From 819c5f84b9b55ecce08b7e35fb81a3bf721e5fbd Mon Sep 17 00:00:00 2001 From: labkey-jeckels Date: Mon, 10 Aug 2026 18:55:20 -0700 Subject: [PATCH] Publish labkey.aws.ssm.enabled for explicit SSM opt-in The post-processor already decides whether the operator opted into AWS config, but never told the CloudServices module, which re-derived intent from whatever AWS credentials happened to resolve. Publishing that decision alongside the region and secrets prefix lets SsmSecretProvider gate on it instead. Cloud deployments are unaffected: the flag is published whenever context.awsParameterStore.prefix or context.awsParameterStore.secretsPrefix is configured. --- .../AwsParameterStoreEnvironmentPostProcessor.java | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java b/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java index dcb4bdbf1d..d6c21ef7ee 100644 --- a/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java +++ b/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java @@ -4,8 +4,8 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; import org.jspecify.annotations.NonNull; -import org.springframework.boot.SpringApplication; import org.springframework.boot.EnvironmentPostProcessor; +import org.springframework.boot.SpringApplication; import org.springframework.core.Ordered; import org.springframework.core.env.ConfigurableEnvironment; import org.springframework.core.env.EnumerablePropertySource; @@ -58,8 +58,9 @@ *

SSM initialization also runs when {@code context.awsParameterStore.prefix} is explicitly * configured (even with no {@code ssm:} values), so that the CloudServices module can create its * own {@code SsmClient} for on-demand {@code SecretService} lookups. When active, this processor - * publishes {@code labkey.aws.ssm.region} and optionally {@code labkey.aws.ssm.secretsPrefix} as - * JVM system properties without any cross-classloader reflection. + * publishes {@code labkey.aws.ssm.enabled}, {@code labkey.aws.ssm.region}, and + * {@code labkey.aws.ssm.secretsPrefix} as JVM system properties without any cross-classloader + * reflection. * *

{@code context.awsParameterStore.secretsPrefix} controls where {@code SecretProperty} * values are looked up at runtime. A relative value (no leading {@code /}) is resolved against @@ -146,7 +147,9 @@ public void postProcessEnvironment(ConfigurableEnvironment environment, SpringAp Region region = resolveRegion(regionOverride); // Publish config as system properties so the CloudServices module can create its own - // SsmClient for on-demand SecretProperty lookups via SecretService at runtime. + // SsmClient for on-demand SecretProperty lookups via SecretService at runtime. The enabled + // flag carries the hasExplicitConfig decision above for use in SsmSecretProvider + System.setProperty("labkey.aws.ssm.enabled", "true"); System.setProperty("labkey.aws.ssm.region", region.id()); System.setProperty("labkey.aws.ssm.secretsPrefix", secretsPrefix);