AWS Secrets Manager Client
AWS Secrets Manager helps you store, manage, rotate and retrieve database credentials, API keys and other secrets, so that they are not hardcoded in your application. This client lets you create, update and retrieve secrets and configure their rotation.
For more information, see the AWS Secrets Manager documentation.
| The extension is based on AWS Java SDK 2.x. It’s a major rewrite of the 1.x code base that offers two programming models (Blocking & Async). |
The Quarkus extension supports two programming models:
-
Blocking access using URL Connection HTTP client (by default), the Apache 5.x HTTP client, the Apache HTTP client (deprecated) or the AWS CRT-based HTTP client
-
Asynchronous programming based on JDK’s
CompletableFutureobjects and the Netty HTTP client or the AWS CRT-based HTTP client
In this guide, we see how you can get your REST services to use AWS Secrets Manager locally and on AWS.
Prerequisites
To complete this guide, you need:
-
JDK 21+ installed with
JAVA_HOMEconfigured appropriately -
an IDE
-
Apache Maven 3.8.1+
-
Docker, to run AWS Secrets Manager locally with Dev Services and to run the tests
-
Optionally, GraalVM or Mandrel installed to build a native executable
No AWS account is required: Dev Services and the local Floci container provide everything you need. You only need an AWS account and the AWS Command Line Interface if you want to deploy to AWS.
Start Floci automatically with Dev Services
The easiest way to start working with AWS Secrets Manager is to run a local instance using Dev Services. Dev Services starts a Floci container in dev and test modes, and configures the client to use it, so you don’t need an AWS account.
The container listens on a random port, so you never hard-code an endpoint.
It is labelled quarkus-dev-service-floci and shared between the Quarkus applications running in dev mode.
Refer to Dev Services for Amazon Services for the provider selection, the container configuration and the init scripts.
Start Floci manually
You can also start a Floci container yourself:
docker run --rm --name floci --publish 4566:4566 -d floci/floci:latest-compatThis starts a Floci instance that is accessible on port 4566. Floci exposes all the services it emulates on this single endpoint.
The latest-compat image ships the AWS CLI, already configured to target the local endpoint.
Run the provisioning commands of this guide inside the container, with docker exec floci aws ….
You do not need to install or configure the AWS CLI on your host.
You can check the region, the credentials and the endpoint used inside the container:
docker exec floci env | grep AWS_The CLI uses the region us-east-1, the credentials test / test, and the endpoint http://localhost:4566 seen from inside the container.
An application running on the host reaches Floci at http://localhost:4566; an application running in another container must use the container name, for example http://floci:4566, and the containers must share a Docker network.
What you will build
The application built here stores secrets in Secrets Manager and retrieves them.
It uses the synchronous client first, then the asynchronous client in Going asynchronous.
Walkthrough
Creating the Maven project
First, we need a new project. Create a new project with the following command:
mvn io.quarkus.platform:quarkus-maven-plugin:4.0.0.Beta2:create \
-DprojectGroupId=org.acme \
-DprojectArtifactId=amazon-secretsmanager-quickstart \
-DclassName="org.acme.secretsmanager.QuarkusSecretsManagerSyncResource" \
-Dpath="/sync" \
-Dextensions="rest-jackson,amazon-secretsmanager"
cd amazon-secretsmanager-quickstartThis command generates a Maven structure importing the Quarkus REST and AWS Secrets Manager Client extensions.
After this, the amazon-secretsmanager extension has been added to your pom.xml, along with quarkus-rest and quarkus-rest-jackson.
The AWS Secrets Manager extensions are a component of the Quarkus platform, and the generated pom.xml already imports their BOM through it, which is the recommended setup.
Due to differing release schedules, the Quarkus platform may not include the latest Quarkus Amazon Services release.
If you need features from a newer release, replace the generated quarkus-amazon-services-bom import with the Quarkus Amazon Services BOM:
<dependency>
<groupId>io.quarkiverse.amazonservices</groupId>
<artifactId>quarkus-amazon-services-bom</artifactId>
<version>4.0.0.Beta5</version>
<type>pom</type>
<scope>import</scope>
</dependency>The command also generates a QuarkusSecretsManagerSyncResourceTest class and a QuarkusSecretsManagerSyncResourceIT class that call the hello endpoint of the generated resource.
The next section replaces that resource: delete these two files, or update them to match the endpoints you create.
Creating the REST resource
Let’s start with the synchronous implementation in the org.acme.secretsmanager.QuarkusSecretsManagerSyncResource class.
package org.acme.secretsmanager;
import jakarta.inject.Inject;
import jakarta.ws.rs.Consumes;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.PUT;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.MediaType;
import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
@Path("/sync")
public class QuarkusSecretsManagerSyncResource {
@Inject (1)
SecretsManagerClient secretsManagerClient;
@PUT
@Path("/{name}")
@Consumes(MediaType.TEXT_PLAIN)
@Produces(MediaType.TEXT_PLAIN)
public String createSecret(@PathParam("name") String name, String value) {
return secretsManagerClient.createSecret(r -> r.name(name).secretString(value)).arn(); (2)
}
@GET
@Path("/{name}")
@Produces(MediaType.TEXT_PLAIN)
public String getSecret(@PathParam("name") String name) {
return secretsManagerClient.getSecretValue(r -> r.secretId(name)).secretString(); (3)
}
}| 1 | Inject the client provided by the amazon-secretsmanager extension |
| 2 | Store the request body as a new secret and return the ARN of the secret |
| 3 | Retrieve the current value of the secret |
Configuring AWS Secrets Manager clients
Both AWS Secrets Manager clients (sync and async) are configurable via the application.properties file that can be provided in the src/main/resources directory.
Additionally, you need to add to the classpath a proper implementation of the sync client. By default, the extension uses the URL connection HTTP client, so
you need to add a URL connection client dependency to the pom.xml file:
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>url-connection-client</artifactId>
</dependency>If you want to use the Apache 5.x HTTP client instead, configure it as follows:
quarkus.secretsmanager.sync-client.type=apache5And add the following dependency to the application pom.xml:
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>apache5-client</artifactId>
</dependency>If you want to use the Apache HTTP client instead, configure it as follows:
quarkus.secretsmanager.sync-client.type=apacheAnd add the following dependency to the application pom.xml:
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>apache-client</artifactId>
</dependency>|
The AWS SDK has deprecated the Apache HTTP client in favor of the Apache 5.x HTTP client, which is a drop-in replacement: prefer |
If you want to use the AWS CRT-based HTTP client instead, configure it as follows:
quarkus.secretsmanager.sync-client.type=aws-crtAnd add the following dependency to the application pom.xml:
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>aws-crt-client</artifactId>
</dependency>Use Dev Services
With Dev Services, there is nothing to configure: in dev and test modes, Dev Services starts Floci and configures the endpoint, the region and the credentials of the clients.
Use a manually started Floci
If you started Floci yourself, configure the client to use it as follows:
quarkus.secretsmanager.endpoint-override=http://localhost:4566 (1)
quarkus.secretsmanager.aws.region=us-east-1 (2)
quarkus.secretsmanager.aws.credentials.type=static (3)
quarkus.secretsmanager.aws.credentials.static-provider.access-key-id=test-key
quarkus.secretsmanager.aws.credentials.static-provider.secret-access-key=test-secret| 1 | Override the AWS Secrets Manager client to use Floci instead of the actual AWS service. When it is set, Dev Services does not start a local stack for AWS Secrets Manager. |
| 2 | Floci defaults to us-east-1 |
| 3 | The static credentials provider lets you set the access-key-id and secret-access-key directly |
Use your AWS account
If you want to work with an AWS account, you need an AWS account with access to AWS Secrets Manager and the AWS Command Line Interface, then remove or comment out the endpoint-override and the static credentials properties of the previous section.
By default, the AWS Secrets Manager client uses the default credentials provider chain that looks for credentials in this order:
-
Java System Properties -
aws.accessKeyIdandaws.secretAccessKey -
Environment Variables -
AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY -
Credential profiles file at the default location (
~/.aws/credentials) shared by all AWS SDKs and the AWS CLI -
Credentials delivered through the Amazon ECS if the
AWS_CONTAINER_CREDENTIALS_RELATIVE_URIenvironment variable is set and the security manager has permission to access the variable, -
Instance profile credentials delivered through the Amazon EC2 metadata service
And the region from your AWS CLI profile will be used.
|
Without Dev Services never starts in production mode. |
Run the application in Dev Mode
Run the application in dev mode with:
./mvnw clean quarkus:devIf you use Dev Services, it starts a Floci container and configures the AWS Secrets Manager clients to use it. The Dev Services card of the Dev UI, at http://localhost:8080/q/dev-ui, shows the container and the endpoint it exposes.
-
Store a secret named
quarkus-passwordwith the synchronous client:
curl -X PUT -H "Content-Type: text/plain" -d "Quarkus is awesome" http://localhost:8080/sync/quarkus-passwordThe endpoint returns the ARN of the secret.
-
Retrieve the secret:
curl http://localhost:8080/sync/quarkus-passwordThe endpoint returns Quarkus is awesome.
Next steps
Packaging
Packaging your application is as simple as ./mvnw clean package.
It can then be run with java -jar target/quarkus-app/quarkus-run.jar.
With GraalVM or Mandrel installed, you can also create a native executable binary:
./mvnw clean package -DnativeWithout GraalVM or Mandrel, build the native executable inside a container:
./mvnw clean package -Dnative -Dquarkus.native.container-build=trueDepending on your system, that will take some time.
Run the native executable with ./target/amazon-secretsmanager-quickstart-1.0.0-SNAPSHOT-runner.
Dev Services does not start in production mode, so you need to make sure that your application.properties file is configured to use your AWS account or a local stack.
To use a local Floci instance, pass the endpoint and the credentials on the command line:
|
java \
-Dquarkus.secretsmanager.endpoint-override=http://localhost:4566 \
-Dquarkus.secretsmanager.aws.region=us-east-1 \
-Dquarkus.secretsmanager.aws.credentials.type=static \
-Dquarkus.secretsmanager.aws.credentials.static-provider.access-key-id=test-key \
-Dquarkus.secretsmanager.aws.credentials.static-provider.secret-access-key=test-secret \
-jar target/quarkus-app/quarkus-run.jarSee the Packaging applications guide for more details.
Going asynchronous
Thanks to the AWS SDK v2.x used by the Quarkus extension, you can use the asynchronous programming model out of the box.
Create a org.acme.secretsmanager.QuarkusSecretsManagerAsyncResource REST resource that will be similar to our QuarkusSecretsManagerSyncResource but using an asynchronous programming model.
package org.acme.secretsmanager;
import jakarta.inject.Inject;
import jakarta.ws.rs.Consumes;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.PUT;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.MediaType;
import io.smallrye.mutiny.Uni;
import software.amazon.awssdk.services.secretsmanager.SecretsManagerAsyncClient;
@Path("/async")
public class QuarkusSecretsManagerAsyncResource {
@Inject
SecretsManagerAsyncClient secretsManagerAsyncClient;
@PUT
@Path("/{name}")
@Consumes(MediaType.TEXT_PLAIN)
@Produces(MediaType.TEXT_PLAIN)
public Uni<String> createSecret(@PathParam("name") String name, String value) {
return Uni.createFrom().completionStage(secretsManagerAsyncClient.createSecret(r -> r.name(name).secretString(value)))
.map(response -> response.arn());
}
@GET
@Path("/{name}")
@Produces(MediaType.TEXT_PLAIN)
public Uni<String> getSecret(@PathParam("name") String name) {
return Uni.createFrom().completionStage(secretsManagerAsyncClient.getSecretValue(r -> r.secretId(name)))
.map(response -> response.secretString());
}
}Note that the SecretsManagerAsyncClient behaves just like the SecretsManagerClient, but returns CompletionStage objects which we use to create Uni instances, and then transform the emitted item.
To enable the asynchronous client, you also need to add the Netty HTTP client dependency to the pom.xml:
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>netty-nio-client</artifactId>
</dependency>If you want to use the AWS CRT-based HTTP client instead, configure it as follows:
quarkus.secretsmanager.async-client.type=aws-crtAnd add the following dependency to the application pom.xml:
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>aws-crt-client</artifactId>
</dependency>Quarkus dev mode picks up the new resource, and restarts by itself when pom.xml changes: if the application is still running, wait a few seconds, then call it again.
Otherwise, run it again with ./mvnw quarkus:dev.
-
Call the same endpoints with the asynchronous client, replacing
syncwithasyncin the URLs. Use another secret name, as the secretquarkus-passwordalready exists.
Going further
You have built a Quarkus application that uses AWS Secrets Manager, developed locally against Dev Services and ready to run on your AWS account. You are all set to build great applications with AWS Secrets Manager, with the fast startup, the low memory footprint and the developer joy of Quarkus.
To go further:
-
Common features: named clients, overriding the client configuration, custom AWS credentials providers.
-
Dev Services for Amazon Services: stack providers, shared containers, init scripts.
-
OpenTelemetry for Amazon Services: trace the calls of the AWS SDK.
Using AWS Secrets Manager as a Quarkus Config Source
Load application properties from explicit Secrets Manager secrets. See Configuration from AWS to compare providers, read properties in your application and configure AWS access. This ConfigSource loads values at startup and can poll for updates.
Map configuration properties to secret names
Create plain-text secrets prod/my-service/password and prod/my-service/api-key with the values your application needs:
quarkus.secretsmanager.config.enabled=true
quarkus.secretsmanager.config.secrets."my.service.password"=prod/my-service/password
quarkus.secretsmanager.config.secrets."my.service.api-key"=prod/my-service/api-keyReading my.service.password or my.service.api-key now returns the corresponding secret text.
The target property name becomes a prefix when the secret contains a document. The selection can be a secret name or ARN
(prefer full ARNs). Only explicit selections are fetched; several targets can select the same secret.
|
An empty selection no longer lists every secret in the account. Specify |
Named entries
quarkus.secretsmanager.config.enabled=true
quarkus.secretsmanager.config.entries.database.secret-id=prod/my-service/db
quarkus.secretsmanager.config.entries.database.prefix=db
quarkus.secretsmanager.config.entries.database.format=jsonThe name database identifies the entry, not its prefix. Named entries and legacy secrets."property"=secret-id mappings
can coexist. quarkus.secretsmanager.config.format is their default format; each entry can override it.
Refresh secret values
Polling is off by default. To read the selected secrets again after startup:
quarkus.secretsmanager.config.update-interval=30SAfter changing a secret and a successful refresh, dynamic lookups return its new value. A failed refresh keeps the previous values. Each refresh makes AWS requests for the selected secrets and may incur charges.
Read fields from a JSON secret
A Key/value secret created in the AWS console, or managed by Amazon RDS, is a JSON object. Mapping
{"username":"app_user","password":"database-password"} to prefix db exposes db.username and db.password, not db.
For nested documents, arrays, scalars and raw fallback, see Formats, prefixes and property names.
SecretBinary must contain valid UTF-8 text; arbitrary binary must be read directly with the SDK.
Optional batch retrieval
quarkus.secretsmanager.config.batch-retrieval=trueEnable this option when you want to retrieve selected secrets in groups of up to 20 instead of individual reads. It is off by default and applies even when only one secret is selected. Use consistent names/ARNs to avoid redundant reads; batching does not discover additional secrets or enable polling by itself.
Grant secretsmanager:BatchGetSecretValue in addition to per-secret secretsmanager:GetSecretValue and appropriate
KMS decrypt permissions. ListSecrets is not required. Check IAM/resource and VPC endpoint policies when enabling the flag.
Denied or unsupported batch operations do not fall back to individual reads; disable the flag to use GetSecretValue.
If any selected secret fails to load, the startup failure policy applies.
No transaction, latency or billing saving is guaranteed.
Expressions still use GetSecretValue; credential sets have their own independent batching flag.
Resolve individual secrets with expressions
myapp.api-key=${sm::prod/api-key}
myapp.database.password=${sm::prod/database#/password}
quarkus.secretsmanager.expression.cache-ttl=5MIf prod/api-key contains example-key, myapp.api-key returns example-key. The JSON example reads the password
field of prod/database. Both use the current (AWSCURRENT) value.
Grant secretsmanager:GetSecretValue and appropriate KMS decrypt permission; neither ListSecrets nor
BatchGetSecretValue is required. SecretBinary must contain valid UTF-8.
See individual-value examples for JSON Pointer syntax, caching and failures;
config.enabled is not required.
Supply credentials to a datasource
Follow the datasource example. Store
{"username":"app_user","password":"database-password"} in prod/database and select it with:
quarkus.secretsmanager.credentials-provider.db.secret-id=prod/database
quarkus.secretsmanager.credentials-provider.db.format=json
quarkus.datasource.credentials-provider=db
quarkus.datasource.credentials-provider-name=secretsmanager-credentials-providerNew physical connections authenticate as app_user with the current (AWSCURRENT) stored password,
provided the database accepts those credentials.
For password-only rotation, set quarkus.secretsmanager.credentials-provider.db.format=raw, select a password-only secret,
and configure quarkus.datasource.username locally.
Alternatively, select individual raw secrets instead of secret-id:
quarkus.secretsmanager.credentials-provider.db.secrets.password=prod/database-password
# Optional; omit to use quarkus.datasource.username
quarkus.secretsmanager.credentials-provider.db.secrets.user=prod/database-user
# Optional, false by default; independent of config.batch-retrieval
quarkus.secretsmanager.credentials-provider.db.batch-retrieval=trueGrant secretsmanager:GetSecretValue by default; batching requires
secretsmanager:BatchGetSecretValue as well, even for one selected document or secret. Appropriate KMS permissions also apply.
There is no automatic fallback if batching is denied or unsupported. Binary secrets must contain valid UTF-8 in the selected format.
See credential formats and field selection and connection recycling when configuring rotation.
Configuration Reference
Configuration property fixed at build time - All other configuration properties are overridable at runtime
Configuration property |
Type |
Default |
|---|---|---|
List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements Environment variable: |
list of string |
|
OpenTelemetry AWS SDK instrumentation will be enabled if the OpenTelemetry extension is present and this value is true. Environment variable: |
boolean |
|
Type of the sync HTTP client implementation Environment variable: |
|
|
Type of the async HTTP client implementation Environment variable: |
|
|
If a local AWS stack should be used. (default to true) If this is true and endpoint-override is not configured then a local AWS stack will be started and will be used instead of the given configuration. The local AWS stack is provided by the stack provider configured with Environment variable: |
boolean |
|
Generic properties that are pass for additional container configuration. Environment variable: |
Map<String,String> |
|
The dev services stack provider to use for this service. If not specified, the global setting from quarkus.aws.devservices.provider is used. Supported values: "floci", "localstack", "ministack", "moto" This allows per-service override of the global stack selection. Environment variable: |
|
|
Whether to enable the AWS Secrets Manager ConfigSource ( When disabled, no configuration values are loaded from AWS Secrets Manager. Environment variable: |
boolean |
|
Fail startup if configuration cannot be loaded completely, including missing resources, access or decoding errors. Environment variable: |
boolean |
|
Config source ordinal; higher values take precedence. Defaults between .env and application.properties. Environment variable: |
int |
|
Minimum delay after a completed read before polling again. Zero disables polling; use at least one second. Environment variable: |
|
|
Retrieve selected secrets with BatchGetSecretValue in groups of up to 20 instead of individual GetSecretValue calls. Requires secretsmanager:BatchGetSecretValue in addition to per-secret GetSecretValue permissions; no listing or automatic fallback is performed. Does not affect expressions or the credentials provider. Environment variable: |
boolean |
|
Mapping from a Quarkus configuration property name to an AWS Secrets Manager secret name.
Combined with named entries. An empty selection never lists secrets or loads the account implicitly. Environment variable: |
Map<String,String> |
|
Format of each secret value. Auto detects JSON objects and arrays, otherwise preserving the raw value. YAML requires the quarkus-config-yaml extension. Environment variable: |
|
|
Successful expression reads are cached for this duration. Zero disables caching; negative durations are rejected. Environment variable: |
|
|
Secret name or ARN to retrieve. Prefer a full ARN over a partial ARN. Environment variable: |
string |
required |
Optional target property/prefix. Required for raw text and non-null JSON scalars. Environment variable: |
string |
|
Value format; defaults to the source-wide format. Environment variable: |
|
|
Secret name or ARN containing a credential document. Mutually exclusive with Environment variable: |
string |
|
Document format: json (default), properties, yaml (requires quarkus-config-yaml), or raw (password only). The auto format is not supported for credentials. Environment variable: |
|
|
Document field containing the username; an empty setting omits the username. Missing fields are also omitted. Environment variable: |
string |
|
Required password field in a JSON, properties or YAML document. Environment variable: |
string |
|
Individual raw secrets keyed by Quarkus credential name: password (required) and user (optional). Environment variable: |
Map<String,String> |
|
Use BatchGetSecretValue for the explicit selection, requiring its additional IAM permission. No fallback. Environment variable: |
boolean |
|
Type |
Default |
|
The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region. Environment variable: |
||
The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present. Environment variable: |
||
The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present. Environment variable: |
||
Whether the Quarkus thread pool should be used for scheduling tasks such as async retry attempts and timeout task. When disabled, the default sdk behavior is to create a dedicated thread pool for each client, resulting in competition for CPU resources among these thread pools. Environment variable: |
boolean |
|
Type |
Default |
|
An Amazon Web Services region that hosts the given service. It overrides region provider chain with static value of region with which the service client should communicate. If not set, region is retrieved via the default providers chain in the following order:
See Environment variable: |
Region |
|
Configure the credentials provider that should be used to authenticate with AWS. Available values:
Environment variable: |
|
|
Type |
Default |
|
Whether this provider should fetch credentials asynchronously in the background. If this is Environment variable: |
boolean |
|
Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain. Environment variable: |
boolean |
|
Type |
Default |
|
AWS Access key id Environment variable: |
string |
|
AWS Secret access key Environment variable: |
string |
|
AWS Session token Environment variable: |
string |
|
Type |
Default |
|
The name of the profile that should be used by this credentials provider. If not specified, the value in Environment variable: |
string |
|
Type |
Default |
|
Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider. Environment variable: |
boolean |
|
The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire. Environment variable: |
|
|
The maximum size of the output that can be returned by the external process before an exception is raised. Environment variable: |
|
|
The command that should be executed to retrieve credentials. Command and parameters are seperated list entries. Environment variable: |
list of string |
|
Type |
Default |
|
The name of custom AwsCredentialsProvider bean. Environment variable: |
string |
|
Type |
Default |
|
The maximum amount of time to establish a connection before timing out. Environment variable: |
|
|
The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out. Environment variable: |
|
|
TLS key managers provider type. Available providers:
Environment variable: |
|
|
Path to the key store. Environment variable: |
path |
|
Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types. Environment variable: |
string |
|
Key store password Environment variable: |
string |
|
TLS trust managers provider type. Available providers:
Environment variable: |
|
|
Path to the key store. Environment variable: |
path |
|
Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types. Environment variable: |
string |
|
Key store password Environment variable: |
string |
|
Type |
Default |
|
The amount of time to wait when acquiring a connection from the pool before giving up and timing out. Environment variable: |
|
|
The maximum amount of time that a connection should be allowed to remain open while idle. Environment variable: |
|
|
The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency. Environment variable: |
||
The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool. Environment variable: |
int |
|
Whether the client should send an HTTP expect-continue handshake before each request. Environment variable: |
boolean |
|
Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than Environment variable: |
boolean |
|
Configure whether to enable or disable TCP KeepAlive. Environment variable: |
boolean |
|
Enable HTTP proxy Environment variable: |
boolean |
|
The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised. Environment variable: |
||
The username to use when connecting through a proxy. Environment variable: |
string |
|
The password to use when connecting through a proxy. Environment variable: |
string |
|
For NTLM proxies - the Windows domain name to use when authenticating with the proxy. Environment variable: |
string |
|
For NTLM proxies - the Windows workstation name to use when authenticating with the proxy. Environment variable: |
string |
|
Whether to attempt to authenticate preemptively against the proxy server using basic authentication. Environment variable: |
boolean |
|
The hosts that the client is allowed to access without going through the proxy. Environment variable: |
list of string |
|
Type |
Default |
|
The maximum amount of time that a connection should be allowed to remain open while idle. Environment variable: |
|
|
The maximum number of allowed concurrent requests. Environment variable: |
int |
|
The amount of time to wait when initially establishing a connection before giving up and timing out. Environment variable: |
|
|
Enable HTTP proxy Environment variable: |
boolean |
|
The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised. Environment variable: |
||
The username to use when connecting through a proxy. Environment variable: |
string |
|
The password to use when connecting through a proxy. Environment variable: |
string |
|
Configure whether to enable or disable TCP KeepAlive. Environment variable: |
boolean |
|
Time between TCP keepalive packets being sent to the peer. Environment variable: |
|
|
Time to wait for a keepalive response before considering the connection timed out. Environment variable: |
|
|
Number of keepalive probes allowed to fail before the connection is considered lost. Environment variable: |
int |
|
Type |
Default |
|
The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection. Environment variable: |
int |
|
The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed. Environment variable: |
int |
|
The amount of time to wait for a read on a socket before an exception is thrown. Specify Environment variable: |
|
|
The amount of time to wait for a write on a socket before an exception is thrown. Specify Environment variable: |
|
|
The amount of time to wait when initially establishing a connection before giving up and timing out. Environment variable: |
|
|
The amount of time to wait when acquiring a connection from the pool before giving up and timing out. Environment variable: |
|
|
The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency. Environment variable: |
||
The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if Environment variable: |
|
|
Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than Environment variable: |
boolean |
|
Configure whether to enable or disable TCP KeepAlive. Applicable only to netty-nio client. Environment variable: |
boolean |
|
Type |
Default |
|
The maximum amount of time that a connection should be allowed to remain open while idle. Environment variable: |
|
|
The maximum number of allowed concurrent requests. Environment variable: |
int |
|
The amount of time to wait when initially establishing a connection before giving up and timing out. Environment variable: |
|
|
Enable HTTP proxy Environment variable: |
boolean |
|
The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised. Environment variable: |
||
The username to use when connecting through a proxy. Environment variable: |
string |
|
The password to use when connecting through a proxy. Environment variable: |
string |
|
Configure whether to enable or disable TCP KeepAlive. Environment variable: |
boolean |
|
Time between TCP keepalive packets being sent to the peer. Environment variable: |
|
|
Time to wait for a keepalive response before considering the connection timed out. Environment variable: |
|
|
Number of keepalive probes allowed to fail before the connection is considered lost. Environment variable: |
int |
|
The HTTP protocol to use. Environment variable: |
|
|
The SSL Provider to be used in the Netty client. Default is Environment variable: |
|
|
The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used. Environment variable: |
long |
|
The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used. Environment variable: |
int |
|
Sets the period that the Netty client will send This setting is only respected when the HTTP/2 protocol is used. Environment variable: |
|
|
Enable HTTP proxy. Environment variable: |
boolean |
|
The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised. Environment variable: |
||
The hosts that the client is allowed to access without going through the proxy. Environment variable: |
list of string |
|
TLS key managers provider type. Available providers:
Environment variable: |
|
|
Path to the key store. Environment variable: |
path |
|
Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types. Environment variable: |
string |
|
Key store password Environment variable: |
string |
|
TLS trust managers provider type. Available providers:
Environment variable: |
|
|
Path to the key store. Environment variable: |
path |
|
Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types. Environment variable: |
string |
|
Key store password Environment variable: |
string |
|
Enable the custom configuration of the Netty event loop group. This option is only available when using Quarkus 3.x. With Quarkus 4, the AWS SDK always uses its own event loop. Environment variable: |
boolean |
|
Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the Environment variable: |
int |
|
The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to Environment variable: |
string |
|
Whether the default thread pool should be used to complete the futures returned from the HTTP client request. When disabled, HTTP attempt completion is not offloaded to the Quarkus worker pool. Vert.x context propagation, when applicable, independently dispatches the final result to a Vert.x event loop. Environment variable: |
boolean |
|
Whether the final results of async calls made from a Vert.x event loop are delivered on the caller’s context. When enabled, a call made from a Vert.x event loop is completed on the caller’s context. Calls made from workers (including When disabled, the SDK completion behavior is kept, including the This only applies when the Quarkus Vert.x extension is present. Environment variable: |
boolean |
|
|
About the Duration format
To write duration values, use the standard You can also use a simplified format, starting with a number:
In other cases, the simplified format is translated to the
|
|
About the MemorySize format
A size configuration option recognizes strings in this format (shown as a regular expression): If no suffix is given, assume bytes. |