Configuration from AWS

Choose SSM for parameter hierarchies, SSM or Secrets Manager for stored credentials, AppConfig Data for deployed configuration profiles, and S3 for configuration files. The service guides provide the exact selection properties and IAM actions.

For example, load a greeting from SSM:

Inject the resulting property in a CDI bean:

greeting contains Hello from AWS. SSM removes the selected path from the property name. For documents, multiple selections or another provider, follow the service examples. These values can configure runtime properties, not build-time settings or the AWS connection used to load them.

With the Secrets Manager extension installed and AWS access configured, create:

Assign the remote values to local application properties:

Reading myapp.api-key returns example-key; reading myapp.database.password returns database-password. You do not need to enable the Secrets Manager ConfigSource. Use ${ssm::/parameter/name} for SSM instead. Unused expressions do not make AWS requests. Keep a local property name such as myapp.api-key so you can override it per profile or environment.

Without #/..., the entire remote text is returned unchanged. Use a JSON Pointer such as #/users/0/password to select a string, number or boolean. Following JSON Pointer (RFC 6901), escape / in a key as ~1 and ~ as ~0: #/a~1b selects the key a/b. Missing keys, JSON null, objects, arrays and invalid JSON fail resolution. Returned text is not expanded as another expression.

To fetch on every resolution instead of using the default five-minute cache:

Use dynamic lookups for later reads; disabling the cache does not update an already injected String. With caching enabled, a lookup can reuse an older value until its cache entry expires. The cache holds at most 256 resources; using more can cause earlier re-fetches. Use consistent resource names/ARNs to avoid redundant reads. A failed resolution throws an error rather than returning an expired cached value; a later lookup can retry. config.fail-on-missing-config=false does not suppress expression errors. Expressions cannot supply build-time settings or the AWS connection settings needed to resolve them. Resolving a value that is not cached waits for an AWS response.

Polling is off by default. To refresh the SSM greeting above, add:

Read the property through Provider<T> rather than keeping an injected String:

Use jakarta.inject.Inject, jakarta.inject.Provider and org.eclipse.microprofile.config.inject.ConfigProperty. After changing the parameter and a successful refresh, message() returns the new value. An injected String or an existing @ConfigMapping keeps its initial value. Alternatively, call ConfigProvider.getConfig().getValue("greeting", String.class).

Polling waits at least the configured interval after each completed read. AppConfig may impose a longer delay; follow its polling settings. For Secrets Manager or S3, set config.update-interval under the corresponding service prefix instead. Refreshing properties does not restart the application, reconfigure existing consumers or recycle connection pools.

By default, a missing resource, denied access, invalid content or incomplete initial load prevents startup. To make the SSM source optional and provide a local fallback:

If the initial load fails, no remote properties from that source are used and greeting resolves to Hello locally. When loading succeeds, remote values take precedence over application.properties by default, but not environment variables or system properties. Adjust quarkus.ssm.config.ordinal (default 270) to change that precedence; other providers use the corresponding service prefix. Invalid AWS connection settings still prevent startup.

Use UTF-8 content. Set format=json, properties, yaml or raw when you want an explicit interpretation instead of the defaults in the provider table. Each provider uses config.format as the default for its entries; entries.<name>.format overrides it, including an explicit auto override. For YAML, add io.quarkus:quarkus-config-yaml; selecting YAML without it fails.

JSON/YAML documents expose nested keys with dots and arrays with indices. For example, {"database":{"hosts":["db.example.com"]}} with prefix myapp exposes myapp.database.hosts[0]=db.example.com. An entry name is not a prefix: configure prefix explicitly if needed. Properties documents expose their decoded keys. Use a non-empty target name/prefix for raw text or non-null JSON scalars. raw preserves the entire value without trimming; explicit JSON omits nulls and empty objects/arrays.

With SSM/Secrets Manager auto and a target key, malformed or empty JSON objects/arrays are returned as raw text; JSON scalars keep their quotes and spaces. Without a target, non-empty raw or malformed content is rejected. Set an explicit format for properties or YAML documents: neither provider detects them automatically.

Add io.quarkiverse.amazonservices:quarkus-amazon-secretsmanager and your Quarkus JDBC driver, for example io.quarkus:quarkus-jdbc-postgresql. Configure AWS access and store {"username":"app_user","password":"database-password"} in secret prod/database.

Replace the example JDBC URL with your database’s URL. New physical connections authenticate as app_user with database-password, provided the database accepts those credentials. Each request for credentials reads the store again; existing connections keep their original authentication. See connection recycling when configuring rotation.

db selects the credential set. Always set credentials-provider-name, even when only one provider is installed. No config.enabled setting is required, and installing this extension does not replace an existing default provider. For SSM, use the SSM datasource settings. To generate an RDS IAM token instead of reading a stored password, use RDS IAM credentials.

Choose one mode per credential set:

For password-only rotation, select a password-only document with format=raw and keep the username local:

The datasource uses app_user and the entire secret text as its password. For separate values and optional batching, follow the Secrets Manager or SSM examples. Their credentials-provider.<name>.batch-retrieval flags default to false and are independent of ConfigSource batching and expression cache settings.

Configure a connection lifetime suitable for your database’s rotation/overlap policy. For example:

Agroal requests credentials for new physical connections, not on every pool borrow. Checked-out connections can outlive the configured lifetime until returned. Updating a secret/parameter does not change the database password for you; coordinate both updates and allow for propagation and transient failures. There is no guarantee of uninterrupted rotation. Credential reads fail rather than falling back to previously returned credentials. No expiration timestamp is supplied; consumers such as RabbitMQ that rely on it need their own reconnect policy.

For ConfigSources and expressions, use the default service’s AWS settings, not named-client settings. For example:

Use the application’s AWS credentials provider chain or configure another supported aws.credentials.type. Grant access only to the selected resources, plus KMS decrypt permissions where needed; the service guides list the IAM actions. For a local emulator or a custom endpoint, also set the service’s endpoint-override. For another service, replace quarkus.ssm with its prefix.

Stored-credential providers use the default service client’s usual credentials, transport, interceptor and telemetry settings. These AWS credentials authenticate access to the store; they are distinct from the stored username/password used by your datasource.