Database password rotation with AWS Secrets Manager and Spring Boot

Depending on how serious you are about security you may want to consider setting up password rotation for databases. If you're on AWS - they've got you covered! AWS Secrets Manager comes with support for automatic password rotation for RDS (and other database services).

In my channel I discuss things I believe are relevant to either Java & Spring beginners, or advanced developers who want to stay up to date. Feedback is very much welcome!

--
Music:

[dvaderjava]

The real question is: why did you stop making these videos? Last one in the channel (the current one) is 9 months old. The material is really good and to the point and really useful for learning about Spring and AWS. I specially liked the one about LocalStack and TestContainers.

[amrutprabhu]

This was what I was looking for.. really helped me... great explanation .. Subscribed!

[ranajitjana]

In case you can point to all the documentation from with you have made this it will help. This effort too was quite helpful. Thank you for posting

[mykolaskucinskas]

Really great tutorial. Thank you for showing the alternative (aws-secretsmanager-jdbc library) to that Java code snippet.

[OlegKosmakov]

I have to add it's not that the AWS maintains 2 passwords at once so that you can connect. What happened really is that the connection was already open when the password changed, therefore it continued to work. Until the program restart, of course.

[mannanahmad]

Nice video, i was struggling to write lambda. But now i came to know lambda is automatically written

[bbNganNguyen]

Thank you so much for this awesowe video.

[amirmuhsin]

you must come back! Why are you taking such a big break between your videos ???
I thought I finally found awesome content about Spring boot.
We need you. Please come back :)
Or if you have some paid courses, give us a link.

[lighninggamerz]

great explanation Maciej ..One thing I would like to know is using aws-secretsmanager-jdbc library if the application is using old password and now if secrets rotation happens how application works without restarting it ? I mean how application establishes the connection with new password without restarting ?

[sangitabiswas]

Amy idea how to handle this same scenario in NodeJs?

[shekhshek]

This approach works fine for spring data source using jdbc template but not working with spring boot jpa applications.Any idea??


Error:
ERROR - Application run failed
Error creating bean with name 'entityManagerFactory' defined in class path resource Unsatisfied dependency expressed through method 'entityManagerFactory' parameter 0; nested exception is Error creating bean with name 'entityManagerFactoryBuilder' defined in class path resource Unsatisfied dependency expressed through method 'entityManagerFactoryBuilder' parameter 0; nested exception is Error creating bean with name 'jpaVendorAdapter' defined in class path resource Bean instantiation via factory method failed; nested exception is Failed to instantiate Factory method 'jpaVendorAdapter' threw exception; nested exception is java.lang.RuntimeException: Driver com.mysql.cj.jdbc.Driver claims to not accept jdbcUrl,

[khoale]

Thanks for the video. One question, do we have any way to hide the real url of database such like username and password. Anyway thank you your video to get me an idea for this situation.

[inaslohith]

After rotating secret in secret manager, do we not needed to update the new password in RDS?

[subodhgholap]

Hello, Can you please share your example repo with us ? Thank you for gr8 session

[pavankumarnimmagadda]

Is something similar available for ruby to connect to postgres? So that the password can be pulled dynamically and secret rotation also talen care.

[ansariamin]

Guyz I am trying to integrate the secret Manager on on premise web server…. We have jboss eap which is connecting to cloud database now I want to mask the id and password using secret manager on the on prem server… have tried multiple method online but nothing seems to work ……does anyone have document for this will by much help

[olehstepaniak]

Hi, one more time. How we can rotate DB password using AWS SM, but at our local DB - not from the RDS list? For example, I would back to REDIS. We have Redis(we haven't Redis engine in AWS RDS), and we need to change a password for him every month(It's would be nice if you send some tutorials how we can change this value programicaly). This is my poc, but I really want to know how to provide the secret to DB, which we haven't in RDS variability(or have, but we don't want to use RDS). (mb, we need a specific configuration?)

And thx for your great work. Your channel is really helpful. Better on YouTube.

[bbNganNguyen]

I follow the instruction but I dont know why my DB's password is not encrypt and it's still show the plain text. For example your password is myscecret and after creating the key, it's still show myscecret. Can you give me the advise?

[jdkim]

Do you have any solution without server reboot to adjust db properties instantly?

[dominikbartholdi]

I might have missed something, but why did your local application have permission to access the secretmanager? kind of looks like everyone could get your passwords from the secret manager.