Never Hardcode a Password in Spring Boot Again !!
Stop hardcoding database passwords. See how Spring Boot fetches them from AWS Secrets Manager at startup, with an animated flow, code and a 4-step build.
Series: How to complete certification... (5 articles)
- …
- 3Never Hardcode a Password in Spring Boot Again !! This article
Level: Beginner  | Reading time: 6 minutes  | Stack: Spring Boot, AWS Secrets Manager, IAM
Your database password should never live in your code. Here is how a Spring Boot app can fetch it from AWS at startup instead, explained with a hotel key desk.
1. The Problem
Almost every first Spring Boot project has a file like this:
1
2
3
spring.datasource.url=jdbc:mysql://my-db.example.com:3306/pizza
spring.datasource.username=pizza_admin
spring.datasource.password=MyPassword123It works, and it is a trap. Imagine writing your room number and key code on the hotel door. That is what committing this file to GitHub does.
- It leaks. Once a password is in Git history, deleting the line does not remove it. Automated bots scan public repositories for exposed credentials.
- It is shared. The same password ends up in development, testing and production.
- It is hard to change. A new password means editing code, rebuilding and redeploying.
Key ideaDo not give the guest the key in advance. Let the guest collect it from the front desk when they arrive, and only if they can prove who they are.
2. The Cast
The hotel maps neatly onto AWS.
- Your Spring Boot app is the guest. It needs a key to enter.
- An IAM role is the guest's ID. It proves who is asking.
- AWS Secrets Manager is the key desk. It stores the password and hands it out only to approved guests.
- The database is the room. It stays locked until the key arrives.
The password is never in the code. It only exists in memory after the app has been approved.
3. One Startup, Step by Step
All of this happens in a moment while the app boots, before it opens its first connection to the database.
4. Build It in Four Steps
Step 1. Store the secret. In the AWS Console, open Secrets Manager and choose Store a new secret, then Other type of secret. Add two key/value pairs and name the secret pizza-shop/db. The equivalent JSON looks like this (use your real values, never these):
1
2
3
4
{
"DB_USERNAME": "pizza_admin",
"DB_PASSWORD": "change-me"
}Step 2. Add the dependency. Spring Cloud AWS 3.4.x matches Spring Boot 3.5.x, and 4.x matches Boot 4.x. Import the BOM, then add the starter:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.awspring.cloud</groupId>
<artifactId>spring-cloud-aws-dependencies</artifactId>
<version>3.4.2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependency>
<groupId>io.awspring.cloud</groupId>
<artifactId>spring-cloud-aws-starter-secrets-manager</artifactId>
</dependency>Step 3. Point Spring at the secret. In application.yml, import the secret and use its keys as placeholders:
1
2
3
4
5
6
7
8
9
10
11
spring:
config:
import: aws-secretsmanager:pizza-shop/db
cloud:
aws:
region:
static: us-east-1
datasource:
url: jdbc:mysql://my-db.example.com:3306/pizza
username: ${DB_USERNAME}
password: ${DB_PASSWORD}Use the region where you created the secret.
Step 4. Allow the app to read it. Attach this policy to the IAM role your app runs with. The trailing -* is needed because AWS adds a random suffix to every secret ARN:
1
2
3
4
5
6
7
8
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "secretsmanager:GetSecretValue",
"Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:pizza-shop/db-*"
}]
}Start the app. There is no password anywhere in your project.
5. Local Machine vs AWS
- On your laptop, sign in with the AWS CLI (for example aws configure sso) so the app can use your profile.
- On AWS, run the app with an IAM role, such as an EC2 instance role or an ECS task role. No access keys are needed.
- Never put AWS access keys in application.yml or commit them. That only moves the leak somewhere else.
6. Four Pitfalls to Avoid
- AccessDeniedException. Check that the policy resource ARN ends with -* and that the region in the ARN matches the secret.
- Secret not found. The name in spring.config.import must match the secret name exactly, in the same region.
- Version mismatch. Use the Spring Cloud AWS release that matches your Spring Boot version, or the app may fail at startup.
- Stale values after rotation. Secrets are read when the app starts, so restart the app after changing a password unless you set up reloading.
7. Secrets Manager or Parameter Store?
- Secrets Manager suits passwords and API keys. It supports automatic rotation and charges per secret per month, so check the current pricing page.
- Parameter Store suits plain configuration such as feature flags and URLs. Standard parameters have no additional charge.
Takeaway
Before committing a password, ask: is my code holding the key, or collecting it from the front desk? Collect it, and your app stays safer, easier to change and ready for real environments.
Let's Support Each Other
If this article helped you, please like it and leave a comment. I will do my best to return the favour on your articles and posts, though replies may take a little time.
We are all working towards the 21-badge milestone, and genuine engagement makes that easier for everyone. Please read each other's articles, leave meaningful comments, and vote for good Wishlist ideas. I only have 5 Wishlist votes per day, so I cannot vote for everyone.
Learn, Build, Share, Connect, Earn, Get Certified. If that goal resonates with you, a vote means a lot. Thank you, and good luck with your own AWS goals.
@lley_candy signing off :)
#springboot #java #aws-secrets-manager #backend #security #AWSStudentRewards #AWSBuilderCenter #AWSCommunity #CloudComputing #AWSCertification
Series: How to complete certification... (5 articles)
- …
- 3Never Hardcode a Password in Spring Boot Again !! This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article