Include tenant secret stores in deploy call

AwsParameterStore iterates through configured stores to find secret
Set up AwsParameterStore
ModelContextImpl properties fetches external ID for every tenant secret store

1 files changed, 4 insertions, 24 deletions

diff --git a/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/AwsParameterStoreValidationHandler.java b/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/AwsParameterStoreValidationHandler.java
index 5d5cad2f75d..8b6e3d52d37 100644
--- a/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/AwsParameterStoreValidationHandler.java
+++ b/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/AwsParameterStoreValidationHandler.java
@@ -28,22 +28,14 @@ import java.util.logging.Logger;
 public class AwsParameterStoreValidationHandler extends LoggingRequestHandler {
 
     private static final Logger log = Logger.getLogger(AwsParameterStoreValidationHandler.class.getName());
-    private final VespaAwsCredentialsProvider credentialsProvider;
-    private final SecretStoreConfig secretStoreConfig;
+    private final AwsParameterStore awsParameterStore;
 
     @Inject
-    public AwsParameterStoreValidationHandler(Context ctx, SecretStoreConfig secretStoreConfig) {
-        this(ctx, secretStoreConfig, new VespaAwsCredentialsProvider());
-    }
-
-
-    public AwsParameterStoreValidationHandler(Context ctx, SecretStoreConfig secretStoreConfig, VespaAwsCredentialsProvider credentialsProvider) {
+    public AwsParameterStoreValidationHandler(Context ctx, AwsParameterStore awsParameterStore) {
         super(ctx);
-        this.credentialsProvider = credentialsProvider;
-        this.secretStoreConfig = secretStoreConfig;
+        this.awsParameterStore = awsParameterStore;
     }
 
-
     @Override
     public HttpResponse handle(HttpRequest request) {
         try {
@@ -66,10 +58,7 @@ public class AwsParameterStoreValidationHandler extends LoggingRequestHandler {
         settings.toSlime(root.setObject("settings"));
 
         try {
-            var arn = "arn:aws:iam::" + settings.awsId + ":role/" + settings.role;
-            var region = getRegion(settings);
-            var store = new AwsParameterStore(this.credentialsProvider, arn, settings.externalId, region);
-            store.getSecret("vespa-secret");
+            awsParameterStore.getSecret("vespa-secret");
             root.setString("status", "ok");
         } catch (RuntimeException e) {
             root.setString("status", "error");
@@ -90,15 +79,6 @@ public class AwsParameterStoreValidationHandler extends LoggingRequestHandler {
         }
     }
 
-    private String getRegion(AwsSettings settings) {
-        return secretStoreConfig.groups()
-                .stream()
-                .filter(group -> group.name().equals(settings.name))
-                .map(SecretStoreConfig.Groups::region)
-                .findFirst()
-                .orElseThrow(() -> new RuntimeException("No secret store named '" + settings.name + "' configured in services.xml"));
-    }
-
     private static class AwsSettings {
         String name;
         String role;