Complete AWS Lambda AppSec telemetry integration

[claponcet]

What Does This Do

• Completes the AWS Lambda AppSec lifecycle on successful and exceptional handler exits.
• Sends request and response data through the existing Instrumentation Gateway callbacks so Lambda analysis reaches the shared GatewayBridge telemetry path.
• Avoids analyzing handler output after an exception and closes abandoned AppSec contexts when ownership cannot be transferred.
• Attributes Lambda API Security telemetry to the bounded framework:aws-lambda value.

Motivation

Lambda AppSec analysis did not always run the shared request-end path, especially when a handler threw or AppSec activation changed during an invocation. That could omit the existing WAF telemetry generated by GatewayBridge.onRequestEnded. Lambda API Security telemetry also lacked a framework value.

Additional Notes

This change reuses the existing AppSec callbacks and collectors. It does not change shared WAF telemetry semantics, add a Lambda-specific metric sender, or add synchronous telemetry delivery.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: N/A

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.02 s	14.02 s	[-1.1%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.95 s	12.98 s	[-1.0%; +0.6%] (no difference)
startup:petclinic:appsec:Agent	17.03 s	16.84 s	[+0.2%; +2.1%] (maybe worse)
startup:petclinic:iast:Agent	16.96 s	17.10 s	[-1.7%; +0.0%] (no difference)
startup:petclinic:profiling:Agent	16.58 s	16.80 s	[-2.3%; -0.3%] (maybe better)
startup:petclinic:sca:Agent	16.95 s	16.81 s	[-0.1%; +1.8%] (no difference)
startup:petclinic:tracing:Agent	16.06 s	16.18 s	[-1.5%; -0.0%] (maybe better)

Commit: 03452084 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-23T08:24:44.098094Z	5ee22c2	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-23T08:25:07.506575Z	5ee22c2	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-us1-prod]

More details

Successful and exceptional Lambda exits use the shared request-end path. The callback order and context guards remain valid.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 5ee22c2 · @DataDog review to ask questions}

[jandro996]

LGTM! just a non blocking comment!