software.amazon.jdbc.plugin

Class AwsSecretsManagerConnectionPlugin2

java.lang.Object

software.amazon.jdbc.plugin.AbstractConnectionPlugin

software.amazon.jdbc.plugin.AwsSecretsManagerConnectionPlugin

software.amazon.jdbc.plugin.AwsSecretsManagerConnectionPlugin2

All Implemented Interfaces:

ConnectionPlugin, StateSnapshotProvider

public class AwsSecretsManagerConnectionPlugin2
extends AwsSecretsManagerConnectionPlugin

Stale-While-Revalidate (SWR) variant of AwsSecretsManagerConnectionPlugin.

This plugin reuses all of the credential fetching, caching, parsing, and error handling of the original plugin, and only changes the cache-refresh strategy:

• Cache hit (fresh): use cached credentials immediately (same as v1).
• Cache hit (stale): use the stale credentials immediately and trigger a single asynchronous background refresh. The connection is never blocked.
• Cache miss (first connection): fetch synchronously (same as v1).
• Login failure with stale credentials: the inherited connect logic performs a synchronous re-fetch and retries the connection.

At most one in-flight refresh exists per (secretId, region) key (pendingRefreshes), which prevents a thundering herd of Secrets Manager calls when many connections are opened concurrently with an expired cache.

Both plugins share the same credential cache (the StorageService), so credentials cached by one are visible to the other.

Field Summary

Fields

Modifier and Type	Field and Description
protected static long	MIN_EXPIRATION_TIME_SECONDS

Fields inherited from class software.amazon.jdbc.plugin.AwsSecretsManagerConnectionPlugin

ENDPOINT_PROPERTY, fetchCredentialsCounter, pluginService, REGION_PROPERTY, regionUtils, secret, SECRET_ID_PROPERTY, secretExpirationTime, SECRETS_MANAGER_EXPIRATION_SEC_PROPERTY, SECRETS_MANAGER_SECRET_PASSWORD_PROPERTY, SECRETS_MANAGER_SECRET_USERNAME_PROPERTY, servicesContainer, TELEMETRY_UPDATE_SECRETS

Constructor Summary

Constructors

Constructor and Description
AwsSecretsManagerConnectionPlugin2(FullServicesContainer servicesContainer, java.util.Properties props)

Method Summary

Modifier and Type	Method and Description
protected long	resolveSecretExpirationTime(long configuredExpirationTime) Clamp the configured expiration time to a minimum to avoid excessively frequent background refresh triggers.
protected boolean	updateSecret(HostSpec hostSpec, boolean forceReFetch) SWR override of the inherited cache-refresh logic.

Methods inherited from class software.amazon.jdbc.plugin.AwsSecretsManagerConnectionPlugin

clearCache, connect, fetchAndStoreSecret, forceConnect, getSubscribedMethods

Methods inherited from class software.amazon.jdbc.plugin.AbstractConnectionPlugin

acceptsStrategy, execute, getHostSpecByStrategy, getHostSpecByStrategy, getSnapshotState, initHostProvider, notifyConnectionChanged, notifyNodeListChanged

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MIN_EXPIRATION_TIME_SECONDS

protected static final long MIN_EXPIRATION_TIME_SECONDS

See Also:

Constant Field Values

Constructor Detail

AwsSecretsManagerConnectionPlugin2

public AwsSecretsManagerConnectionPlugin2(FullServicesContainer servicesContainer,
                                          java.util.Properties props)

Method Detail

resolveSecretExpirationTime

protected long resolveSecretExpirationTime(long configuredExpirationTime)

Clamp the configured expiration time to a minimum to avoid excessively frequent background refresh triggers. Values below the minimum are raised with a warning.

Overrides:

resolveSecretExpirationTime in class AwsSecretsManagerConnectionPlugin

Parameters:

configuredExpirationTime - the value configured via secretsManagerExpirationTimeSec.

Returns:

the expiration time to use.

updateSecret

protected boolean updateSecret(HostSpec hostSpec,
                               boolean forceReFetch)
                        throws java.sql.SQLException

SWR override of the inherited cache-refresh logic.

Overrides:

updateSecret in class AwsSecretsManagerConnectionPlugin

Parameters:

forceReFetch - when true (login-failure retry path) a synchronous fetch is always performed; otherwise stale credentials are served immediately while a background refresh runs.

Returns:

true only when credentials were freshly fetched from the service, matching the contract of the superclass (a true result suppresses the login-failure retry).

Throws:

java.sql.SQLException