How to fetch AWS SSM parameter at startup in Quarkus Native Image without GraalVM build failure?

Question

I am building a Quarkus application that runs as a native image with GraalVM. I need to fetch a decryption key from AWS Systems Manager (SSM) Parameter Store before the application starts, so I can decrypt my configuration values (DB credentials, third-party API keys, etc.).

I tried fetching the SSM parameter using AWS SDK v2 in a @Startup bean (or @PostConstruct), but I get the following build-time error when compiling to a native image:

Caused by: org.graalvm.compiler.debug.GraalError: com.oracle.svm.core.util.UserError$UserException: Class initialization of software.amazon.awssdk.awscore.client.config.AwsClientOption failed. 
This error is reported at image build time because class 
software.amazon.awssdk.awscore.client.config.AwsClientOption is registered for linking at image build time by command line and command line. 
Use the option '--initialize-at-run-time=software.amazon.awssdk.awscore.client.config.AwsClientOption' to explicitly request initialization of this class at run time.

Even when adding the following configuration in application.properties, the build still fails:

quarkus.native.additional-build-args=--initialize-at-run-time=software.amazon.awssdk.awscore.client.config.AwsClientOption

---

What I've Tried:

• Using @PostConstruct or @Startup to fetch SSM parameter at startup.
• Adding the GraalVM runtime initialization flag as suggested in the error message.
• Using reflection-config.json to explicitly allow runtime initialization of AWS SDK classes.

None of these approaches have worked, and the native image build always fails.

---

What I Need:

• A way to fetch the AWS SSM parameter during startup in Quarkus Native without causing build failures.
• Any workarounds that allow retrieving the decryption key before the application initializes other resources (DB, third-party APIs, etc.).
• If AWS SDK v2 is incompatible, is there a recommended approach (e.g., using a separate process, environment variables, or another AWS SDK)?

Any insights or workarounds would be greatly appreciated!