tramai-spring-secrets-aws

Version: 0.6.0
Status: Preview
Role: Secret-backend module: resolves aws-secretsmanager:<secret-id>#<field> references.

Purpose

This module plugs an AWS Secrets Manager resolver into TramAI's Spring secret chain, so provider credentials can be referenced by secret id instead of being configured inline:

tramai:
  providers:
    openai:
      api-key-secret-ref: aws-secretsmanager:tramai/openai#api-key

Like the Vault module it contributes to the full chain, while its own AWS credentials are resolved through the bootstrap chain (user resolvers, env:, file:).

What it provides

Component	Detail
`AwsSecretsManagerSecretValueResolver`	`SecretValueResolver` implementation for the `aws-secretsmanager:` scheme
`AwsSecretsManagerSecretValueResolverAutoConfiguration`	Contributes the resolver to the full chain; inactive unless enabled
`AwsSecretsManagerProperties`	Binds `tramai.secrets.aws-secrets-manager.*`
`AwsSecretsManagerLookupClient`	Lookup seam used by the resolver and its tests

Key	Default	Notes
`tramai.secrets.aws-secrets-manager.enabled`	`false`	Resolver stays out of the chain unless true
`tramai.secrets.aws-secrets-manager.region`	—	Required when enabled
`tramai.secrets.aws-secrets-manager.endpoint`	—	Custom endpoint (e.g. LocalStack)
`tramai.secrets.aws-secrets-manager.access-key-id` / `access-key-id-secret-ref`	—	Static credential, first half
`tramai.secrets.aws-secrets-manager.secret-access-key` / `secret-access-key-secret-ref`	—	Static credential, second half
`tramai.secrets.aws-secrets-manager.session-token` / `session-token-secret-ref`	—	Optional session token
`tramai.secrets.aws-secrets-manager.default-field`	`value`	Field read when the reference names no field

Credential resolution rules:

access-key-id and secret-access-key must be configured together; configuring only one raises IllegalArgumentException at startup.
With no static credentials configured, the AWS SDK's default credential provider chain is used (instance profile, IRSA, environment).
A secret that does not exist resolves to nothing; a lookup error raises IllegalStateException. Secrets never appear in logs or exception messages.
Without #<field>, the resolver reads default-field, then falls back to the only value when the secret holds exactly one.

Dependencies

dependencies {
    implementation(platform("dev.tramai:tramai-bom:0.6.0"))
    implementation("dev.tramai:tramai-spring-boot-starter")
    implementation("dev.tramai:tramai-spring-secrets-aws")
}

tramai:
  secrets:
    aws-secrets-manager:
      enabled: true
      region: eu-west-1
      default-field: value

When to use this module

Credentials are managed in AWS Secrets Manager and resolved at application startup.
The workload already authenticates to AWS through a role, so no static keys are stored.

When NOT to use this module

The secret is a local file — use tramai-spring-secrets-file.
You use HashiCorp Vault — use tramai-spring-secrets-vault.
You want per-request secret retrieval or rotation: resolution happens once, during startup property binding.