AWSSDK.SecretsManager.Caching lifetime can we instaniate this as a singleton and not have to worry about the client

[JaieParker]

I am looking at using AWSSDK.SecretsManager.Caching to get some information in my .net 8 project and I will use BasicAWSCredentials(accessKey, secretKey) for my local dev instance and EC2 local credentials for container instance.

I am wondering about the lifetime of how long the cache should be instaniated, i.e. should the cache be a singleton that I inject and if it is do I need to worry about the client credentials object lifetime, will this auto reconnect if it disconnects?

I have read a few articles about this and lots of AWS documentation but have not been able to find anything yet about this. Is the credential object fully managed by AWS so I dont need to think about this, what are my option for handling this when the network is down?

I have also done further investigation and can see that you use a RuntimePipeline underneith to handle communication which looks like it uses a CredentialsRetriever, which gives me the impression that you are creating a http connection per request and seems like this should be ok to have AmazonSecretsManagerClient initialized as a singlton, but it would be great to have confirmation

Also asked here: https://stackoverflow.com/questions/78718902/aws-awssdk-secretsmanager-caching-lifetime-of-the-client-and-the-cache-object

Thanks for any help

[jirkafajfr]

Hello Jaie,

may I ask about clarification of your question?

The Amazon.SecretsManager.Extensions.Caching is a simple in-memory secret store, that works as a wrapper around the SecretsManager service. Two instances of ISecretsManagerCache wont share the content of the cache. The majority of use-cases instantiates the SecretsManagerCache as singleton hence underlaying AmazonSecretsManagerClient is singleton as well. But how you instantiate cache in general definitely depends on your use-case.

The EC2 can use local metadata endpoint in order to refresh the underlaying credentials when nearing expiration. If you use BasicAWSCredentials it will allow you to have cache only for the duration of these credentials.