Skip to content

Commit cf034e1

Browse files
MouhsinElmajdoubyMouhsinElmajdouby
committed
Add resource providers for AWS Parameter Store
1 parent ba2a981 commit cf034e1

22 files changed

+1295
-31
lines changed

‎ojdbc-provider-aws/README.md

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,22 @@ particular provider.
3030
<dl>
3131
<dt><a href="#aws-secrets-manager-username-provider">Secrets Manager Username Provider</a></dt>
3232
<dd>Provides a database username from AWS Secrets Manager</dd>
33+
<dt><a href="#aws-parameter-store-username-provider">Parameter Store Username Provider</a></dt>
34+
<dd>Provides a database username from AWS Parameter Store</dd>
3335
<dt><a href="#aws-secrets-manager-password-provider">Secrets Manager Password Provider</a></dt>
3436
<dd>Provides a database password from AWS Secrets Manager</dd>
37+
<dt><a href="#aws-parameter-store-password-provider">Parameter Store Password Provider</a></dt>
38+
<dd>Provides a database password from AWS Parameter Store</dd>
3539
<dt><a href="#aws-secrets-manager-connection-string-provider">Secrets Manager Connection String Provider</a></dt>
3640
<dd>Provides connection strings from a tnsnames.ora file stored in AWS Secrets Manager</dd>
41+
<dt><a href="#aws-parameter-store-connection-string-provider">Parameter Store Connection String Provider</a></dt>
42+
<dd>Provides connection strings from a tnsnames.ora file stored in AWS Parameter Store</dd>
3743
<dt><a href="#aws-secrets-manager-tcps-wallet-provider">Secrets Manager TCPS Wallet Provider</a></dt>
3844
<dd>Provides TCPS/TLS wallet from AWS Secrets Manager</dd>
3945
<dt><a href="#aws-secrets-manager-seps-wallet-provider">Secrets Manager SEPS Wallet Provider</a></dt>
4046
<dd>Provides SEPS (Secure External Password Store) wallet from AWS Secrets Manager</dd>
47+
<dt><a href="#aws-parameter-store-seps-wallet-provider">Parameter Store SEPS Wallet Provider</a></dt>
48+
<dd>Provides SEPS (Secure External Password Store) wallet from AWS Parameter Store</dd>
4149
<dt><a href="#common-parameters-for-resource-providers">Common Parameters for Resource Providers</a></dt>
4250
<dd>Common parameters supported by the resource providers</dd>
4351
</dl>
@@ -330,6 +338,37 @@ An example of a
330338
that configures this provider can be found in
331339
[example-vault.properties](example-aws-secretsmanager.properties).
332340

341+
## AWS Parameter Store Username Provider
342+
343+
The Parameter Store Username Provider provides Oracle JDBC with a database username stored in AWS Systems Manager Parameter Store.
344+
This is a [Resource Provider](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/spi/OracleResourceProvider.html) identified
345+
by the name `ojdbc-provider-aws-parameter-store-username`.
346+
347+
In addition to the set of [common parameters](#common-parameters-for-resource-providers),
348+
this provider also supports the parameters listed below.
349+
350+
<table>
351+
<thead><tr>
352+
<th>Parameter Name</th>
353+
<th>Description</th>
354+
<th>Accepted Values</th>
355+
<th>Default Value</th>
356+
</tr></thead>
357+
<tbody>
358+
<tr>
359+
<td><code>parameterName</code></td>
360+
<td>The name of a parameter in AWS Parameter Store.</td>
361+
<td>Any valid parameter name.</td>
362+
<td><i>No default value. A value must be configured for this parameter.</i></td>
363+
</tr>
364+
</tbody>
365+
</table>
366+
367+
An example of a
368+
[connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE)
369+
that configures this provider can be found in
370+
[example-vault.properties](example-aws-parameterstore.properties).
371+
333372
## AWS Secrets Manager Password Provider
334373
The Secrets Manager Password Provider provides Oracle JDBC with a database password
335374
that is managed by the AWS Secrets Manager service. This is a [Resource Provider](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/spi/OracleResourceProvider.html)
@@ -380,6 +419,36 @@ An example of a
380419
that configures this provider can be found in
381420
[example-vault.properties](example-aws-secretsmanager.properties).
382421

422+
## AWS Parameter Store Password Provider
423+
424+
The Parameter Store Password Provider provides Oracle JDBC with a database password stored in AWS Systems Manager Parameter Store.
425+
This is a [Resource Provider](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/spi/OracleResourceProvider.html) identified
426+
by the name `ojdbc-provider-aws-parameter-store-password`.
427+
428+
In addition to the set of [common parameters](#common-parameters-for-resource-providers),
429+
this provider also supports the parameters listed below.
430+
<table>
431+
<thead><tr>
432+
<th>Parameter Name</th>
433+
<th>Description</th>
434+
<th>Accepted Values</th>
435+
<th>Default Value</th>
436+
</tr></thead>
437+
<tbody>
438+
<tr>
439+
<td><code>parameterName</code></td>
440+
<td>The name of a parameter in AWS Parameter Store.</td>
441+
<td>Any valid parameter name.</td>
442+
<td><i>No default value. A value must be configured for this parameter.</i></td>
443+
</tr>
444+
</tbody>
445+
</table>
446+
447+
An example of a
448+
[connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE)
449+
that configures this provider can be found in
450+
[example-vault.properties](example-aws-parameterstore.properties).
451+
383452
## AWS Secrets Manager TCPS Wallet Provider
384453

385454
The TCPS Wallet Provider provides Oracle JDBC with keys and certificates managed by the AWS Secrets Manager service
@@ -542,6 +611,49 @@ The name of the key to extract from the secret when it is stored as a set of key
542611

543612
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-secrets-manager-wallet.properties](example-aws-secretsmanager-wallet.properties.properties).
544613

614+
## AWS Parameter Store SEPS Wallet Provider
615+
616+
The SEPS Wallet Provider retrieves a SEPS wallet stored in AWS Parameter Store.
617+
This is a [Resource Provider](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/spi/OracleResourceProvider.html) identified
618+
by the name `ojdbc-provider-aws-parameter-store-seps`.
619+
620+
This provider works identically to the [AWS Secrets Manager SEPS Wallet Provider](#aws-secrets-manager-seps-wallet-provider)
621+
except that it uses a Parameter Store parameter instead of a Secrets Manager secret.
622+
623+
In addition to the set of [common parameters](#common-parameters-for-resource-providers), this provider also supports the parameters listed below.
624+
625+
<table>
626+
<thead><tr>
627+
<th>Parameter Name</th>
628+
<th>Description</th>
629+
<th>Accepted Values</th>
630+
<th>Default Value</th>
631+
</tr>
632+
</thead>
633+
<tbody>
634+
<tr>
635+
<td><code>parameterName</code></td>
636+
<td>The name of a parameter in AWS Parameter Store.</td>
637+
<td>Any valid parameter name.</td>
638+
<td><i>No default value. A value must be configured for this parameter.</i></td>
639+
</tr>
640+
<tr>
641+
<td><code>walletPassword</code></td>
642+
<td>Optional password for PKCS12 wallets.</td>
643+
<td>Any valid password</td>
644+
<td><i>None. Required if wallet is password-protected.</i></td>
645+
</tr>
646+
<tr>
647+
<td><code>connectionStringIndex</code></td>
648+
<td>Optional index to select specific credentials in SEPS wallet.</td>
649+
<td>Any positive integer (e.g., 1, 2, 3)</td>
650+
<td><i>None</i></td>
651+
</tr>
652+
</tbody>
653+
</table>
654+
655+
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-parameter-store-wallet.properties](example-aws-parameterstore-wallet.properties).
656+
545657
## AWS Secrets Manager Connection String Provider
546658

547659
The Connection String Provider provides Oracle JDBC with a connection string managed by the AWS Secrets Manager service.
@@ -607,6 +719,49 @@ In addition to the set of [common parameters](#common-parameters-for-resource-pr
607719

608720
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-aws-secretsmanager.properties](example-aws-secretsmanager.properties).
609721

722+
## AWS Parameter Store Connection String Provider
723+
724+
The Connection String Provider provides Oracle JDBC with a connection string managed by the AWS Systems Manager Parameter Store service.
725+
This is a [Resource Provider](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/spi/OracleResourceProvider.html) identified
726+
by the name `ojdbc-provider-aws-parameter-store-tnsnames`.
727+
728+
This provider retrieves and decodes a `tnsnames.ora` file stored as a parameter value in AWS Parameter Store.
729+
730+
You can store the contents of the `tnsnames.ora` file as:
731+
732+
- A base64-encoded string containing the full contents of the `tnsnames.ora` file.
733+
734+
- Plain text, by simply copying and pasting the contents directly into the parameter value.
735+
736+
In addition to the set of [common parameters](#common-parameters-for-resource-providers), this provider also requires the parameters listed below.
737+
738+
<table>
739+
<thead>
740+
<tr>
741+
<th>Parameter Name</th>
742+
<th>Description</th>
743+
<th>Accepted Values</th>
744+
<th>Default Value</th>
745+
</tr>
746+
</thead>
747+
<tbody>
748+
<tr>
749+
<td><code>parameterName</code></td>
750+
<td>The name of a parameter in AWS Systems Manager Parameter Store.</td>
751+
<td>Any valid parameter name.</td>
752+
<td><i>No default value. A value must be configured for this parameter.</i></td>
753+
</tr>
754+
<tr>
755+
<td><code>tnsAlias</code></td>
756+
<td>Specifies the alias to retrieve the appropriate connection string from the <code>tnsnames.ora</code> file.</td>
757+
<td>Any valid alias present in your <code>tnsnames.ora</code> file.</td>
758+
<td><i>No default value. A value must be configured for this parameter.</i></td>
759+
</tr>
760+
</tbody>
761+
</table>
762+
763+
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-aws-parameterstore.properties](example-aws-parameterstore.properties).
764+
610765
## Common Parameters for Resource Providers
611766

612767
Providers classified as [Resource Providers](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/spi/OracleResourceProvider.html) within this module

‎ojdbc-provider-aws/example-aws-parameterstore-wallet.properties

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
################################################################################
2+
# Copyright (c) 2024 Oracle and/or its affiliates.
3+
#
4+
# The Universal Permissive License (UPL), Version 1.0
5+
#
6+
# Subject to the condition set forth below, permission is hereby granted to any
7+
# person obtaining a copy of this software, associated documentation and/or data
8+
# (collectively the "Software"), free of charge and under any and all copyright
9+
# rights in the Software, and any and all patent rights owned or freely
10+
# licensable by each licensor hereunder covering either (i) the unmodified
11+
# Software as contributed to or provided by such licensor, or (ii) the Larger
12+
# Works (as defined below), to deal in both
13+
#
14+
# (a) the Software, and
15+
# (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
16+
# one is included with the Software (each a "Larger Work" to which the Software
17+
# is contributed by such licensors),
18+
#
19+
# without restriction, including without limitation the rights to copy, create
20+
# derivative works of, display, perform, and distribute the Software and make,
21+
# use, sell, offer for sale, import, export, have made, and have sold the
22+
# Software and the Larger Work(s), and to sublicense the foregoing rights on
23+
# either these or other terms.
24+
#
25+
# This license is subject to the following condition:
26+
# The above copyright notice and either this complete permission notice or at
27+
# a minimum a reference to the UPL must be included in all copies or
28+
# substantial portions of the Software.
29+
#
30+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
31+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
32+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
34+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
35+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36+
# SOFTWARE.
37+
################################################################################
38+
39+
# An example of a connection properties file that configures Oracle JDBC to
40+
# obtain SEPS credentials from AWS Parameter Store.
41+
#
42+
# This file can be located by Oracle JDBC using the "oracle.jdbc.config.file"
43+
# connection property. For details, see:
44+
# https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE
45+
46+
# Configures the AWS Parameter Store SEPS Wallet Provider for both username and password.
47+
# The SEPS wallet parameter name, wallet password, and index are configured via
48+
# "SEPS_WALLET_PARAMETER_NAME", "SEPS_WALLET_PASSWORD", and "SEPS_CONNECTION_STRING_INDEX".
49+
oracle.jdbc.provider.username=ojdbc-provider-aws-parameter-store-seps
50+
oracle.jdbc.provider.username.parameterName=${SEPS_WALLET_PARAMETER_NAME}
51+
oracle.jdbc.provider.username.walletPassword=${SEPS_WALLET_PASSWORD}
52+
oracle.jdbc.provider.username.connectionStringIndex=${SEPS_CONNECTION_STRING_INDEX}
53+
oracle.jdbc.provider.username.awsRegion=${AWS_REGION}
54+
55+
oracle.jdbc.provider.password=ojdbc-provider-aws-parameter-store-seps
56+
oracle.jdbc.provider.password.parameterName=${SEPS_WALLET_PARAMETER_NAME}
57+
oracle.jdbc.provider.password.walletPassword=${SEPS_WALLET_PASSWORD}
58+
oracle.jdbc.provider.password.connectionStringIndex=${SEPS_CONNECTION_STRING_INDEX}
59+
oracle.jdbc.provider.password.authenticationMethod=aws-default
60+
oracle.jdbc.provider.password.awsRegion=${AWS_REGION}
61+
62+
63+

‎ojdbc-provider-aws/example-aws-parameterstore.properties

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
################################################################################
2+
# Copyright (c) 2025 Oracle and/or its affiliates.
3+
#
4+
# The Universal Permissive License (UPL), Version 1.0
5+
#
6+
# Subject to the condition set forth below, permission is hereby granted to any
7+
# person obtaining a copy of this software, associated documentation and/or data
8+
# (collectively the "Software"), free of charge and under any and all copyright
9+
# rights in the Software, and any and all patent rights owned or freely
10+
# licensable by each licensor hereunder covering either (i) the unmodified
11+
# Software as contributed to or provided by such licensor, or (ii) the Larger
12+
# Works (as defined below), to deal in both
13+
#
14+
# (a) the Software, and
15+
# (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
16+
# one is included with the Software (each a "Larger Work" to which the Software
17+
# is contributed by such licensors),
18+
#
19+
# without restriction, including without limitation the rights to copy, create
20+
# derivative works of, display, perform, and distribute the Software and make,
21+
# use, sell, offer for sale, import, export, have made, and have sold the
22+
# Software and the Larger Work(s), and to sublicense the foregoing rights on
23+
# either these or other terms.
24+
#
25+
# This license is subject to the following condition:
26+
# The above copyright notice and either this complete permission notice or at
27+
# a minimum a reference to the UPL must be included in all copies or
28+
# substantial portions of the Software.
29+
#
30+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
31+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
32+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
34+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
35+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36+
# SOFTWARE.
37+
################################################################################
38+
39+
# An example of a connection properties file that configures Oracle JDBC to
40+
# login using a username and password managed by AWS Parameter Store.
41+
#
42+
# This file can be located by Oracle JDBC using the "oracle.jdbc.config.file"
43+
# connection property. For details, see:
44+
# https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE
45+
46+
# Configures the AWS Parameter Store Username Provider.
47+
# The parameter name is configured as an environment variable or JVM system property
48+
# named "USERNAME_PARAMETER_NAME". The AWS region is configured via "AWS_REGION".
49+
oracle.jdbc.provider.username=ojdbc-provider-aws-parameter-store-username
50+
oracle.jdbc.provider.username.parameterName=${USERNAME_PARAMETER_NAME}
51+
oracle.jdbc.provider.username.awsRegion=${AWS_REGION}
52+
53+
# Configures the AWS Parameter Store Password Provider.
54+
# The parameter name is configured as an environment variable or JVM system property
55+
# named "PASSWORD_PARAMETER_NAME". The AWS region is configured via "AWS_REGION".
56+
oracle.jdbc.provider.password=ojdbc-provider-aws-parameter-store-password
57+
oracle.jdbc.provider.password.parameterName=${PASSWORD_PARAMETER_NAME}
58+
oracle.jdbc.provider.password.awsRegion=${AWS_REGION}
59+
60+
# Configures the AWS Parameter Store Connection String Provider.
61+
# The parameter name and alias are configured as environment variables or JVM system properties
62+
# named "TNSNAMES_PARAMETER_NAME" and "TNS_ALIAS", respectively. The AWS region is configured via "AWS_REGION".
63+
oracle.jdbc.provider.connectionString=ojdbc-provider-aws-parameter-store-tnsnames
64+
oracle.jdbc.provider.connectionString.parameterName=${TNSNAMES_PARAMETER_NAME}
65+
oracle.jdbc.provider.connectionString.tnsAlias=${TNS_ALIAS}
66+
oracle.jdbc.provider.connectionString.awsRegion=${AWS_REGION}
67+
68+
69+

0 commit comments

Comments
 (0)