This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new ed2f2f5297f6 CAMEL-26367: camel-aws - give each client its own
DefaultCredentialsProvider instead of the JVM-wide singleton (#28625)
ed2f2f5297f6 is described below
commit ed2f2f5297f65fea5b40b77d493bde75b619f1f0
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Oct 28 20:25:03 2026 +0100
CAMEL-26367: camel-aws - give each client its own
DefaultCredentialsProvider instead of the JVM-wide singleton (#28625)
Co-Authored-By: Claude <[email protected]>
---
.../component/aws/common/AwsClientBuilderUtil.java | 4 +-
.../camel/component/aws2/s3/AWS2S3Producer.java | 35 +++---
.../s3/AWS2S3ProducerPresignerCredentialsTest.java | 140 +++++++++++++++++++++
.../component/aws2/sqs/SqsClientFactoryTest.java | 21 ++++
4 files changed, 185 insertions(+), 15 deletions(-)
diff --git
a/components/camel-aws/camel-aws-common/src/main/java/org/apache/camel/component/aws/common/AwsClientBuilderUtil.java
b/components/camel-aws/camel-aws-common/src/main/java/org/apache/camel/component/aws/common/AwsClientBuilderUtil.java
index ff002c7985f7..b2f678d8a1cf 100644
---
a/components/camel-aws/camel-aws-common/src/main/java/org/apache/camel/component/aws/common/AwsClientBuilderUtil.java
+++
b/components/camel-aws/camel-aws-common/src/main/java/org/apache/camel/component/aws/common/AwsClientBuilderUtil.java
@@ -258,7 +258,9 @@ public final class AwsClientBuilderUtil {
// Priority 1: Default credentials provider (IAM roles, env vars, etc.)
if (config.isUseDefaultCredentialsProvider()) {
LOG.trace("Using default credentials provider (IAM)");
- return DefaultCredentialsProvider.create();
+ // a new instance for each client: closing a client closes its
credentials provider, and
+ // DefaultCredentialsProvider.create() returns a singleton shared
by every client in the JVM
+ return DefaultCredentialsProvider.builder().build();
}
// Priority 2: Profile credentials provider
diff --git
a/components/camel-aws/camel-aws2-s3/src/main/java/org/apache/camel/component/aws2/s3/AWS2S3Producer.java
b/components/camel-aws/camel-aws2-s3/src/main/java/org/apache/camel/component/aws2/s3/AWS2S3Producer.java
index ae8f0d3fb41e..901aff204ff9 100644
---
a/components/camel-aws/camel-aws2-s3/src/main/java/org/apache/camel/component/aws2/s3/AWS2S3Producer.java
+++
b/components/camel-aws/camel-aws2-s3/src/main/java/org/apache/camel/component/aws2/s3/AWS2S3Producer.java
@@ -833,7 +833,6 @@ public class AWS2S3Producer extends DefaultProducer {
} else {
milliSeconds += 1000 * 60 * 60;
}
- S3Presigner presigner = getOrCreatePresigner();
GetObjectRequest getObjectRequest = GetObjectRequest.builder()
.bucket(bucketName)
@@ -845,7 +844,15 @@ public class AWS2S3Producer extends DefaultProducer {
.getObjectRequest(getObjectRequest)
.build();
- PresignedGetObjectRequest presignedGetObjectRequest =
presigner.presignGetObject(getObjectPresignRequest);
+ S3Presigner presigner = getOrCreatePresigner();
+ PresignedGetObjectRequest presignedGetObjectRequest;
+ try {
+ presignedGetObjectRequest =
presigner.presignGetObject(getObjectPresignRequest);
+ } finally {
+ if
(ObjectHelper.isEmpty(getConfiguration().getAmazonS3Presigner())) {
+ presigner.close();
+ }
+ }
Message message = getMessageForResponse(exchange);
message.setBody(presignedGetObjectRequest.url().toString());
@@ -862,10 +869,6 @@ public class AWS2S3Producer extends DefaultProducer {
message.setHeader(AWS2S3Constants.DOWNLOAD_LINK_SIGNED_PAYLOAD,
payload.asUtf8String());
});
}
-
- if (ObjectHelper.isEmpty(getConfiguration().getAmazonS3Presigner())) {
- presigner.close();
- }
}
private void headBucket(S3Client s3Client, Exchange exchange) {
@@ -1163,7 +1166,6 @@ public class AWS2S3Producer extends DefaultProducer {
} else {
milliSeconds += 1000 * 60 * 60;
}
- S3Presigner presigner = getOrCreatePresigner();
PutObjectRequest putObjectRequest = PutObjectRequest.builder()
.bucket(bucketName)
@@ -1176,8 +1178,15 @@ public class AWS2S3Producer extends DefaultProducer {
.putObjectRequest(putObjectRequest)
.build();
- PresignedPutObjectRequest presignedPutObjectRequest
- = presigner.presignPutObject(putObjectPresignRequest);
+ S3Presigner presigner = getOrCreatePresigner();
+ PresignedPutObjectRequest presignedPutObjectRequest;
+ try {
+ presignedPutObjectRequest =
presigner.presignPutObject(putObjectPresignRequest);
+ } finally {
+ if
(ObjectHelper.isEmpty(getConfiguration().getAmazonS3Presigner())) {
+ presigner.close();
+ }
+ }
Message message = getMessageForResponse(exchange);
message.setBody(presignedPutObjectRequest.url().toString());
@@ -1194,10 +1203,6 @@ public class AWS2S3Producer extends DefaultProducer {
message.setHeader(AWS2S3Constants.UPLOAD_LINK_SIGNED_PAYLOAD,
payload.asUtf8String());
});
}
-
- if (ObjectHelper.isEmpty(getConfiguration().getAmazonS3Presigner())) {
- presigner.close();
- }
}
private S3Presigner getOrCreatePresigner() {
@@ -1207,7 +1212,9 @@ public class AWS2S3Producer extends DefaultProducer {
S3Presigner.Builder builder = S3Presigner.builder();
if (getConfiguration().isUseDefaultCredentialsProvider()) {
- builder.credentialsProvider(DefaultCredentialsProvider.create());
+ // a new instance for each presigner: closing the presigner closes
its credentials provider, and
+ // DefaultCredentialsProvider.create() returns a singleton shared
by every client in the JVM
+
builder.credentialsProvider(DefaultCredentialsProvider.builder().build());
} else if (getConfiguration().isUseProfileCredentialsProvider()) {
builder.credentialsProvider(
ProfileCredentialsProvider.create(getConfiguration().getProfileCredentialsName()));
diff --git
a/components/camel-aws/camel-aws2-s3/src/test/java/org/apache/camel/component/aws2/s3/AWS2S3ProducerPresignerCredentialsTest.java
b/components/camel-aws/camel-aws2-s3/src/test/java/org/apache/camel/component/aws2/s3/AWS2S3ProducerPresignerCredentialsTest.java
new file mode 100644
index 000000000000..d94028939b8e
--- /dev/null
+++
b/components/camel-aws/camel-aws2-s3/src/test/java/org/apache/camel/component/aws2/s3/AWS2S3ProducerPresignerCredentialsTest.java
@@ -0,0 +1,140 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.aws2.s3;
+
+import java.net.URI;
+import java.util.List;
+
+import org.apache.camel.Exchange;
+import org.apache.camel.impl.DefaultCamelContext;
+import org.apache.camel.support.DefaultExchange;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.MockedStatic;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
+import software.amazon.awssdk.core.exception.SdkClientException;
+import software.amazon.awssdk.services.s3.presigner.S3Presigner;
+import
software.amazon.awssdk.services.s3.presigner.model.GetObjectPresignRequest;
+import
software.amazon.awssdk.services.s3.presigner.model.PresignedGetObjectRequest;
+import
software.amazon.awssdk.services.s3.presigner.model.PutObjectPresignRequest;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.RETURNS_SELF;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+/**
+ * Tests the presigners that the producer creates for download and upload
links. The producer closes such a presigner
+ * after each use, and closing the presigner closes its credentials provider,
so each presigner gets its own default
+ * credentials provider (a provider shared with other clients would break
them), and the presigner is closed also when
+ * presigning fails (its credentials provider would leak otherwise).
+ */
+class AWS2S3ProducerPresignerCredentialsTest {
+
+ private final DefaultCamelContext camelContext = new DefaultCamelContext();
+ private final AWS2S3Configuration configuration =
mock(AWS2S3Configuration.class);
+ private final S3Presigner presigner = mock(S3Presigner.class);
+ private final S3Presigner.Builder presignerBuilder =
mock(S3Presigner.Builder.class, RETURNS_SELF);
+ private final SdkClientException failure =
SdkClientException.create("Unable to load credentials");
+
+ @BeforeEach
+ void setUp() {
+ when(configuration.getBucketName()).thenReturn("test-bucket");
+ when(configuration.getKeyName()).thenReturn("a.txt");
+ when(configuration.getRegion()).thenReturn("eu-west-1");
+ when(configuration.isUseDefaultCredentialsProvider()).thenReturn(true);
+ when(presignerBuilder.build()).thenReturn(presigner);
+ }
+
+ @Test
+ void eachDownloadLinkUsesItsOwnDefaultCredentialsProvider() throws
Exception {
+ PresignedGetObjectRequest presignedRequest =
mock(PresignedGetObjectRequest.class);
+
when(presignedRequest.url()).thenReturn(URI.create("https://test-bucket.s3.eu-west-1.amazonaws.com/a.txt";).toURL());
+ when(presignedRequest.isBrowserExecutable()).thenReturn(true);
+
when(presigner.presignGetObject(any(GetObjectPresignRequest.class))).thenReturn(presignedRequest);
+
+ AWS2S3Producer producer =
createProducer(AWS2S3Operations.createDownloadLink);
+ try (MockedStatic<S3Presigner> presigners =
mockStatic(S3Presigner.class)) {
+ presigners.when(S3Presigner::builder).thenReturn(presignerBuilder);
+
+ producer.process(new DefaultExchange(camelContext));
+ producer.process(new DefaultExchange(camelContext));
+ }
+
+ ArgumentCaptor<AwsCredentialsProvider> credentialsProviders =
ArgumentCaptor.forClass(AwsCredentialsProvider.class);
+ verify(presignerBuilder,
times(2)).credentialsProvider(credentialsProviders.capture());
+ List<AwsCredentialsProvider> providers =
credentialsProviders.getAllValues();
+ assertInstanceOf(DefaultCredentialsProvider.class, providers.get(0));
+ assertNotSame(providers.get(0), providers.get(1));
+ // each presigner is closed after use, and its credentials provider
with it
+ verify(presigner, times(2)).close();
+ }
+
+ @Test
+ void presignerIsClosedWhenPresigningTheDownloadLinkFails() {
+
when(presigner.presignGetObject(any(GetObjectPresignRequest.class))).thenThrow(failure);
+
+ assertSame(failure,
processAndExpectFailure(AWS2S3Operations.createDownloadLink));
+ verify(presigner).close();
+ }
+
+ @Test
+ void presignerIsClosedWhenPresigningTheUploadLinkFails() {
+
when(presigner.presignPutObject(any(PutObjectPresignRequest.class))).thenThrow(failure);
+
+ assertSame(failure,
processAndExpectFailure(AWS2S3Operations.createUploadLink));
+ verify(presigner).close();
+ }
+
+ @Test
+ void presignerOfTheConfigurationIsNotClosedWhenPresigningFails() {
+ when(configuration.getAmazonS3Presigner()).thenReturn(presigner);
+
when(presigner.presignGetObject(any(GetObjectPresignRequest.class))).thenThrow(failure);
+
+ assertSame(failure,
processAndExpectFailure(AWS2S3Operations.createDownloadLink));
+ // the presigner belongs to the user, who closes it
+ verify(presigner, never()).close();
+ }
+
+ private AWS2S3Producer createProducer(AWS2S3Operations operation) {
+ when(configuration.getOperation()).thenReturn(operation);
+ AWS2S3Endpoint endpoint = mock(AWS2S3Endpoint.class);
+ when(endpoint.getConfiguration()).thenReturn(configuration);
+ when(endpoint.getCamelContext()).thenReturn(camelContext);
+ return new AWS2S3Producer(endpoint);
+ }
+
+ private SdkClientException processAndExpectFailure(AWS2S3Operations
operation) {
+ AWS2S3Producer producer = createProducer(operation);
+ Exchange exchange = new DefaultExchange(camelContext);
+ try (MockedStatic<S3Presigner> presigners =
mockStatic(S3Presigner.class)) {
+ presigners.when(S3Presigner::builder).thenReturn(presignerBuilder);
+
+ return assertThrows(SdkClientException.class, () ->
producer.process(exchange));
+ }
+ }
+}
diff --git
a/components/camel-aws/camel-aws2-sqs/src/test/java/org/apache/camel/component/aws2/sqs/SqsClientFactoryTest.java
b/components/camel-aws/camel-aws2-sqs/src/test/java/org/apache/camel/component/aws2/sqs/SqsClientFactoryTest.java
index a42c54b1e30e..01e3ec843de0 100644
---
a/components/camel-aws/camel-aws2-sqs/src/test/java/org/apache/camel/component/aws2/sqs/SqsClientFactoryTest.java
+++
b/components/camel-aws/camel-aws2-sqs/src/test/java/org/apache/camel/component/aws2/sqs/SqsClientFactoryTest.java
@@ -18,9 +18,13 @@ package org.apache.camel.component.aws2.sqs;
import org.apache.camel.component.aws2.sqs.client.Sqs2ClientFactory;
import org.junit.jupiter.api.Test;
+import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
+import software.amazon.awssdk.identity.spi.IdentityProvider;
import software.amazon.awssdk.services.sqs.SqsClient;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
public class SqsClientFactoryTest {
@@ -34,6 +38,23 @@ public class SqsClientFactoryTest {
sqsClient.close();
}
+ @Test
+ void getSqsClientsWithDefaultCredentialsDoNotShareTheCredentialsProvider()
{
+ Sqs2Configuration sqsConfiguration = new Sqs2Configuration();
+ sqsConfiguration.setUseDefaultCredentialsProvider(true);
+ sqsConfiguration.setRegion("eu-west-1");
+ SqsClient first = Sqs2ClientFactory.getSqsClient(sqsConfiguration);
+ SqsClient second = Sqs2ClientFactory.getSqsClient(sqsConfiguration);
+ IdentityProvider<?> firstProvider =
first.serviceClientConfiguration().credentialsProvider();
+ IdentityProvider<?> secondProvider =
second.serviceClientConfiguration().credentialsProvider();
+ // a client closes its credentials provider when it is closed, so a
provider shared by several
+ // clients would break all of them as soon as one endpoint is stopped
+ assertInstanceOf(DefaultCredentialsProvider.class, firstProvider);
+ assertNotSame(firstProvider, secondProvider);
+ first.close();
+ second.close();
+ }
+
@Test
public void getSqsClientWithStaticCredentials() {
Sqs2Configuration sqsConfiguration = new Sqs2Configuration();
