses the default regional AWS endpoint.

Role ARN

String

Uniquely identifies a role to gain cross-account access.

External ID

String

The External ID is used to prevent the confused deputy problem when assuming a role in another account.

STS Endpoint URL

String

Custom endpoint URL that overrides the default regional AWS STS endpoint used when assuming a role. Configure this field independently of Custom Endpoint URL to route AWS STS calls through a separate VPC interface endpoint. When unset, the connector uses the default regional AWS STS endpoint.

Types

Expiration Policy

Field Type Description Default Value Required

Max Idle Time

Number

Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

Time unit for the Max Idle Time field.

Limitations

  • Amazon Secrets Manager Properties Provider doesn’t support the use of property files for the configuration of the properties provider.

  • The Custom Endpoint URL value applies to all secrets retrieved by a given configuration. To retrieve secrets from different endpoints, configure multiple config elements with distinct names.

  • Endpoint validation checks syntax only. Unreachable endpoints aren’t detected at deployment time and instead fail when a secret is first resolved.

Environment Variables

If you do not provide the AWS Access Key, AWS Secret Key, or AWS Secrets Manager Region values in the configuration, Amazon Secrets Manager Properties Provider uses the default credentials provider chain - AWS SDK for Java 2.x to resolve credentials and the region from the runtime environment. This capability enables you to avoid hardcoding AWS credentials in the Mule app configuration.

Use the following environment variables to configure the behavior of Amazon Secrets Manager Properties Provider from the environment instead of specifying parameters in the Mule app configuration:

  • AWS_ACCESS_KEY_ID

  • AWS_SECRET_ACCESS_KEY

  • AWS_SESSION_TOKEN (required only when using temporary credentials)

  • AWS_REGION

These variables are stored in secure configuration files with the values encrypted. During execution, the runtime decrypts these values and they remain in memory in their decrypted state. For more information, refer to Protecting App Property Values.

Alternatively, you can set the equivalent Java system properties: aws.accessKeyId, aws.secretAccessKey, aws.sessionToken, and aws.region. For the full list of credential sources and the order in which they are evaluated, refer to the default credentials provider chain - AWS SDK for Java 2.x.

Authenticate Through Environment Variables

To authenticate to Amazon Secrets Manager using environment variables, set the following environment variables:

  • AWS_ACCESS_KEY_ID

  • AWS_SECRET_ACCESS_KEY

  • AWS_REGION

Refer to Setting Environment Variables for details.

If you do not set the AWS Access Key, AWS Secret Key, or AWS Secrets Manager Region attributes in the configuration, the properties provider uses the values from the environment variables.

In the XML configuration, you can omit the credential attributes when you rely on environment variables:

<!-- Configuration using environment variables for AWS credentials and region -->
<aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config">
    <aws-secrets-manager-properties-override:basic-connection />
</aws-secrets-manager-properties-override:config>

If the properties provider cannot resolve credentials or the region from the configuration, environment variables, or any other source in the default credentials provider chain, the Mule app fails to start.

See Also

Back to top