how to use different aws credentials for SQS than for S3 ?

[ddinger]

Hello spring cloud aws users,
In the 2.x version I was able to configure the SQS client with different credentials (an IAM user only allowed to access some queues) that the S3 client.

       AmazonSQSAsyncClientBuilder.standard()
                .withRegion("eu-central-1")
                .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey,secretKey)))
                .build();
...
        QueueMessageHandlerFactory queueMessageHandlerFactory = new QueueMessageHandlerFactory();
        queueMessageHandlerFactory.setAmazonSqs(amazonSQS());

with the new 3.x version i do not see a way to archive this, since there are no separate config properties for sqs and s3 credentials. The class AmazonSQSAsyncClientBuilder seems to no longer exist in the amazon v2 sdk.

Any help would be appreciated,
Dirk

[neiljbrown]

Hi @ddinger

I don’t believe the project supports configuring different credentials for each of its module’s auto-configured AWS clients, at least not out of the box using properties. Although as mentioned below, you can still create and register your own SDK client beans instead.

The Amazon SDK V2 is a complete rewrite, so some of the APIs and classes have changed, but most of the V1 functionality is available. When using version 3.x of the project, you could implement the equivalent of your code above to create your own instance of the SQS client using the SDK V2 as follows

SqsAsyncClient.builder()
  .region(Region.EU_CENTRAL_1)
  .credentialsProvider(StaticCredentialsProvider.create(AwsBasicCredentials.create(accessKeyId, secretAccessKey)))
  .build();

If you then register this instance as a bean, the project’s SQS auto-configuration will back-off and use that in place of its own.

What’s the reason behind your need to use different AWS credentials in the same app? If it's related to authorisation / permissions, could it be achieved through IAM policy(s) instead?

Regards, Neil.

[ddinger]

The reason why I need different credentials is that for S3 I have to use a S3 compatible service provided by a hoster in europe due to GDPR regulations. So technically It is a different region, endpoint etc.
Currently I setup the S3 client manually and use the spring aws cloud v2.x only for SQS. But I would like to use the new S3Template abstraction also.

[maciejwalkowiak]

as @neiljbrown mentioned, you can opt-out from SQS client auto-configuration by defining your own bean of type SqsAsyncClient. Take a look at https://github.com/awspring/spring-cloud-aws/blob/main/spring-cloud-aws-autoconfigure/src/main/java/io/awspring/cloud/autoconfigure/sqs/SqsAutoConfiguration.java#L70

[ddinger]

Thank you. This pointed me to the right direction