This message was deleted.

I used to take a similar approach with Grails 4. I'm fully on Grails 5 and 6 now but so I don't know if this approach will still work, but I used

grails-app/conf/runtime.groovy

to call a utility function to decrypt the encrypted password and set it as the

dataSource.password

value. I believe runtime.groovy runs before application.groovy or application.yml is processed so the password will be set before the datasource is initialized. My current approach is to read in secrets as env variables and they are referenced by application.yml

Thank you, Spencer! Could you please share a sample code snippet of runtime.groovy?

import xxxxx.ConfigService

ConfigService configService = new ConfigService()

dataSource.password=configService.getSecureProperties()?.getProperty("dataSource.password")

ConfigService is just a utility class for handling configuration, the details don't matter but the dataSource.password is set to the result of the decryption. If I were you I would try temporarily hard coding the password and assign it to dataSource.password - and see if it works. Then figure out how to read the actual encrypted value and decrypt it

sure, thank you so much! will try it out and let you know.

You will need to think about how to protect the AES256 password used to decrypt the encrypted db password too

yea I will set the encrypted password, IV and encrypted Key as environment variables on the server and read them in utility file to decrypt and assign to datasource.password. I have proposed the usage of direct environment variables on the server but Linux team rejected of storing clear text password on the server too. So I had to find this way of storing environment variables as encrypted and using them in the application code to decrypt back. This way both source code and linux servers are clear of plain text passwords.

hm, sounds like you'll have both the encrypted secret and the password to decrypt it available on the machine. How much this helps may depend on how those are getting injected and how secure those processes and systems are. When I was doing this my decryption key was stored in AWS KMS. The machine the app was running on was authorized to retrieve the master key from there using the AWS API. You could also use a service like AWS Secrets Manager to store and retrieve passwords safely. The approach with runtime.groovy should still work, you would just be calling the API to directly get the password

sure, thank you!