Secure Access to AWS Services Without Hardcoded Keys, and Secret Storage/Rotation

// WRONG: hardcoded keys -- if this file leaks, the attacker has full access
package com.bank.service;

import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
import software.amazon.awssdk.services.s3.S3Client;

public class InsecureClient {
    // Never do this in production
    private final S3Client s3 = S3Client.builder()
        .credentialsProvider(StaticCredentialsProvider.create(
            AwsBasicCredentials.create("AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG")
        )).build();
}

// CORRECT: no keys in code. The SDK picks up role credentials automatically.
package com.bank.service;

import software.amazon.awssdk.services.s3.S3Client;

public class SecureClient {
    // Default provider chain: instance profile -> task role -> env vars -> ...
    private final S3Client s3 = S3Client.create();

    public void uploadStatement(String accountId) {
        // Uses temporary, rotating credentials from the attached role
        System.out.println("Uploading with role credentials for: " + accountId);
    }
}

// ECS task definition with both roles (conceptual)
package com.bank.infrastructure;

public class EcsTaskConfig {
    // Task role: what the application can do (S3, DynamoDB, SQS)
    private final String taskRoleArn = "arn:aws:iam::111122223333:role/transfer-task-role";
    // Execution role: what ECS agent can do (ECR pull, CloudWatch logs)
    private final String executionRoleArn = "arn:aws:iam::111122223333:role/ecs-exec-role";

    public void printRoleExplanation() {
        System.out.println("Task role: authorizes YOUR application's AWS calls");
        System.out.println("Execution role: authorizes the ECS AGENT's housekeeping");
    }
}

// Lambda handler using role-based credentials
package com.bank.lambda;

import software.amazon.awssdk.services.dynamodb.DynamoDbClient;
import software.amazon.awssdk.services.dynamodb.model.*;
import java.util.Map;

public class FeeCalculatorHandler {
    // SDK picks up Lambda execution role credentials automatically
    private final DynamoDbClient dynamo = DynamoDbClient.create();

    public String handleRequest(Map<String, Object> event, Object context) {
        dynamo.putItem(PutItemRequest.builder()
            .tableName("nbi-fee-records")
            .item(Map.of("txnId", AttributeValue.fromS(event.get("txnId").toString())))
            .build());
        return "Fee recorded";
    }
}

// Fetching a rotated secret at runtime
package com.bank.service;

import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;

public class SecretFetcher {
    private final SecretsManagerClient sm = SecretsManagerClient.create();

    public String getDatabasePassword() {
        String secretJson = sm.getSecretValue(
            GetSecretValueRequest.builder()
                .secretId("prod/nbi-ledger/credentials")
                .build()
        ).secretString();
        // Parse JSON to extract username and password
        System.out.println("Fetched rotated credentials from Secrets Manager");
        return secretJson;
    }
}

// Fetching a config value from Parameter Store
package com.bank.service;

import software.amazon.awssdk.services.ssm.SsmClient;
import software.amazon.awssdk.services.ssm.model.GetParameterRequest;

public class ConfigFetcher {
    private final SsmClient ssm = SsmClient.create();

    public String getConfig(String paramName) {
        return ssm.getParameter(
            GetParameterRequest.builder()
                .name(paramName)
                .withDecryption(true)
                .build()
        ).parameter().value();
    }
}

// Wrong: secret baked into environment variable in source control
// docker-compose.yml:
//   environment:
//     DB_PASSWORD: "MyS3cretPa$$word"   <-- committed to git!

// Correct: fetch at runtime, cache briefly, refresh on failure
package com.bank.service;

public class SecretCacheExample {
    private String cachedPassword;
    private long cacheExpiry;

    public String getPassword() {
        if (cachedPassword == null || System.currentTimeMillis() > cacheExpiry) {
            cachedPassword = new SecretFetcher().getDatabasePassword();
            cacheExpiry = System.currentTimeMillis() + 300_000; // 5 min cache
        }
        return cachedPassword;
    }

    public void onAuthFailure() {
        // Force refresh on auth failure (password may have rotated)
        cachedPassword = null;
    }
}