Lecture 113: Configuring Actuator via application.properties

By default Spring Boot Actuator exposes a lot of useful info. But that doesn't mean everything should always be available externally. The more data you show, the bigger the risk — a "friendly" hacker seeing /env might learn way more than you'd like. So it's important to configure access, visibility, and even which endpoints exist. This is where the configuration file application.properties or its YAML counterpart application.yml comes in.

Configuring Actuator endpoints

Enabling Actuator in the project

If you happen to forget how to add Actuator, here's a reminder: just add the dependency to your pom.xml (Maven) or build.gradle (Gradle).

Maven:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

Gradle:

implementation 'org.springframework.boot:spring-boot-starter-actuator'

Enabling/disabling endpoints

Spring Boot Actuator provides many standard endpoints like /health, /metrics, /env, /loggers, etc. Many of them are enabled by default, but if you want to enable or disable specific endpoints you can do that via application.properties.

Example config that includes only the /health and /metrics endpoints:

management.endpoints.web.exposure.include=health,metrics

Or, conversely, exclude a few endpoints:

management.endpoints.web.exposure.exclude=env,beans

Hide or show all endpoints If you want to hide ALL endpoints and pick only the ones you need:

management.endpoints.web.exposure.include=none

And then add the ones you want manually:

management.endpoints.web.exposure.include=health,info

Changing the base path for endpoints

By default Actuator endpoints are available under /actuator. But sometimes you might want to change that — for security or just to make it look nicer.

You can change the base path with this setting:

management.endpoints.web.base-path=/monitoring

Now, instead of /actuator/health, your health endpoint will be at /monitoring/health.

Access and security configuration

Most Actuator endpoints are available to everyone by default (except /shutdown, which is disabled by default). But in real apps it's better to restrict access to metrics and config info so attackers can't abuse it.

First, enable Spring Security if it's not already added: Maven:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Gradle:

implementation 'org.springframework.boot:spring-boot-starter-security'

Now, to control access to endpoints:

management.endpoint.health.roles=ADMIN,USER
management.endpoint.metrics.roles=ADMIN

Here we say that /health can be accessed by users with roles ADMIN or USER, while /metrics is only available to ADMIN.

Disabling endpoints

If you don't need a particular endpoint at all, you can disable it completely:

management.endpoint.env.enabled=false

Now the /env endpoint will be gone from the app.

Additional settings

If you need more detail for debugging, you can increase logging for Actuator endpoints.

Add this line to your application.properties:

logging.level.org.springframework.boot.actuate=DEBUG

Actuator will now log more info to the console, which can help with troubleshooting.

Configuring custom metrics (basic)

Custom metrics let you track app-specific stuff. For example, you might want to see active user counts or how often a business operation runs. We'll dive deeper in later lectures, but to start you can add basic tags via Actuator.

Example of setting a custom metric in application.properties

management.metrics.tags.application=MyApplication

This tag adds a custom metric tag application that will be attached to all your metrics. So in /metrics you'll start seeing entries with the tag application=MyApplication.

Practical assignment

Part I: Configuring endpoints

1. Enable only the /health, /info, and /metrics endpoints.
2. Change the base path for endpoints to /monitoring.

Part II: Access control

1. Allow access to /health for all roles, and make /metrics inaccessible to users without the ADMIN role.
2. Completely disable the /env endpoint.

Part III: Verification

1. Use Postman or a browser to check endpoint availability.
2. Try sending requests without authentication and see which endpoints are available.

Common mistakes

In practice you often run into these issues:

• "Why aren't the endpoints I expect enabled?" Check the management.endpoints.web.exposure.include setting. If nothing is specified, Spring Boot enables only /health and /info.
• "Endpoints are unavailable after changing the base path." If you changed the base path, make sure you're requesting endpoints with the new prefix. For example, use /monitoring/health instead of /actuator/health.
• "Unprotected endpoints." If you forgot to add Spring Security or configure roles, sensitive info can leak. Always check the management.endpoint.<name>.roles settings.

Useful links

• Official Spring Boot Actuator documentation
• Working with Spring Security