feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation by andreiborza · Pull Request #22165 · getsentry/sentry-javascript

andreiborza · 2026-07-09T21:22:15Z

Ports the messaging service extensions from the OTel aws-sdk integration to the orchestrion channel integration and registers them in the service registry:

SQS: producer/consumer span kinds and names, messaging.* attributes, trace propagation into outgoing MessageAttributes (single and batch), and span links from received messages via the propagated headers
SNS: producer span kind/name for Publish, messaging.* and topic ARN attributes, trace propagation into MessageAttributes
Lambda: faas.* attributes for Invoke, trace propagation into the base64 ClientContext (respecting the 3583 byte cap)

Propagation writes Sentry-native sentry-trace/baggage headers derived from the request span instead of OTel propagation.inject, and the SQS receive side reads them back with propagationContextFromHeaders.

Part of #20946

cursor · 2026-07-09T21:26:02Z

+      debug.warn(
+        '[orchestrion:aws-sdk] cannot set trace propagation on SQS/SNS message due to maximum amount of MessageAttributes',
+      );
+  }


Message attribute quota over-counts

Medium Severity

injectPropagationContext treats every propagation header as a new attribute when checking the 10-attribute SQS/SNS limit, even when sentry-trace or baggage keys already exist. At nine or ten attributes including those keys, injection is skipped even though overwriting would stay within the quota and trace propagation should still run.

^{Reviewed by Cursor Bugbot for commit 5069f36. Configure here.}

cursor · 2026-07-09T21:26:02Z

+      );
+  }
+  return attributes;
+}


Feat PR lacks propagation tests

Medium Severity

This feature adds SQS, SNS, and Lambda trace propagation but the diff includes no unit, integration, or E2E test covering injection, extraction, or quota behavior. Testing conventions for feat PRs expect at least one such test.

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit 5069f36. Configure here.}

cursor · 2026-07-09T21:39:15Z

+    this._services.set('SQS', new SqsServiceExtension());
+    this._services.set('SNS', new SnsServiceExtension());
    this._services.set('DynamoDB', new DynamodbServiceExtension());
+    this._services.set('Lambda', new LambdaServiceExtension());


Missing tests for new extensions

Medium Severity

This feat adds SQS, SNS, and Lambda trace propagation and span attributes, but the diff includes no unit, integration, or E2E coverage. Per review guidelines, feat PRs should include at least one test that asserts propagation headers, span kinds/names, or receive-side span links.

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit 6abbb22. Configure here.}

cursor · 2026-07-09T21:39:15Z

+
+          request.commandInput.MessageAttributeNames = addPropagationFieldsToAttributeNames(
+            request.commandInput.MessageAttributeNames,
+          );


All breaks receive attribute names

Medium Severity

For ReceiveMessage, when MessageAttributeNames is ['All'], addPropagationFieldsToAttributeNames appends sentry-trace and baggage, producing a list that mixes All with specific names. SQS does not allow that combination, so the call can fail or omit propagation headers and span links.

Additional Locations (1)

packages/server-utils/src/integrations/tracing-channel/aws-sdk/services/MessageAttributes.ts#L78-L82

^{Reviewed by Cursor Bugbot for commit 6abbb22. Configure here.}

cursor · 2026-07-09T21:48:20Z

+  if (segments.length === 0) return undefined;
+
+  return segments[segments.length - 1];
+}


Feat PR lacks integration tests

Medium Severity

This feature adds SQS, SNS, and Lambda trace propagation and span behavior, but the diff includes no integration or E2E test covering those paths. Per SDK testing conventions for feat PRs, at least one such test is expected.

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit 1964abf. Configure here.}

cursor · 2026-07-09T21:51:16Z

+  if (baggage) {
+    headers[BAGGAGE_HEADER] = baggage;
+  }
+  return headers;


Trace propagation skips getTraceData

Medium Severity

getPropagationHeaders builds sentry-trace/baggage via spanToTraceHeader and DSC helpers instead of getTraceData({ span }). Outgoing HTTP uses getTraceData, which handles tracing-without-performance placeholders and skips invalid trace data, so SQS/SNS/Lambda propagation can disagree with other SDK propagation for the same span.

Additional Locations (1)

packages/server-utils/src/integrations/tracing-channel/aws-sdk/services/lambda.ts#L56-L57

^{Reviewed by Cursor Bugbot for commit f024586. Configure here.}

github-actions · 2026-07-09T22:02:45Z

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	27.6 kB	-	-
@sentry/browser - with treeshaking flags	26.04 kB	-	-
@sentry/browser (incl. Tracing)	46.35 kB	-	-
@sentry/browser (incl. Tracing + Span Streaming)	48.14 kB	-	-
@sentry/browser (incl. Tracing, Profiling)	51.13 kB	-	-
@sentry/browser (incl. Tracing, Replay)	85.62 kB	-	-
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	75.26 kB	-	-
@sentry/browser (incl. Tracing, Replay with Canvas)	90.33 kB	-	-
@sentry/browser (incl. Tracing, Replay, Feedback)	102.99 kB	-	-
@sentry/browser (incl. Feedback)	44.78 kB	-	-
@sentry/browser (incl. sendFeedback)	32.4 kB	-	-
@sentry/browser (incl. FeedbackAsync)	37.53 kB	-	-
@sentry/browser (incl. Metrics)	28.68 kB	-	-
@sentry/browser (incl. Logs)	28.93 kB	-	-
@sentry/browser (incl. Metrics & Logs)	29.61 kB	-	-
@sentry/react	29.39 kB	-	-
@sentry/react (incl. Tracing)	48.62 kB	-	-
@sentry/vue	33.03 kB	-	-
@sentry/vue (incl. Tracing)	48.33 kB	-	-
@sentry/svelte	27.63 kB	-	-
CDN Bundle	30 kB	-	-
CDN Bundle (incl. Tracing)	48.33 kB	-	-
CDN Bundle (incl. Logs, Metrics)	31.58 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics)	49.65 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics)	70.82 kB	-	-
CDN Bundle (incl. Tracing, Replay)	85.84 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	87.16 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback)	91.64 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	92.92 kB	-	-
CDN Bundle - uncompressed	89.33 kB	-	-
CDN Bundle (incl. Tracing) - uncompressed	146.07 kB	-	-
CDN Bundle (incl. Logs, Metrics) - uncompressed	94.03 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	150.05 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	218.76 kB	-	-
CDN Bundle (incl. Tracing, Replay) - uncompressed	265.28 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	269.24 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	278.98 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	282.93 kB	-	-
@sentry/nextjs (client)	51.17 kB	-	-
@sentry/sveltekit (client)	46.8 kB	-	-
@sentry/core/server	78.42 kB	-	-
@sentry/core/browser	64.77 kB	-	-
@sentry/node-core	62.73 kB	-	-
@sentry/node	125.35 kB	-	-
⛔️ @sentry/node (incl. diagnostics channel injection) (max: 142 kB)	142.8 kB	+2.27%	+3.17 kB 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	69.96 kB	-	-
@sentry/node/light	50.73 kB	-	-
@sentry/node - without tracing	74.04 kB	+0.01%	+1 B 🔺
@sentry/aws-serverless	83.26 kB	+0.01%	+4 B 🔺
@sentry/cloudflare (withSentry) - minified	181.47 kB	-	-
@sentry/cloudflare (withSentry)	448.98 kB	-	-

View base workflow run

cursor · 2026-07-09T22:16:21Z

+export function addPropagationFieldsToAttributeNames(messageAttributeNames: string[] = []): string[] {
+  return messageAttributeNames.length
+    ? Array.from(new Set([...messageAttributeNames, ...PROPAGATION_FIELDS]))
+    : [...PROPAGATION_FIELDS];


All breaks ReceiveMessage mutation

High Severity

addPropagationFieldsToAttributeNames always appends sentry-trace and baggage to MessageAttributeNames on ReceiveMessage. When callers pass All (a common way to fetch every message attribute), AWS SQS rejects requests that combine All with other names, so instrumented receives can fail.

Additional Locations (1)

packages/server-utils/src/integrations/tracing-channel/aws-sdk/services/sqs.ts#L39-L42

^{Reviewed by Cursor Bugbot for commit d26e97f. Configure here.}

cursor · 2026-07-09T22:35:41Z

+        };
+        if (request.region) {
+          spanAttributes[ATTR_FAAS_INVOKED_REGION] = request.region;
+        }


Lambda region attribute never set

Medium Severity

faas.invoked_region is only added when request.region is set in requestPreSpanHook, but the orchestrion subscriber always builds the normalized request with region undefined and backfills cloud.region later on the span. Lambda Invoke spans therefore omit faas.invoked_region despite OTel parity expecting it.

^{Reviewed by Cursor Bugbot for commit 711b9bd. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

There are 11 total unresolved issues (including 8 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 47d6cc5. Configure here.}

cursor · 2026-07-10T14:40:42Z

+      debug.warn(
+        '[orchestrion:aws-sdk] cannot set trace propagation on SQS/SNS message due to maximum amount of MessageAttributes',
+      );
+  }


Quota blocks propagation header refresh

Medium Severity

injectPropagationContext rejects injection when Object.keys(attributes).length + headerKeys.length exceeds ten, even when sentry-trace and baggage keys already exist and would only be overwritten. Messages already at the attribute cap then keep stale trace context instead of updating propagation on send.

^{Reviewed by Cursor Bugbot for commit 47d6cc5. Configure here.}

cursor · 2026-07-10T14:40:42Z

+export function addPropagationFieldsToAttributeNames(messageAttributeNames: string[] = []): string[] {
+  return messageAttributeNames.length
+    ? Array.from(new Set([...messageAttributeNames, ...PROPAGATION_FIELDS]))
+    : [...PROPAGATION_FIELDS];


All breaks ReceiveMessage attribute names

Medium Severity

For ReceiveMessage, addPropagationFieldsToAttributeNames merges sentry-trace and baggage into a non-empty MessageAttributeNames list. When that list already contains All, the result violates SQS rules ( All cannot be combined with other names), which can fail or alter receive requests that intentionally request every attribute.

Additional Locations (1)

packages/server-utils/src/integrations/tracing-channel/aws-sdk/services/sqs.ts#L39-L42

^{Reviewed by Cursor Bugbot for commit 47d6cc5. Configure here.}

cursor · 2026-07-10T14:40:42Z

+    this._services.set('SQS', new SqsServiceExtension());
+    this._services.set('SNS', new SnsServiceExtension());
    this._services.set('DynamoDB', new DynamodbServiceExtension());
+    this._services.set('Lambda', new LambdaServiceExtension());


Missing tests for new extensions

Low Severity

This feat change registers SQS, SNS, and Lambda trace propagation but the diff adds no integration or E2E coverage for those behaviors. Per PR review guidelines, new instrumentation like message attribute injection and span links should have at least one test exercising the added paths.

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit 47d6cc5. Configure here.}

…trace propagation Ports the messaging service extensions from the OTel aws-sdk integration to the orchestrion channel integration and registers them in the service registry: - SQS: producer/consumer span kinds and names, `messaging.*` attributes, trace propagation into outgoing `MessageAttributes` (single and batch), and span links from received messages via the propagated headers - SNS: producer span kind/name for `Publish`, `messaging.*` and topic ARN attributes, trace propagation into `MessageAttributes` - Lambda: `faas.*` attributes for `Invoke`, trace propagation into the base64 `ClientContext` (respecting the 3583 byte cap) Propagation writes Sentry-native `sentry-trace`/`baggage` headers derived from the request span instead of OTel `propagation.inject`, and the SQS receive side reads them back with `propagationContextFromHeaders`. Part of #20946 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>