allthingssecurity opened a new pull request, #28036: URL: https://github.com/apache/camel/pull/28036
# Description [CAMEL-25729](https://issues.apache.org/jira/browse/CAMEL-25729) With `camel.vault.aws.refreshEnabled=true` and without SQS notification, `CloudTrailReloadTriggerTask.run` sent one `LookupEvents` request per check with `maxResults(100)` (the API accepts 1 to 50), never read `nextToken`, and started the next check at `lastTime + 1 s`. The lookup is by event source only, so it returns every Secrets Manager call of the account and Region (for example `GetSecretValue` of other applications), newest first. An update of a tracked secret that was not on the first page, or that was recorded in the same second as the newest event of the previous check, was never looked at: the context was not reloaded and kept the old secret values, without a log line. The first check, which had no start time, looked at the newest events of the last 90 days and could reload the context for an old update. Change (in `CloudTrailReloadTriggerTask`), the same approach as `CloudtrailConsumer.poll` since CAMEL-24082: - each check reads every page from the newest event time seen, inclusive, 50 events per page; - the events of that instant that the previous check handled are skipped by event id; - the position starts when the task starts; - if a page fails, the position does not move, and the next check reads the same events again. What users can notice: an update is seen whatever the number of other Secrets Manager events in the check period; the first check no longer reloads the context for an update made before the start. Upgrade guide (4.24): a note under `camel-aws-secrets-manager`. Cost: one request per 50 Secrets Manager events of the account and Region since the previous check (before: always one). LookupEvents allows two requests per second per account and Region; a throttled request is retried by the SDK, and a check that still fails leaves the position where it was, so the next check reads the same events again. There is no cap on the pages of one check: an account with more than about 100 Secrets Manager calls per second on average cannot be followed (main misses almost every update there); the upgrade note points to the SQS notification mode for such accounts. Tests: - New `CloudTrailReloadTriggerTaskLookupTest` (3 tests, mocked `CloudTrailClient` that answers like the service: events at or after `startTime`, newest first, at most 50 per page, a next token while events are left). All three fail without the change, 3 of 3 runs: an update behind 60 other events, an update in the same second as the newest event seen (also checks that a third check does not reload again), and the first check looking at an update made a day before the start. - With the change the camel-aws-secrets-manager tests pass: 9 run, 0 failures, 0 errors, 0 skipped. What is not changed: an event that CloudTrail makes visible after a newer one was seen by an earlier check (delivery delay) is still missed, as in the camel-aws-cloudtrail consumer. The SQS mode is unchanged. What was not run: the full root build; no test against AWS (what the service does with `maxResults=100` was not checked; the change is right whether it rejects it or answers with 50 events). # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it): [CAMEL-25729](https://issues.apache.org/jira/browse/CAMEL-25729). # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. (I built and tested camel-aws-secrets-manager, including the formatter and import-sort plugins. No option or generated file changed. I did not run the full root build.) # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. This PR was prepared with Claude Code (Claude Opus 5.5). The commit carries a `Co-Authored-By` trailer. _Claude Code on behalf of allthingssecurity_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
