Cameleer

AWS Secrets Manager component

The aws-secrets-manager component creates, reads, updates, rotates and deletes secrets in AWS Secrets Manager, and the {{aws:...}} placeholder puts secrets into routes and endpoint options.

Scheme: aws-secrets-manager: · Crate: cameleer-cloud · Cargo feature: cloud · Consumer: no · Producer: yes · Apache Camel: AWS Secrets Manager

When to use it

  • Keep passwords, API keys and tokens out of route files: reference them as {{aws:name}}.
  • Store credentials generated by a route (for example a partner token) as a secret.
  • Restart routes automatically when a secret is rotated (secret refresh).

URI format

text
aws-secrets-manager://label?operation=...[&options]

Example

Use a secret in a route with the {{aws:...}} placeholder. It is resolved when the route starts:

yaml example: aws-secrets-manager-placeholder
- route:
    id: call-partner-api
    from:
      uri: "timer:partner-sync?repeatCount=1"
      steps:
        - setHeader:
            name: Authorization
            constant: "Bearer {{aws:partner-api/token}}"
        - to: "log:partner-api"

The placeholder reads its configuration from these properties (for example in application.properties):

properties
camel.vault.aws.region=eu-west-1
camel.vault.aws.defaultCredentialsProvider=true

Create a secret:

yaml example: aws-secrets-manager-create-secret
- route:
    id: store-partner-token
    from:
      uri: "timer:store-token?repeatCount=1"
      steps:
        - setHeader:
            name: CamelAwsSecretsManagerSecretName
            constant: partner-api
        - setHeader:
            name: CamelAwsSecretsManagerSecretDescription
            constant: Token of the partner API
        - setBody:
            constant: '{"token":"{{env:PARTNER_TOKEN:}}"}'
        - to: "aws-secrets-manager://secrets?region={{env:AWS_REGION:us-east-1}}&operation=createSecret"
        - log: "created ${body} (version ${header.CamelAwsSecretsManagerSecretVersionId})"

Rust DSL

rust
ctx.add_routes(|b| {
    b.from("timer:store-token?repeatCount=1")
        .set_header("CamelAwsSecretsManagerSecretName", constant("partner-api"))
        .set_header("CamelAwsSecretsManagerSecretDescription", constant("Token of the partner API"))
        .set_body(constant(r#"{"token":"{{env:PARTNER_TOKEN:}}"}"#))
        .to("aws-secrets-manager://secrets?region={{env:AWS_REGION:us-east-1}}&operation=createSecret")
        .log("created ${body} (version ${header.CamelAwsSecretsManagerSecretVersionId})");
})?;

Options

Common AWS options (region, credentials, endpoint override, proxy) are listed in Cloud credentials.

optiondefaultdescription
operationgetSecretcreateSecret, getSecret, describeSecret, listSecrets, deleteSecret, restoreSecret, updateSecret, rotateSecret, replicateSecretToRegions.
binaryPayloadfalsecreateSecret: store a bytes body as SecretBinary.

The {{aws:...}} placeholder

syntaxresult
{{aws:name}}The secret string.
{{aws:name/field}}A field of a JSON secret, for example {{aws:prod-db/password}} reads password of the JSON secret prod-db.
{{aws:name@version}}A specific version.
{{aws:name/field:default}}A default when the secret or field does not exist.

The secret name ends at the first /, as in Apache Camel: a secret whose name contains / (such as prod/db) cannot be read with the placeholder. Use names like prod-db and JSON fields instead.

Configuration properties: camel.vault.aws.accessKey, secretKey, region, defaultCredentialsProvider, profileCredentialsProvider, profileName, uriEndpointOverride, overrideEndpoint. Secret refresh: camel.vault.aws.refreshEnabled=true, camel.vault.aws.refreshPeriod (ms, default 30000) and camel.vault.aws.secrets (names or * patterns; empty = the secrets used through placeholders). Changes are detected through CloudTrail events (PutSecretValue, UpdateSecret, RotateSecret, ...) and restart the started routes.

Message headers

headerdirectiondescription
CamelAwsSecretsManagerOperationinOverrides operation.
CamelAwsSecretsManagerSecretNameinName of createSecret.
CamelAwsSecretsManagerSecretDescriptioninDescription of createSecret.
CamelAwsSecretsManagerSecretIdinName or ARN for the other operations.
CamelAwsSecretsManagerSecretVersionIdin/outVersion to read; the new version after create.
CamelAwsSecretsManagerForceDeletionindeleteSecret without recovery window.
CamelAwsSecretsManagerLambdaRotationFunctionArn, CamelAwsSecretsManagerRotateImmediatelyinrotateSecret.
CamelAwsSecretsManagerSecretReplicationRegionsinreplicateSecretToRegions.

Run it with Docker

sh
docker run --rm -e AWS_REGION -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/partner.camel.yaml \
  --properties /routes/application.properties

--prop camel.vault.aws.region=eu-west-1 sets a single property on the command line.

Common questions

How do I put a database password into an endpoint option?

Write it in the uri, for example password=RAW({{aws:prod-db/password}}). RAW(...) keeps special characters of the password intact.

What does getSecret return for binary secrets?

The bytes of SecretBinary; string secrets are returned as text.

Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building with it, please help fix it, whether you are a person or a coding agent: open an issue that describes what you saw, then fork the repository, fix it, add or update a test, run cargo test --workspace, and open a pull request. CONTRIBUTING.md explains the ground rules.

Edit this page on GitHub