@Override
    public void upgrade() {
        if (clusterConfigService.get(MigrationCompleted.class) != null) {
            LOG.debug("Migration already completed.");
            return;
        }

        final LegacyAWSPluginConfiguration legacyConfiguration = clusterConfigService.get(
                CLUSTER_CONFIG_TYPE,
                LegacyAWSPluginConfiguration.class
        );

        if (legacyConfiguration != null && !Strings.isNullOrEmpty(legacyConfiguration.secretKey())) {
            final AWSPluginConfiguration migratedPluginConfiguration = AWSPluginConfiguration.fromLegacyConfig(legacyConfiguration, systemConfiguration);

            clusterConfigService.write(CLUSTER_CONFIG_TYPE, migratedPluginConfiguration);
        }

        clusterConfigService.write(MigrationCompleted.create());
    }
@Test
    public void encryptsSecretKeyIfPresent() {
        mockExistingConfig(V20200505121200_EncryptAWSSecretKey.LegacyAWSPluginConfiguration.create(
                true,
                "lookupRegions",
                "something",
                "verySecretKey",
                true
        ));
        when(configuration.getPasswordSecret()).thenReturn("systemSecret1234");

        this.migration.upgrade();

        final ArgumentCaptor<V20200505121200_EncryptAWSSecretKey.AWSPluginConfiguration> writtenConfigCaptor = ArgumentCaptor.forClass(
                V20200505121200_EncryptAWSSecretKey.AWSPluginConfiguration.class
        );
        verify(clusterConfigService, times(1)).write(eq(PLUGIN_CONFIG_CLASS_NAME), writtenConfigCaptor.capture());
        verify(clusterConfigService, times(1)).write(any(V20200505121200_EncryptAWSSecretKey.MigrationCompleted.class));
        final V20200505121200_EncryptAWSSecretKey.AWSPluginConfiguration writtenConfig = writtenConfigCaptor.getValue();

        assertThat(AESTools.decrypt(writtenConfig.encryptedSecretKey(), "systemSecret1234", writtenConfig.secretKeySalt()))
                .isEqualTo("verySecretKey");
    }