From 9e8bb14fd381e0202a6ac5ece5b64a964590a94e Mon Sep 17 00:00:00 2001 From: Pedram Safaei Date: Tue, 22 Sep 2026 13:12:06 +0000 Subject: [PATCH] Tag DynamoDB and S3 client spans with the owning AWS account DynamoDB and S3 client spans named the table or bucket but never the account that owns it, so two accounts each holding an "orders" table produced indistinguishable spans. The owning account is available to the tracer without any extra call in three situations, and this change uses all of them: DynamoDB, TableName given as an ARN. The ARN carries partition, Region and account. Spans now get aws.table.arn and aws_account, and aws.table.name / tablename / peer.service carry the bare table name instead of the raw ARN. DynamoDB, bare TableName. DynamoDB documents that a bare name is resolved in the requestor's own account ("If you only provide the table name parameter instead of a complete ARN, the API operation will be performed on the table in the account to which the requestor belongs"), so the account owning the signing credentials is the table owner. On SDK v2 the account is read from the credentials object (AwsCredentialsIdentity.accountId(), SDK 2.26+, populated by the STS, SSO, profile, process and container credential providers) through a reflective, per-class cached getter so the instrumentation still loads against 2.2.0. Spans get aws_account and a synthesized aws.table.arn built from the client Region, account and table name. SDK v1 does not expose the signing credentials to request handlers, so v1 only handles the ARN form. The enrichment is gated on the DynamoDB service so other request models with a TableName member (Timestream, Keyspaces) keep the plain table name tags. S3, ExpectedBucketOwner. When the caller sets it, S3 rejects the request with 403 on a mismatch, so it names the owner whenever the request succeeds. Spans get aws_account on both SDKs, applied from the successful response so a rejected owner is never tagged. For older v2 SDKs whose credentials carry no account, the account can optionally be decoded from the access key ID, which encodes it in its trailing base32 characters for keys issued since March 2019 (older keys carry no account and are rejected by a format marker check). That encoding is not part of the documented AWS API surface, so it is behind dd.trace.aws.account.from.access.key.enabled (DD_TRACE_AWS_ACCOUNT_FROM_ACCESS_KEY_ENABLED), default false. aws_account is the tag name dd-trace-py already uses for the SNS and SQS account it derives from TopicArn and QueueUrl, and the dimension tag on the aws.dynamodb.* integration metrics, so the span joins to the metrics for the same table without translation. It is also on the allow list of the Agent's credit card obfuscator; a 12-digit account under any other key is redacted to "?" by default, which is why no second account-bearing key is introduced. ARNs are parsed once into a new AwsArn value type (the SDK's own software.amazon.awssdk.arns.Arn is not available at the 2.2.0 floor nor to SDK v1), which also owns the table-name extraction shared by both decorators. Partition mapping, table ARN assembly and access key decoding live in AwsAccountIdentity. Both sit in the aws-java-common module and are registered as injected helper classes by both SDK instrumentations. --- .../aws/AwsAccountIdentity.java | 37 ++++++ .../trace/instrumentation/aws/AwsArn.java | 107 +++++++++++++++ .../aws/AwsAccountIdentityTest.java | 25 ++++ .../trace/instrumentation/aws/AwsArnTest.java | 75 +++++++++++ .../aws-java/aws-java-sdk-1.11/build.gradle | 1 + .../aws/v0/AwsSdkClientDecorator.java | 35 ++++- .../instrumentation/aws/v0/AwsSdkModule.java | 2 + .../instrumentation/aws/v0/GetterAccess.java | 6 + .../aws/v0/TracingRequestHandler.java | 1 + .../src/test/groovy/AWS1ClientTest.groovy | 1 + .../aws-java/aws-java-sdk-2.2/build.gradle | 2 +- .../aws/v2/AwsSdkClientDecorator.java | 125 +++++++++++++++++- .../instrumentation/aws/v2/AwsSdkModule.java | 4 +- .../aws/v2/S3BucketOwnerForkedTest.java | 122 +++++++++++++++++ .../src/test/groovy/Aws2ClientTest.groovy | 72 ++++++++++ .../AwsSdkClientDecoratorCredentialsTest.java | 111 ++++++++++++++++ .../api/InstrumentationTags.java | 5 + 17 files changed, 726 insertions(+), 5 deletions(-) create mode 100644 dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsAccountIdentity.java create mode 100644 dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsArn.java create mode 100644 dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsAccountIdentityTest.java create mode 100644 dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsArnTest.java create mode 100644 dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/payloadTaggingTest/java/datadog/trace/instrumentation/aws/v2/S3BucketOwnerForkedTest.java create mode 100644 dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecoratorCredentialsTest.java diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsAccountIdentity.java b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsAccountIdentity.java new file mode 100644 index 00000000000..e6948d70acf --- /dev/null +++ b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsAccountIdentity.java @@ -0,0 +1,37 @@ +package datadog.trace.instrumentation.aws; + +/** + * Account identity of resources addressed by AWS SDK requests. + * + *

Two sources are trustworthy and used by the SDK instrumentations: + * + *

+ */ +public final class AwsAccountIdentity { + + private AwsAccountIdentity() {} + + /** {@code true} for exactly twelve ASCII digits. */ + public static boolean isAccountId(final String value) { + if (value == null || value.length() != 12) { + return false; + } + for (int i = 0; i < 12; i++) { + char c = value.charAt(i); + if (c < '0' || c > '9') { + return false; + } + } + return true; + } +} diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsArn.java b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsArn.java new file mode 100644 index 00000000000..0bb3f5f62ea --- /dev/null +++ b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/main/java/datadog/trace/instrumentation/aws/AwsArn.java @@ -0,0 +1,107 @@ +package datadog.trace.instrumentation.aws; + +/** + * A parsed Amazon Resource Name: {@code arn:::::}. + * + *

Parsed once so callers that need several fields do not re-scan the string. The AWS SDK ships + * its own parser ({@code software.amazon.awssdk.arns.Arn}) but it lives in a module that neither + * the SDK v2 2.2.0 floor these instrumentations compile against nor SDK v1 provide, so a minimal + * one is kept here. + */ +public final class AwsArn { + + private final String raw; + private final String partition; + private final String service; + private final String region; + private final String account; + private final String resource; + + private AwsArn( + final String raw, + final String partition, + final String service, + final String region, + final String account, + final String resource) { + this.raw = raw; + this.partition = partition; + this.service = service; + this.region = region; + this.account = account; + this.resource = resource; + } + + /** + * Parses an ARN. + * + * @return the parsed ARN, or {@code null} when the value is not of the form {@code + * arn:partition:service:region:account:resource} (partition and service non-empty). + */ + public static AwsArn parse(final String value) { + if (value == null || !value.startsWith("arn:")) { + return null; + } + int c1 = value.indexOf(':', 4); + if (c1 < 0) { + return null; + } + int c2 = value.indexOf(':', c1 + 1); + if (c2 < 0) { + return null; + } + int c3 = value.indexOf(':', c2 + 1); + if (c3 < 0) { + return null; + } + int c4 = value.indexOf(':', c3 + 1); + if (c4 < 0) { + return null; + } + if (c1 == 4 || c2 == c1 + 1 || c4 == value.length() - 1) { + // empty partition, empty service or empty resource + return null; + } + return new AwsArn( + value, + value.substring(4, c1), + value.substring(c1 + 1, c2), + emptyToNull(value.substring(c2 + 1, c3)), + emptyToNull(value.substring(c3 + 1, c4)), + value.substring(c4 + 1)); + } + + /** The original string. */ + public String raw() { + return raw; + } + + /** {@code aws}, {@code aws-cn}, {@code aws-us-gov}, ... */ + public String partition() { + return partition; + } + + /** {@code dynamodb}, {@code sns}, {@code s3}, ... */ + public String service() { + return service; + } + + /** The Region, or {@code null} for global services (S3, IAM). */ + public String region() { + return region; + } + + /** The 12-digit account, or {@code null} when absent (S3 ARNs) or not exactly twelve digits. */ + public String account() { + return AwsAccountIdentity.isAccountId(account) ? account : null; + } + + /** Everything after the fifth colon. Never empty. */ + public String resource() { + return resource; + } + + private static String emptyToNull(final String value) { + return value.isEmpty() ? null : value; + } +} diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsAccountIdentityTest.java b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsAccountIdentityTest.java new file mode 100644 index 00000000000..6f53271b95e --- /dev/null +++ b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsAccountIdentityTest.java @@ -0,0 +1,25 @@ +package datadog.trace.instrumentation.aws; + +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.NullAndEmptySource; +import org.junit.jupiter.params.provider.ValueSource; + +class AwsAccountIdentityTest { + + @ParameterizedTest(name = "{0} is an account id") + @ValueSource(strings = {"123456789012", "000000000000", "999999999999"}) + void acceptsTwelveDigits(String value) { + assertTrue(AwsAccountIdentity.isAccountId(value)); + } + + @ParameterizedTest(name = "{0} is not an account id") + @NullAndEmptySource + @ValueSource( + strings = {"12345", "1234567890123", "12345678901a", " 23456789012", "arn:aws:s3:::b"}) + void rejectsNonAccountIds(String value) { + assertFalse(AwsAccountIdentity.isAccountId(value)); + } +} diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsArnTest.java b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsArnTest.java new file mode 100644 index 00000000000..7a123c84441 --- /dev/null +++ b/dd-java-agent/instrumentation/aws-java/aws-java-common/src/test/java/datadog/trace/instrumentation/aws/AwsArnTest.java @@ -0,0 +1,75 @@ +package datadog.trace.instrumentation.aws; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertNull; + +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.CsvSource; +import org.junit.jupiter.params.provider.NullAndEmptySource; +import org.junit.jupiter.params.provider.ValueSource; + +class AwsArnTest { + + @ParameterizedTest(name = "parses {0}") + @CsvSource( + nullValues = "NULL", + value = { + "arn:aws:dynamodb:us-east-1:123456789012:table/orders, aws, dynamodb, us-east-1, 123456789012, table/orders", + "arn:aws:dynamodb:us-east-1:123456789012:table/orders/index/by-user, aws, dynamodb, us-east-1, 123456789012, table/orders/index/by-user", + "arn:aws-cn:dynamodb:cn-north-1:123456789012:table/orders, aws-cn, dynamodb, cn-north-1, 123456789012, table/orders", + "arn:aws-us-gov:sns:us-gov-west-1:123456789012:alerts, aws-us-gov, sns, us-gov-west-1, 123456789012, alerts", + "arn:aws:s3:::my-bucket, aws, s3, NULL, NULL, my-bucket", + "arn:aws:iam::123456789012:role/app, aws, iam, NULL, 123456789012, role/app", + "arn:aws:states:us-east-1:123456789012:stateMachine:orders:extra:colons, aws, states, us-east-1, 123456789012, stateMachine:orders:extra:colons", + }) + void parsesFields( + String value, + String partition, + String service, + String region, + String account, + String resource) { + AwsArn arn = AwsArn.parse(value); + assertNotNull(arn); + assertEquals(value, arn.raw()); + assertEquals(partition, arn.partition()); + assertEquals(service, arn.service()); + assertEquals(region, arn.region()); + assertEquals(account, arn.account()); + assertEquals(resource, arn.resource()); + } + + @ParameterizedTest(name = "rejects {0}") + @NullAndEmptySource + @ValueSource( + strings = { + "orders", + "arn:", + "arn:aws", + "arn:aws:dynamodb", + "arn:aws:dynamodb:us-east-1", + "arn:aws:dynamodb:us-east-1:123456789012", + "arn:aws:dynamodb:us-east-1:123456789012:", + "arn::dynamodb:us-east-1:123456789012:table/orders", + "arn:aws::us-east-1:123456789012:table/orders", + "table/orders", + "https://sqs.us-east-1.amazonaws.com/123456789012/q", + }) + void rejectsNonArn(String value) { + assertNull(AwsArn.parse(value)); + } + + @ParameterizedTest(name = "account of {0} is null") + @ValueSource( + strings = { + "arn:aws:dynamodb:us-east-1:12345:table/orders", + "arn:aws:dynamodb:us-east-1:12345678901a:table/orders", + "arn:aws:dynamodb:us-east-1::table/orders", + }) + void accountMustBeTwelveDigits(String value) { + AwsArn arn = AwsArn.parse(value); + assertNotNull(arn); + assertNull(arn.account()); + } +} diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/build.gradle b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/build.gradle index e8173d6afe0..610823222b1 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/build.gradle +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/build.gradle @@ -38,6 +38,7 @@ addTestSuiteExtendingForDir('latestDsmForkedTest', 'latestDsmTest', 'dsmTest') dependencies { compileOnly group: 'com.amazonaws', name: 'aws-java-sdk-core', version: '1.11.0' + implementation project(':dd-java-agent:instrumentation:aws-java:aws-java-common') // Include httpclient instrumentation for testing because it is a dependency for aws-sdk. testImplementation project(':dd-java-agent:instrumentation:apache-httpclient:apache-httpclient-4.0') diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkClientDecorator.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkClientDecorator.java index 07027e0f4f6..a1870ea8666 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkClientDecorator.java +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkClientDecorator.java @@ -25,6 +25,8 @@ import datadog.trace.bootstrap.instrumentation.api.Tags; import datadog.trace.bootstrap.instrumentation.api.UTF8BytesString; import datadog.trace.bootstrap.instrumentation.decorator.HttpClientDecorator; +import datadog.trace.instrumentation.aws.AwsAccountIdentity; +import datadog.trace.instrumentation.aws.AwsArn; import java.net.URI; import java.util.List; import java.util.Locale; @@ -179,12 +181,26 @@ protected void doOnRequest(final AgentSpan span, final Request request) { } String tableName = access.getTableName(originalRequest); if (null != tableName) { + // A DynamoDB TableName given as an ARN carries the owning account. SDK v1 does not expose + // the signing credentials to request handlers, so a bare name yields no account here. The + // existing table name tags keep the value as given, ARN or not. Other services with a + // TableName member (Timestream, Keyspaces, ...) only get the plain table name tags. + AwsArn arn = + awsSimplifiedServiceName != null && awsSimplifiedServiceName.startsWith("dynamodb") + ? AwsArn.parse(tableName) + : null; + if (arn != null) { + span.setTag(InstrumentationTags.AWS_TABLE_ARN, arn.raw()); + String account = arn.account(); + if (account != null) { + span.setTag(InstrumentationTags.AWS_ACCOUNT, account); + } + } span.setTag(InstrumentationTags.AWS_TABLE_NAME, tableName); span.setTag(InstrumentationTags.TABLE_NAME, tableName); bestPrecursor = InstrumentationTags.AWS_TABLE_NAME; bestPeerService = tableName; } - // Set peer.service based on Config for serverless functions if (Config.get().isAwsServerless()) { URI uri = request.getEndpoint(); @@ -247,6 +263,23 @@ protected void doOnRequest(final AgentSpan span, final Request request) { } } + /** + * Tags derived from the request that are only trustworthy once the service accepted it. S3 + * enforces {@code ExpectedBucketOwner} (403 on mismatch), so the asserted owner names the bucket + * owner only on a successful response. + */ + public void onSuccessfulRequest(final AgentSpan span, final Request request) { + if (!"s3".equalsIgnoreCase(simplifyServiceName(request.getServiceName()))) { + return; + } + final AmazonWebServiceRequest originalRequest = request.getOriginalRequest(); + final String expectedBucketOwner = + GetterAccess.of(originalRequest).getExpectedBucketOwner(originalRequest); + if (AwsAccountIdentity.isAccountId(expectedBucketOwner)) { + span.setTag(InstrumentationTags.AWS_ACCOUNT, expectedBucketOwner); + } + } + public void onServiceResponse( final AgentSpan span, final String awsService, final Response response) { if ("s3".equalsIgnoreCase(simplifyServiceName(awsService)) diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkModule.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkModule.java index 8c370ce03b8..29db032dfc0 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkModule.java +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/AwsSdkModule.java @@ -30,6 +30,8 @@ public String[] helperClassNames() { packageName + ".TracingRequestHandler", packageName + ".AwsNameCache", packageName + ".OnErrorDecorator", + "datadog.trace.instrumentation.aws.AwsAccountIdentity", + "datadog.trace.instrumentation.aws.AwsArn", }; } diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/GetterAccess.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/GetterAccess.java index ed87408c1bd..37e69fa18ca 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/GetterAccess.java +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/GetterAccess.java @@ -39,6 +39,7 @@ static GetterAccess of(final Object request) { private final MethodHandle getPublishBatchRequestEntries; private final MethodHandle getApproximateArrivalTimestamp; private final MethodHandle getTableName; + private final MethodHandle getExpectedBucketOwner; private GetterAccess(final Class objectType) { operationName = @@ -55,6 +56,7 @@ private GetterAccess(final Class objectType) { getApproximateArrivalTimestamp = findGetter(objectType, "getApproximateArrivalTimestamp", Date.class); getTableName = findStringGetter(objectType, "getTableName"); + getExpectedBucketOwner = findStringGetter(objectType, "getExpectedBucketOwner"); } String getOperationNameFromType() { @@ -101,6 +103,10 @@ String getTableName(final Object object) { return invokeForString(getTableName, object); } + String getExpectedBucketOwner(final Object object) { + return invokeForString(getExpectedBucketOwner, object); + } + Date getApproximateArrivalTimestamp(final Object object) { return invoke(getApproximateArrivalTimestamp, object); } diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/TracingRequestHandler.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/TracingRequestHandler.java index 84e6f7ad142..afa65f9cd32 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/TracingRequestHandler.java +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/main/java/datadog/trace/instrumentation/aws/v0/TracingRequestHandler.java @@ -96,6 +96,7 @@ public void afterResponse(final Request request, final Response response) span = AgentSpan.fromContext(context); if (span != null) { DECORATE.onResponse(span, response); + DECORATE.onSuccessfulRequest(span, request); DECORATE.onServiceResponse(span, request.getServiceName(), response); DECORATE.beforeFinish(span); span.finish(); diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/test/groovy/AWS1ClientTest.groovy b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/test/groovy/AWS1ClientTest.groovy index c5ea6ca23cf..2a574b898f3 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/test/groovy/AWS1ClientTest.groovy +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-1.11/src/test/groovy/AWS1ClientTest.groovy @@ -210,6 +210,7 @@ abstract class AWS1ClientTest extends VersionedNamingTestBase { "S3" | "GetObject" | "GET" | "/someBucket/someKey" | AmazonS3ClientBuilder.standard().withPathStyleAccessEnabled(true).withEndpointConfiguration(endpoint).withCredentials(credentialsProvider).build() | { c -> c.getObject("someBucket", "someKey") } | ["aws.bucket.name": "someBucket", "bucketname": "someBucket", "aws.object.key": "someKey"] | "" | "aws.bucket.name" | null "DynamoDBv2" | "CreateTable" | "POST" | "/" | AmazonDynamoDBClientBuilder.standard().withEndpointConfiguration(endpoint).withCredentials(credentialsProvider).build() | { c -> c.createTable(new CreateTableRequest("sometable", null)) } | ["aws.table.name": "sometable", "tablename": "sometable"] | "" | "aws.table.name" | null "DynamoDBv2" | "GetItem" | "POST" | "/" | AmazonDynamoDBClientBuilder.standard().withEndpointConfiguration(endpoint).withCredentials(credentialsProvider).build() | { c -> c.getItem(new GetItemRequest("sometable", ["attribute": new AttributeValue("somevalue")])) } | ["aws.table.name": "sometable", "tablename": "sometable"] | "" | "aws.table.name" | null + "DynamoDBv2" | "GetItem" | "POST" | "/" | AmazonDynamoDBClientBuilder.standard().withEndpointConfiguration(endpoint).withCredentials(credentialsProvider).build() | { c -> c.getItem(new GetItemRequest("arn:aws:dynamodb:us-east-1:123456789012:table/sometable", ["attribute": new AttributeValue("somevalue")])) } | ["aws.table.name": "arn:aws:dynamodb:us-east-1:123456789012:table/sometable", "tablename": "arn:aws:dynamodb:us-east-1:123456789012:table/sometable", "aws.table.arn": "arn:aws:dynamodb:us-east-1:123456789012:table/sometable", "aws_account": "123456789012"] | "" | "aws.table.name" | null "Kinesis" | "DeleteStream" | "POST" | "/" | AmazonKinesisClientBuilder.standard().withEndpointConfiguration(endpoint).withCredentials(credentialsProvider).build() | { c -> c.deleteStream(new DeleteStreamRequest().withStreamName("somestream")) } | ["aws.stream.name": "somestream", "streamname": "somestream"] | "" | "aws.stream.name" | null "SQS" | "CreateQueue" | "POST" | "/" | AmazonSQSClientBuilder.standard().withEndpointConfiguration(endpoint).withCredentials(credentialsProvider).build() | { c -> c.createQueue(new CreateQueueRequest("somequeue")) } | ["aws.queue.name": "somequeue", "queuename": "somequeue"] | """ diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/build.gradle b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/build.gradle index cfdc266d8ec..bd1a87ab6c6 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/build.gradle +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/build.gradle @@ -36,7 +36,7 @@ def fixedSdkVersion = '2.20.33' // 2.20.34 is missing and breaks IDEA import dependencies { compileOnly group: 'software.amazon.awssdk', name: 'aws-core', version: '2.2.0' payloadTaggingTestContainerImage(image('localstack/localstack:4.2.0', 'test.localstack.image')) - testImplementation project(':dd-java-agent:instrumentation:aws-java:aws-java-common') + implementation project(':dd-java-agent:instrumentation:aws-java:aws-java-common') // Include httpclient instrumentation for testing because it is a dependency for aws-sdk. testImplementation project(':dd-java-agent:instrumentation:apache-httpclient:apache-httpclient-4.0') diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecorator.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecorator.java index 7c1a1a85b90..4b211e58430 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecorator.java +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecorator.java @@ -14,6 +14,7 @@ import datadog.trace.api.Config; import datadog.trace.api.ConfigDefaults; import datadog.trace.api.DDTags; +import datadog.trace.api.GenericClassValue; import datadog.trace.api.cache.DDCache; import datadog.trace.api.cache.DDCaches; import datadog.trace.api.datastreams.AgentDataStreamsMonitoring; @@ -28,7 +29,12 @@ import datadog.trace.bootstrap.instrumentation.api.Tags; import datadog.trace.bootstrap.instrumentation.api.UTF8BytesString; import datadog.trace.bootstrap.instrumentation.decorator.HttpClientDecorator; +import datadog.trace.instrumentation.aws.AwsAccountIdentity; +import datadog.trace.instrumentation.aws.AwsArn; import datadog.trace.payloadtags.PayloadTagsData; +import java.lang.invoke.MethodHandle; +import java.lang.invoke.MethodHandles; +import java.lang.invoke.MethodType; import java.net.URI; import java.time.Instant; import java.util.ArrayList; @@ -41,6 +47,8 @@ import java.util.Set; import javax.annotation.Nonnull; import javax.annotation.ParametersAreNonnullByDefault; +import software.amazon.awssdk.auth.credentials.AwsCredentials; +import software.amazon.awssdk.auth.signer.AwsSignerExecutionAttribute; import software.amazon.awssdk.awscore.AwsResponse; import software.amazon.awssdk.core.SdkBytes; import software.amazon.awssdk.core.SdkField; @@ -96,6 +104,14 @@ public class AwsSdkClientDecorator extends HttpClientDecorator new ExecutionAttribute<>("KinesisStreamArn")); + // ExpectedBucketOwner is carried from the request to the response so the account is only tagged + // once S3 has accepted it (a mismatch is rejected with 403). + public static final ExecutionAttribute EXPECTED_BUCKET_OWNER_ATTRIBUTE = + InstanceStore.of(ExecutionAttribute.class) + .getOrCreate( + "DatadogExpectedBucketOwner", + () -> new ExecutionAttribute<>("DatadogExpectedBucketOwner")); + // not static because this object would be ClassLoader specific if multiple SDK instances were // loaded by different loaders private SdkField kinesisApproximateArrivalTimestampField = null; @@ -135,6 +151,12 @@ public void onSdkRequest( // S3 request.getValueForField("Bucket", String.class).ifPresent(name -> setBucketName(span, name)); if ("s3".equalsIgnoreCase(awsServiceName)) { + // S3 enforces ExpectedBucketOwner (403 on mismatch), so it names the owner only once the + // request has succeeded. Remember it here and tag it from the successful response. + request + .getValueForField("ExpectedBucketOwner", String.class) + .filter(AwsAccountIdentity::isAccountId) + .ifPresent(owner -> attributes.putAttribute(EXPECTED_BUCKET_OWNER_ATTRIBUTE, owner)); // gate "Key" extraction to S3 — DynamoDB's Key is Map, would CCE request.getValueForField("Key", String.class).ifPresent(key -> setObjectKey(span, key)); if (traceConfig().isDataStreamsEnabled()) { @@ -185,8 +207,18 @@ public void onSdkRequest( } }); - // DynamoDB - request.getValueForField("TableName", String.class).ifPresent(name -> setTableName(span, name)); + // DynamoDB. Other services (Timestream, Keyspaces, Athena, ...) also have TableName members; + // only DynamoDB resolves a bare name in the caller's account, so only it gets the ownership + // enrichment. Everything else keeps the plain table name tags. + if ("dynamodb".equalsIgnoreCase(awsServiceName)) { + request + .getValueForField("TableName", String.class) + .ifPresent(name -> onDynamoDbTable(span, name, attributes)); + } else { + request + .getValueForField("TableName", String.class) + .ifPresent(name -> setTableName(span, name)); + } // DSM if (traceConfig().isDataStreamsEnabled()) { @@ -274,6 +306,88 @@ private static void setPeerService( } } + /** + * Tags the owning account of the table. A TableName given as an ARN carries it (and is tagged as + * aws.table.arn). A bare name is, by DynamoDB's documented contract, resolved in the requestor's + * own account, so the account owning the signing credentials is the table owner. The existing + * aws.table.name, tablename and peer.service tags keep the TableName value as given, ARN or not, + * so nothing changes for spans that already carry an ARN there. + */ + private static void onDynamoDbTable( + final AgentSpan span, final String tableName, final ExecutionAttributes attributes) { + setTableName(span, tableName); + AwsArn arn = AwsArn.parse(tableName); + String account; + if (arn != null) { + account = arn.account(); + span.setTag(InstrumentationTags.AWS_TABLE_ARN, arn.raw()); + } else { + account = callerAccount(attributes); + } + if (account != null) { + span.setTag(InstrumentationTags.AWS_ACCOUNT, account); + } + } + + /** + * Account owning the credentials that sign this request, when the SDK exposes it + * (AwsCredentialsIdentity.accountId(), SDK 2.26+, populated by the STS, SSO, profile, process and + * container providers). Absent on older SDKs and for providers that do not resolve it. + */ + private static String callerAccount(final ExecutionAttributes attributes) { + AwsCredentials credentials = + attributes.getAttribute(AwsSignerExecutionAttribute.AWS_CREDENTIALS); + return credentials == null ? null : credentialsAccountId(credentials); + } + + // Optional accountId() was introduced on AwsCredentialsIdentity after 2.2.0, an interface + // that does not exist at the 2.2.0 floor, so it is looked up by name per credentials class. The + // handle is kept on the class itself (ClassValue) rather than in a static map: a credentials + // class from an application class loader must not be pinned by instrumentation state. A missing + // method is recorded as this sentinel. + private static final MethodHandle NO_ACCOUNT_ID_GETTER = + MethodHandles.constant(Optional.class, Optional.empty()); + private static final ClassValue ACCOUNT_ID_GETTERS = + GenericClassValue.of(AwsSdkClientDecorator::accountIdGetter); + + private static MethodHandle accountIdGetter(final Class type) { + try { + return MethodHandles.publicLookup() + .findVirtual(type, "accountId", MethodType.methodType(Optional.class)); + } catch (NoSuchMethodException | IllegalAccessException e) { + return NO_ACCOUNT_ID_GETTER; + } + } + + static String credentialsAccountId(final AwsCredentials credentials) { + MethodHandle getter = ACCOUNT_ID_GETTERS.get(credentials.getClass()); + if (getter == NO_ACCOUNT_ID_GETTER) { + return null; + } + try { + Object value = getter.invoke(credentials); + if (value instanceof Optional) { + Object account = ((Optional) value).orElse(null); + if (account instanceof String && AwsAccountIdentity.isAccountId((String) account)) { + return (String) account; + } + } + } catch (VirtualMachineError | ThreadDeath fatal) { + // OutOfMemoryError, StackOverflowError, ...: never hide these from the application. + throw fatal; + } catch (Throwable ignored) { + // Anything else (a provider failing to resolve, a linkage problem in the lookup) means the + // account is not available for this request; it must not fail the application's call. + } + return null; + } + + private static void setBucketOwner(AgentSpan span, String owner) { + // aws_account only: the Agent's credit card obfuscator redacts 12-digit values under keys it + // does not know, and aws_account is on its allow list. + span.setTag(InstrumentationTags.AWS_ACCOUNT, owner); + } + private static void setBucketName(AgentSpan span, String name) { span.setTag(InstrumentationTags.AWS_BUCKET_NAME, name); span.setTag(InstrumentationTags.BUCKET_NAME, name); @@ -317,6 +431,13 @@ public void onSdkResponse( final AgentSpan span = fromContext(context); Config config = Config.get(); String serviceName = attributes.getAttribute(SdkExecutionAttribute.SERVICE_NAME); + + // Only a successful response proves the asserted ExpectedBucketOwner is the bucket owner. + String expectedBucketOwner = attributes.getAttribute(EXPECTED_BUCKET_OWNER_ATTRIBUTE); + if (expectedBucketOwner != null && httpResponse != null && httpResponse.isSuccessful()) { + setBucketOwner(span, expectedBucketOwner); + } + if (config.isCloudResponsePayloadTaggingEnabled() && config.isCloudPayloadTaggingEnabledFor(serviceName)) { awsPojoToTags(span, ConfigDefaults.DEFAULT_TRACE_CLOUD_PAYLOAD_RESPONSE_TAG, response); diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkModule.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkModule.java index bfe441c52e9..1a4f26fec58 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkModule.java +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/main/java/datadog/trace/instrumentation/aws/v2/AwsSdkModule.java @@ -20,7 +20,9 @@ public AwsSdkModule() { public String[] helperClassNames() { return new String[] { "datadog.trace.instrumentation.aws.v2.AwsSdkClientDecorator", - "datadog.trace.instrumentation.aws.v2.TracingExecutionInterceptor" + "datadog.trace.instrumentation.aws.v2.TracingExecutionInterceptor", + "datadog.trace.instrumentation.aws.AwsAccountIdentity", + "datadog.trace.instrumentation.aws.AwsArn" }; } diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/payloadTaggingTest/java/datadog/trace/instrumentation/aws/v2/S3BucketOwnerForkedTest.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/payloadTaggingTest/java/datadog/trace/instrumentation/aws/v2/S3BucketOwnerForkedTest.java new file mode 100644 index 00000000000..cb7347b8738 --- /dev/null +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/payloadTaggingTest/java/datadog/trace/instrumentation/aws/v2/S3BucketOwnerForkedTest.java @@ -0,0 +1,122 @@ +package datadog.trace.instrumentation.aws.v2; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertFalse; + +import com.sun.net.httpserver.HttpServer; +import datadog.trace.agent.test.AbstractInstrumentationTest; +import datadog.trace.core.DDSpan; +import java.io.IOException; +import java.net.InetSocketAddress; +import java.net.URI; +import java.util.List; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; +import software.amazon.awssdk.auth.credentials.AwsBasicCredentials; +import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider; +import software.amazon.awssdk.regions.Region; +import software.amazon.awssdk.services.s3.S3Client; +import software.amazon.awssdk.services.s3.S3Configuration; +import software.amazon.awssdk.services.s3.model.GetObjectRequest; +import software.amazon.awssdk.services.s3.model.S3Exception; + +/** + * Lives in this source set because its S3 model (2.18.40) has {@code ExpectedBucketOwner}; the base + * test suite pins s3 2.2.0 which predates the field. + */ +class S3BucketOwnerForkedTest extends AbstractInstrumentationTest { + + private static HttpServer server; + private static S3Client client; + + @BeforeAll + static void startServer() throws IOException { + server = HttpServer.create(new InetSocketAddress("localhost", 0), 0); + server.createContext( + "/", + exchange -> { + // Keys under "forbidden" simulate S3 rejecting the asserted ExpectedBucketOwner. + int status = exchange.getRequestURI().getPath().contains("forbidden") ? 403 : 200; + exchange.sendResponseHeaders(status, -1); + exchange.close(); + }); + server.start(); + client = + S3Client.builder() + .endpointOverride(URI.create("http://localhost:" + server.getAddress().getPort())) + // Path-style addressing keeps the bucket out of the host name. With the virtual-hosted + // default the SDK would call somebucket.localhost, which only resolves on machines + // whose resolver maps *.localhost to loopback (it did locally, not on CI runners). + .serviceConfiguration(S3Configuration.builder().pathStyleAccessEnabled(true).build()) + .region(Region.US_EAST_1) + .credentialsProvider( + StaticCredentialsProvider.create(AwsBasicCredentials.create("test", "test"))) + .build(); + } + + @AfterAll + static void stopServer() { + client.close(); + server.stop(0); + } + + @Test + void expectedBucketOwnerTagsTheOwningAccount() throws Exception { + client.getObject( + GetObjectRequest.builder() + .bucket("somebucket") + .key("somekey") + .expectedBucketOwner("123456789012") + .build()); + + DDSpan span = firstSpan(); + assertEquals("somebucket", span.getTag("aws.bucket.name")); + assertEquals("123456789012", span.getTag("aws_account")); + } + + @Test + void noExpectedBucketOwnerMeansNoAccountTag() throws Exception { + client.getObject(GetObjectRequest.builder().bucket("somebucket").key("somekey").build()); + + DDSpan span = firstSpan(); + assertEquals("somebucket", span.getTag("aws.bucket.name")); + assertFalse(span.getTags().containsKey("aws_account")); + } + + @Test + void rejectedExpectedBucketOwnerIsNotTagged() throws Exception { + try { + client.getObject( + GetObjectRequest.builder() + .bucket("somebucket") + .key("forbidden") + .expectedBucketOwner("123456789012") + .build()); + } catch (S3Exception expected) { + // S3 rejects a wrong owner with 403; the asserted owner must not be tagged as the account + } + + DDSpan span = firstSpan(); + assertEquals("somebucket", span.getTag("aws.bucket.name")); + assertFalse(span.getTags().containsKey("aws_account")); + } + + @Test + void malformedExpectedBucketOwnerIsIgnored() throws Exception { + client.getObject( + GetObjectRequest.builder() + .bucket("somebucket") + .key("somekey") + .expectedBucketOwner("not-an-account") + .build()); + + assertFalse(firstSpan().getTags().containsKey("aws_account")); + } + + private static DDSpan firstSpan() throws Exception { + writer.waitForTraces(1); + List trace = writer.firstTrace(); + return trace.get(0); + } +} diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/groovy/Aws2ClientTest.groovy b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/groovy/Aws2ClientTest.groovy index aa7ecf0cd24..7723aeec1c3 100644 --- a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/groovy/Aws2ClientTest.groovy +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/groovy/Aws2ClientTest.groovy @@ -433,6 +433,78 @@ abstract class Aws2ClientTest extends VersionedNamingTestBase { """ } + def "DynamoDb request with a table ARN tags the owning account and table ARN"() { + setup: + def client = DynamoDbClient.builder() + .endpointOverride(server.address) + .region(Region.AP_NORTHEAST_1) + .credentialsProvider(CREDENTIALS_PROVIDER) + .build() + responseBody.set("") + def tableArn = "arn:aws:dynamodb:ap-northeast-1:123456789012:table/sometable" + + when: + client.getItem(GetItemRequest.builder().tableName(tableArn).key(["attribute": AttributeValue.builder().s("somevalue").build()]).build()) + TEST_WRITER.waitForTraces(1) + + then: + assertTraces(1) { + trace(1) { + span { + serviceName expectedService("DynamoDb", "GetItem") + operationName expectedOperation("DynamoDb", "GetItem") + resourceName "DynamoDb.GetItem" + spanType DDSpanTypes.HTTP_CLIENT + errored false + measured true + parent() + tags { + "$Tags.COMPONENT" "java-aws-sdk" + "$Tags.SPAN_KIND" Tags.SPAN_KIND_CLIENT + "$Tags.PEER_HOSTNAME" "localhost" + "$Tags.PEER_PORT" server.address.port + "$Tags.HTTP_METHOD" "POST" + "$Tags.HTTP_STATUS" 200 + "aws.service" "DynamoDb" + "aws_service" "DynamoDb" + "aws.operation" "GetItem" + "aws.agent" "java-aws-sdk" + "aws.requestId" "UNKNOWN" + // the name tags (and so peer.service) keep the TableName as given; the ARN and + // account are additions, not replacements + "aws.table.name" tableArn + "tablename" tableArn + "aws.table.arn" tableArn + "aws_account" "123456789012" + peerServiceFrom("aws.table.name") + urlTags("${server.address}/", ExpectedQueryParams.getExpectedQueryParams("GetItem")) + defaultTags(false, true) + } + } + } + } + } + + def "DynamoDb request with a bare table name has no account when the credentials carry none"() { + setup: + def client = DynamoDbClient.builder() + .endpointOverride(server.address) + .region(Region.AP_NORTHEAST_1) + .credentialsProvider(CREDENTIALS_PROVIDER) + .build() + responseBody.set("") + + when: + client.getItem(GetItemRequest.builder().tableName("sometable").key(["attribute": AttributeValue.builder().s("somevalue").build()]).build()) + TEST_WRITER.waitForTraces(1) + + then: + def tags = TEST_WRITER.firstTrace().first().tags + tags["aws.table.name"] == "sometable" + !tags.containsKey("aws_account") + !tags.containsKey("aws.table.arn") + } + def "timeout and retry errors captured"() { setup: def server = httpServer { diff --git a/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecoratorCredentialsTest.java b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecoratorCredentialsTest.java new file mode 100644 index 00000000000..69074cf8dfe --- /dev/null +++ b/dd-java-agent/instrumentation/aws-java/aws-java-sdk-2.2/src/test/java/datadog/trace/instrumentation/aws/v2/AwsSdkClientDecoratorCredentialsTest.java @@ -0,0 +1,111 @@ +package datadog.trace.instrumentation.aws.v2; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNull; +import static org.junit.jupiter.api.Assertions.assertSame; +import static org.junit.jupiter.api.Assertions.assertThrows; + +import datadog.trace.agent.test.AbstractInstrumentationTest; +import java.util.Optional; +import org.junit.jupiter.api.Test; +import software.amazon.awssdk.auth.credentials.AwsBasicCredentials; +import software.amazon.awssdk.auth.credentials.AwsCredentials; + +/** + * {@code AwsCredentialsIdentity.accountId()} does not exist in the SDK this suite compiles against, + * so the lookup is exercised with credentials classes that declare the same method. + */ +public class AwsSdkClientDecoratorCredentialsTest extends AbstractInstrumentationTest { + + @Test + void readsTheAccountFromCredentialsThatExposeIt() { + assertEquals( + "123456789012", + AwsSdkClientDecorator.credentialsAccountId(new AccountCredentials("123456789012"))); + } + + @Test + void ignoresCredentialsWithoutAnAccountIdMethod() { + // AwsBasicCredentials at 2.2.0 predates accountId() + assertNull( + AwsSdkClientDecorator.credentialsAccountId(AwsBasicCredentials.create("key", "secret"))); + } + + @Test + void ignoresAnEmptyOrMalformedAccount() { + assertNull(AwsSdkClientDecorator.credentialsAccountId(new AccountCredentials(null))); + assertNull(AwsSdkClientDecorator.credentialsAccountId(new AccountCredentials("12345"))); + assertNull( + AwsSdkClientDecorator.credentialsAccountId(new AccountCredentials("arn:aws:iam::1:root"))); + } + + @Test + void treatsAFailingLookupAsAbsent() { + assertNull(AwsSdkClientDecorator.credentialsAccountId(new FailingCredentials())); + } + + @Test + void doesNotSwallowFatalErrors() { + OutOfMemoryError error = + assertThrows( + OutOfMemoryError.class, + () -> AwsSdkClientDecorator.credentialsAccountId(new ExhaustedCredentials())); + assertSame(ExhaustedCredentials.ERROR, error); + } + + public static final class AccountCredentials implements AwsCredentials { + private final String account; + + AccountCredentials(String account) { + this.account = account; + } + + public Optional accountId() { + return Optional.ofNullable(account); + } + + @Override + public String accessKeyId() { + return "key"; + } + + @Override + public String secretAccessKey() { + return "secret"; + } + } + + public static final class FailingCredentials implements AwsCredentials { + public Optional accountId() { + throw new IllegalStateException("provider could not resolve the account"); + } + + @Override + public String accessKeyId() { + return "key"; + } + + @Override + public String secretAccessKey() { + return "secret"; + } + } + + public static final class ExhaustedCredentials implements AwsCredentials { + static final OutOfMemoryError ERROR = new OutOfMemoryError("simulated"); + + public Optional accountId() { + throw ERROR; + } + + @Override + public String accessKeyId() { + return "key"; + } + + @Override + public String secretAccessKey() { + return "secret"; + } + } +} diff --git a/internal-api/src/main/java/datadog/trace/bootstrap/instrumentation/api/InstrumentationTags.java b/internal-api/src/main/java/datadog/trace/bootstrap/instrumentation/api/InstrumentationTags.java index 0c1054e7776..5a84543e55d 100644 --- a/internal-api/src/main/java/datadog/trace/bootstrap/instrumentation/api/InstrumentationTags.java +++ b/internal-api/src/main/java/datadog/trace/bootstrap/instrumentation/api/InstrumentationTags.java @@ -37,6 +37,11 @@ public class InstrumentationTags { public static final String AWS_REQUEST_ID = "aws.requestId"; public static final String AWS_STORAGE_CLASS = "aws.storage.class"; + // Owning account of the addressed resource. aws_account matches the tag dd-trace-py sets and the + // dimension tag on the AWS integration metrics. + public static final String AWS_ACCOUNT = "aws_account"; + public static final String AWS_TABLE_ARN = "aws.table.arn"; + // These are temporary keys used for span pointer hash calculation public static final String S3_ETAG = "s3.eTag"; public static final String DYNAMO_PRIMARY_KEY_1 = "dynamodb.primary_key_1";