How to pass the DB AWS secret into tomcat context.xml?

Question

I have a context.xml where I am connecting to DB.

<?xml version='1.0' encoding='utf-8'?>
<Context>
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>

<Resource name="jdbc/SS" 
        auth="Container"
        type="javax.sql.DataSource"
        factory="org.apache.tomcat.jdbc.pool.DataSourceFactory" 
        username="a***b"
        password="C********1"
        driverClassName="org.postgresql.Driver"
        url="jdbc:postgresql://**********:****/a***b"
        maxActive="100"
        maxIdle="50"
        minIdle="10"
        testWhileIdle="true"
        maxWait="30000"  
        maxAge="60000"
        removeAbandoned="true" 
        removeAbandonedTimeout="600" />
</Context>

I need to get the DB credentials from the secret manager and pass the values into the context.xml by replacing the hardcoded DB credentials.

Is there any way to achieve this?

Do you want to modify xml using java code ? Because in xml, you have to go by hardcoding only. — Anish B., Oct 20 '20 at 07:32
I need to remove the hardcoded DB credentials from XML and get the DB credentials from secret and assign it in XML — rakeshh92, Oct 20 '20 at 08:44

score 2 · Answer 1 · answered Oct 20 '20 at 11:12

If you want to load the DB credential dynamically. It is possible to only for the time Tomcat is loading context.xml once (because Tomcat read environment variable only once at startup).

Notice that at runtime, whenever contxt.xml change the relevant web application reloads. Tomcat is not restarted.

So the trick is to deliver DB credentials as JVM parameter/argument, like the above ${catalina.base}

There are 3 stages:

Declare and set value to the environment variable:
```
export DB_CREDENTIALS='*****'
```
Good place is at Tomcat's user login script.bash_profile, or Tomcat environments setenv.sh
Create a JVM parameter (system variable) for environment variable: add the following line to setenv.sh before the last line.
```
-Denvironment.db.credentials=${DB_CREDENTIALS} \
```

Use/call the declared JVM parameter in context.xml. For example:

url="jdbc:postgresql://**********:****/${environment.db.credentials}"

Since Tomcat version [8.5.46](https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#8.5.46_(markt)) and [9.0.25](https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.25_(markt)), step 2 can be skipped and one can use directly OS's environment variables in the `context.xml` file (cf. [Property replacements](http://tomcat.apache.org/tomcat-9.0-doc/config/systemprops.html#Property_replacements)). — Piotr P. Karwasz, Jun 07 '21 at 10:50

How to pass the DB AWS secret into tomcat context.xml?

1 Answers1

Linked