AWS Iot v1 updateCredentials API alternative

[mogambo100]

In v1 SDK for java we uses mqttClient updateCredentials API to refresh the credentials post expiration, But in V2 sdk we dont have UpdateCredentials API, so we did manual disconnect and used refreshed AwsSessionCredentials to create a new mqttClient and maps it to the old MQttWrapper. For creating the new client we uses AwsIotMqttConenctionBuilder which takes CredentialsProvider.

Questions.

Does the V2 SDK supports automatic refresh of AWSSessionCredentials or do we need to manually do it.
If we need to do it manually Is there any way other than manual disconnect and connect again.
As the manual disconnect and connect can cause intermittent issues and Latency issue do we have any other alternative for it.

Older way of doing refresh

STSAssumeRoleSessionCredentialsProvider stsAssumeRoleSessionCredentialsProvider =
--
  | mqttWrapper.getStsAssumeRoleSessionCredentialsProvider();
  |  
  | stsAssumeRoleSessionCredentialsProvider.refresh();
  | log.info("Temporary credential refreshed");
  | AWSSessionCredentials awsSessionCredentials = stsAssumeRoleSessionCredentialsProvider.getCredentials();
  |  
  | mqttWrapper.getAwsIotMqttClient().updateCredentials(awsSessionCredentials.getAWSAccessKeyId(),
  | awsSessionCredentials.getAWSSecretKey(), awsSessionCredentials.getSessionToken());
  | log.info("MQTT client credentials successfully updated.");
  |  
  | mqttWrapper.setCredentialExpirationTime(currentTime + TOKEN_EXPIRATION_TIME);
  | log.info("Expiration time of new credential {}",currentTime + TOKEN_EXPIRATION_TIME);

New way of refresh credentials we used.

TSAssumeRoleSessionCredentialsProvider stsAssumeRoleSessionCredentialsProvider =
                mqttWrapper.getStsAssumeRoleSessionCredentialsProvider();

        stsAssumeRoleSessionCredentialsProvider.refresh();
        log.info("Temporary credential refreshed");
        AWSSessionCredentials awsSessionCredentials = stsAssumeRoleSessionCredentialsProvider.getCredentials();

        // disconnect the existing client and create new client with refreshed creds
        try {
            CompletableFuture<Void> disconnectFeature = mqttWrapper.getAwsIotMqttClient().disconnect();
            disconnectFeature.get(5000, TimeUnit.MILLISECONDS);
            log.info("successfully disconnected the old aws Iot client.");
        } catch (Exception e) {
            log.error("unable to disconnect existing iotClient with old credentials.", e);
            throw new InternalServerException(e);
        }

        MqttClientConnection awsIotMqttClient = createConnectAndSubscribeMqttClient(mqttWrapper.getIotEndpoint(),
                mqttWrapper.getDeviceResponseListener(), awsSessionCredentials);
        
        mqttWrapper.setAwsIotMqttClient(awsIotMqttClient);
        log.info("MQTT client credentials successfully updated.");

        mqttWrapper.setCredentialExpirationTime(currentTime + TOKEN_EXPIRATION_TIME);
        log.info("Expiration time of new credential {}",currentTime + TOKEN_EXPIRATION_TIME)

[bretambrose]

The v2 SDK uses credentials providers and/or credentials provider chains (https://github.com/awslabs/aws-crt-java/tree/main/src/main/java/software/amazon/awssdk/crt/auth/credentials) so that you don't need to manage credential acquisition or refresh. The default provider chain (Environment -> Profile -> STS Web Identity -> ECS/IMDS) is often sufficent in many instances, but other providers exist to cover additional use cases (X509 for example). If you have a credential sourcing use case that isn't covered by the existing providers, feel free to create a discussion with a request to add support.

[mogambo100]

But my question is we are still refreshing the STS assume role credentials. so how to get that with the existing mqttClient. As you can see, we refreshed the STS credentials. now how to map that STS to my client

[bretambrose]

There is no way to inject session credentials into the client, by design. The providers are intended to handle all credentals refreshing for you.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.