Skip to content

Publish labkey.aws.ssm.enabled for explicit SSM opt-in #1468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
labkey-jeckels merged 2 commits into from
Aug 21, 2026
Merged

Publish labkey.aws.ssm.enabled for explicit SSM opt-in #1468

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
819c5f8
Publish labkey.aws.ssm.enabled for explicit SSM opt-in
labkey-jeckels Aug 11, 2026
ef9e75f
Refer to class-level docs for enabled state
labkey-jeckels Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.jspecify.annotations.NonNull;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.EnvironmentPostProcessor;
import org.springframework.boot.SpringApplication;
import org.springframework.core.Ordered;
import org.springframework.core.env.ConfigurableEnvironment;
import org.springframework.core.env.EnumerablePropertySource;
Expand Down Expand Up @@ -58,8 +58,9 @@
* <p>SSM initialization also runs when {@code context.awsParameterStore.prefix} is explicitly
* configured (even with no {@code ssm:} values), so that the CloudServices module can create its
* own {@code SsmClient} for on-demand {@code SecretService} lookups. When active, this processor
* publishes {@code labkey.aws.ssm.region} and optionally {@code labkey.aws.ssm.secretsPrefix} as
* JVM system properties without any cross-classloader reflection.
* publishes {@code labkey.aws.ssm.enabled}, {@code labkey.aws.ssm.region}, and
* {@code labkey.aws.ssm.secretsPrefix} as JVM system properties without any cross-classloader
* reflection.
*
* <p>{@code context.awsParameterStore.secretsPrefix} controls where {@code SecretProperty}
* values are looked up at runtime. A relative value (no leading {@code /}) is resolved against
Expand Down Expand Up @@ -137,16 +138,17 @@ public void postProcessEnvironment(ConfigurableEnvironment environment, SpringAp
secretsPrefix = prefix;
}

if (!secretsPrefix.isEmpty() && !secretsPrefix.endsWith("/") && !secretsPrefix.endsWith("::"))
if (!secretsPrefix.endsWith("/") && !secretsPrefix.endsWith("::"))
throw new IllegalStateException(
"[LabKey AWS] Resolved secretsPrefix must end with '/' or '::' (got: '" + secretsPrefix +
"'). Check " + SECRETS_PREFIX_PROPERTY + " and " + PREFIX_PROPERTY + " in application.properties");

String regionOverride = environment.getProperty(REGION_PROPERTY);
Region region = resolveRegion(regionOverride);

// Publish config as system properties so the CloudServices module can create its own
// SsmClient for on-demand SecretProperty lookups via SecretService at runtime.
// Publish config as system properties so the CloudServices module can create its own SsmClient
// for on-demand SecretProperty lookups via SecretService at runtime, enabled per the class-level JavaDoc
System.setProperty("labkey.aws.ssm.enabled", "true");

@labkey-gokhano labkey-gokhano Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comment update: This flag is set to True whenever we didn't take the early return above: either explicit config or at least one SSM reference

@labkey-jeckels labkey-jeckels Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I revised to reference the class-level docs that already explain in more detail

System.setProperty("labkey.aws.ssm.region", region.id());
System.setProperty("labkey.aws.ssm.secretsPrefix", secretsPrefix);

Expand Down