Refresh old credentials

2 files changed, 9 insertions, 1 deletions

diff --git a/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java b/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java
index 6de8b5c0142..f307e903b19 100644
--- a/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java
+++ b/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java
@@ -43,7 +43,7 @@ public class VespaAwsCredentialsProvider implements AWSCredentialsProvider {
     @Override
     public AWSCredentials getCredentials() {
         Credentials sessionCredentials = credentials.get();
-        if (Duration.between(clock.instant(), sessionCredentials.expiry).abs().compareTo(REFRESH_INTERVAL)<0) {
+        if (Duration.between(clock.instant(), sessionCredentials.expiry).compareTo(REFRESH_INTERVAL)<0) {
             refresh();
             sessionCredentials = credentials.get();
         }
diff --git a/jdisc-cloud-aws/src/test/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProviderTest.java b/jdisc-cloud-aws/src/test/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProviderTest.java
index 63cfd2f1eeb..889aa0f02c1 100644
--- a/jdisc-cloud-aws/src/test/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProviderTest.java
+++ b/jdisc-cloud-aws/src/test/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProviderTest.java
@@ -27,6 +27,7 @@ public class VespaAwsCredentialsProviderTest {
 
         Instant updatedExpiry = clock.instant().plus(Duration.ofHours(24));
         writeCredentials(credentialsPath, updatedExpiry);
+
         // File updated, but old credentials still valid
         credentials = credentialsProvider.getCredentials();
         assertExpiryEquals(originalExpiry, credentials);
@@ -35,6 +36,13 @@ public class VespaAwsCredentialsProviderTest {
         clock.advance(Duration.ofHours(11).plus(Duration.ofMinutes(31)));
         credentials = credentialsProvider.getCredentials();
         assertExpiryEquals(updatedExpiry, credentials);
+
+        // Credentials refreshes when they are long expired (since noone asked for them for a long time)
+        updatedExpiry = clock.instant().plus(Duration.ofDays(12));
+        writeCredentials(credentialsPath, updatedExpiry);
+        clock.advance(Duration.ofDays(11));
+        credentials = credentialsProvider.getCredentials();
+        assertExpiryEquals(updatedExpiry, credentials);
     }
 
     @Test