Example of filtering RDS region-specific certificates, installed to an OpenJDK Docker image, to speed up image build time (eu-west-2)

Dockerfile

FROM openjdk:16-jdk-buster
LABEL org.opencontainers.image.source="https://github.com/KaleCharity/snip"

ARG jar
ADD $jar /service.jar

RUN curl -sS "https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem" > rds-combined-ca-bundle.pem
RUN awk 'split_after == 1 {n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1}{print > "rds-ca-" n ".pem"}' < rds-combined-ca-bundle.pem

RUN for CERT in rds-ca-*; do \
  alias=$(openssl x509 -noout -text -in $CERT | perl -ne 'next unless /Subject:/; s/.*(CN=|CN = )//; print') && \
  if echo "$alias" | grep -v "eu-west-2\|RDS Root"; then continue; fi && \
  echo "Importing $alias" && \
  keytool -import -file ${CERT} -alias "${alias}" -storepass changeit -cacerts -noprompt && \
  rm $CERT; \
done

CMD java $JAVA_OPTS -jar /service.jar $RUN_MODE