Fix AWS API Gateway endpoints correlation HTTP span tags - Inferred Proxy Spans #10561
+561
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jandro996
added
tag: do not merge
jandro996
force-pushed
the
alejandro.gonzalez/RFC-1081
branch
from
7163ef9 to
85a368c
Compare
jandro996
force-pushed
the
alejandro.gonzalez/RFC-1081
branch
from
c681b6c to
c8a926f
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 63 metrics, 8 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.07 s) : 0, 1069573
Total [baseline] (8.787 s) : 0, 8786767
Agent [candidate] (1.069 s) : 0, 1069159
Total [candidate] (8.767 s) : 0, 8766727
section iast
Agent [baseline] (1.233 s) : 0, 1232581
Total [baseline] (9.393 s) : 0, 9392974
Agent [candidate] (1.239 s) : 0, 1238521
Total [candidate] (9.392 s) : 0, 9392116
gantt
title insecure-bank - break down per module: candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.197 ms) : 0, 1197
crashtracking [candidate] (1.19 ms) : 0, 1190
BytebuddyAgent [baseline] (633.278 ms) : 0, 633278
BytebuddyAgent [candidate] (632.52 ms) : 0, 632520
AgentMeter [baseline] (29.127 ms) : 0, 29127
AgentMeter [candidate] (28.991 ms) : 0, 28991
GlobalTracer [baseline] (258.776 ms) : 0, 258776
GlobalTracer [candidate] (257.821 ms) : 0, 257821
AppSec [baseline] (33.167 ms) : 0, 33167
AppSec [candidate] (32.782 ms) : 0, 32782
Debugger [baseline] (61.767 ms) : 0, 61767
Debugger [candidate] (63.026 ms) : 0, 63026
Remote Config [baseline] (712.741 µs) : 0, 713
Remote Config [candidate] (683.898 µs) : 0, 684
Telemetry [baseline] (10.717 ms) : 0, 10717
Telemetry [candidate] (9.89 ms) : 0, 9890
Flare Poller [baseline] (5.343 ms) : 0, 5343
Flare Poller [candidate] (6.842 ms) : 0, 6842
section iast
crashtracking [baseline] (1.189 ms) : 0, 1189
crashtracking [candidate] (1.191 ms) : 0, 1191
BytebuddyAgent [baseline] (796.737 ms) : 0, 796737
BytebuddyAgent [candidate] (801.246 ms) : 0, 801246
AgentMeter [baseline] (11.253 ms) : 0, 11253
AgentMeter [candidate] (11.511 ms) : 0, 11511
GlobalTracer [baseline] (248.312 ms) : 0, 248312
GlobalTracer [candidate] (249.513 ms) : 0, 249513
AppSec [baseline] (34.959 ms) : 0, 34959
AppSec [candidate] (35.978 ms) : 0, 35978
Debugger [baseline] (65.023 ms) : 0, 65023
Debugger [candidate] (64.135 ms) : 0, 64135
Remote Config [baseline] (533.004 µs) : 0, 533
Remote Config [candidate] (534.076 µs) : 0, 534
Telemetry [baseline] (8.688 ms) : 0, 8688
Telemetry [candidate] (8.497 ms) : 0, 8497
Flare Poller [baseline] (3.524 ms) : 0, 3524
Flare Poller [candidate] (3.444 ms) : 0, 3444
IAST [baseline] (27.0 ms) : 0, 27000
IAST [candidate] (27.033 ms) : 0, 27033
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.065 s) : 0, 1065417
Total [baseline] (10.913 s) : 0, 10912712
Agent [candidate] (1.075 s) : 0, 1075184
Total [candidate] (10.971 s) : 0, 10970869
section appsec
Agent [baseline] (1.248 s) : 0, 1247772
Total [baseline] (11.027 s) : 0, 11026583
Agent [candidate] (1.241 s) : 0, 1240764
Total [candidate] (11.205 s) : 0, 11205240
section iast
Agent [baseline] (1.242 s) : 0, 1241511
Total [baseline] (11.245 s) : 0, 11245270
Agent [candidate] (1.241 s) : 0, 1240602
Total [candidate] (11.154 s) : 0, 11153576
section profiling
Agent [baseline] (1.192 s) : 0, 1192038
Total [baseline] (11.052 s) : 0, 11052147
Agent [candidate] (1.191 s) : 0, 1191421
Total [candidate] (11.049 s) : 0, 11048673
gantt
title petclinic - break down per module: candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.176 ms) : 0, 1176
crashtracking [candidate] (1.218 ms) : 0, 1218
BytebuddyAgent [baseline] (628.562 ms) : 0, 628562
BytebuddyAgent [candidate] (634.861 ms) : 0, 634861
AgentMeter [baseline] (28.992 ms) : 0, 28992
AgentMeter [candidate] (29.264 ms) : 0, 29264
GlobalTracer [baseline] (257.72 ms) : 0, 257720
GlobalTracer [candidate] (260.332 ms) : 0, 260332
AppSec [baseline] (32.616 ms) : 0, 32616
AppSec [candidate] (32.969 ms) : 0, 32969
Debugger [baseline] (63.518 ms) : 0, 63518
Debugger [candidate] (62.623 ms) : 0, 62623
Remote Config [baseline] (619.389 µs) : 0, 619
Remote Config [candidate] (643.601 µs) : 0, 644
Telemetry [baseline] (11.491 ms) : 0, 11491
Telemetry [candidate] (12.298 ms) : 0, 12298
Flare Poller [baseline] (5.373 ms) : 0, 5373
Flare Poller [candidate] (5.37 ms) : 0, 5370
section appsec
crashtracking [baseline] (1.217 ms) : 0, 1217
crashtracking [candidate] (1.189 ms) : 0, 1189
BytebuddyAgent [baseline] (662.918 ms) : 0, 662918
BytebuddyAgent [candidate] (658.721 ms) : 0, 658721
AgentMeter [baseline] (12.028 ms) : 0, 12028
AgentMeter [candidate] (11.974 ms) : 0, 11974
GlobalTracer [baseline] (259.878 ms) : 0, 259878
GlobalTracer [candidate] (258.744 ms) : 0, 258744
AppSec [baseline] (168.927 ms) : 0, 168927
AppSec [candidate] (168.067 ms) : 0, 168067
Debugger [baseline] (67.819 ms) : 0, 67819
Debugger [candidate] (67.03 ms) : 0, 67030
Remote Config [baseline] (662.977 µs) : 0, 663
Remote Config [candidate] (660.278 µs) : 0, 660
Telemetry [baseline] (9.605 ms) : 0, 9605
Telemetry [candidate] (9.806 ms) : 0, 9806
Flare Poller [baseline] (3.748 ms) : 0, 3748
Flare Poller [candidate] (3.862 ms) : 0, 3862
IAST [baseline] (25.441 ms) : 0, 25441
IAST [candidate] (25.259 ms) : 0, 25259
section iast
crashtracking [baseline] (1.186 ms) : 0, 1186
crashtracking [candidate] (1.19 ms) : 0, 1190
BytebuddyAgent [baseline] (802.518 ms) : 0, 802518
BytebuddyAgent [candidate] (802.449 ms) : 0, 802449
AgentMeter [baseline] (11.397 ms) : 0, 11397
AgentMeter [candidate] (11.543 ms) : 0, 11543
GlobalTracer [baseline] (249.947 ms) : 0, 249947
GlobalTracer [candidate] (249.807 ms) : 0, 249807
AppSec [baseline] (34.828 ms) : 0, 34828
AppSec [candidate] (33.981 ms) : 0, 33981
Debugger [baseline] (66.113 ms) : 0, 66113
Debugger [candidate] (66.612 ms) : 0, 66612
Remote Config [baseline] (540.544 µs) : 0, 541
Remote Config [candidate] (533.011 µs) : 0, 533
Telemetry [baseline] (8.607 ms) : 0, 8607
Telemetry [candidate] (8.502 ms) : 0, 8502
Flare Poller [baseline] (3.503 ms) : 0, 3503
Flare Poller [candidate] (3.4 ms) : 0, 3400
IAST [baseline] (27.159 ms) : 0, 27159
IAST [candidate] (27.104 ms) : 0, 27104
section profiling
crashtracking [baseline] (1.215 ms) : 0, 1215
crashtracking [candidate] (1.216 ms) : 0, 1216
BytebuddyAgent [baseline] (683.037 ms) : 0, 683037
BytebuddyAgent [candidate] (682.615 ms) : 0, 682615
AgentMeter [baseline] (8.59 ms) : 0, 8590
AgentMeter [candidate] (8.62 ms) : 0, 8620
GlobalTracer [baseline] (215.727 ms) : 0, 215727
GlobalTracer [candidate] (216.042 ms) : 0, 216042
AppSec [baseline] (32.478 ms) : 0, 32478
AppSec [candidate] (32.681 ms) : 0, 32681
Debugger [baseline] (67.669 ms) : 0, 67669
Debugger [candidate] (67.202 ms) : 0, 67202
Remote Config [baseline] (621.782 µs) : 0, 622
Remote Config [candidate] (625.636 µs) : 0, 626
Telemetry [baseline] (8.951 ms) : 0, 8951
Telemetry [candidate] (8.995 ms) : 0, 8995
Flare Poller [baseline] (3.692 ms) : 0, 3692
Flare Poller [candidate] (3.735 ms) : 0, 3735
ProfilingAgent [baseline] (100.08 ms) : 0, 100080
ProfilingAgent [candidate] (99.799 ms) : 0, 99799
Profiling [baseline] (100.665 ms) : 0, 100665
Profiling [candidate] (100.362 ms) : 0, 100362
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 7 performance regressions! Performance is the same for 12 metrics, 17 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section baseline
no_agent (19.223 ms) : 19024, 19422
. : milestone, 19223,
appsec (18.412 ms) : 18226, 18599
. : milestone, 18412,
code_origins (17.649 ms) : 17477, 17821
. : milestone, 17649,
iast (17.9 ms) : 17723, 18076
. : milestone, 17900,
profiling (18.741 ms) : 18558, 18923
. : milestone, 18741,
tracing (18.302 ms) : 18116, 18487
. : milestone, 18302,
section candidate
no_agent (18.026 ms) : 17839, 18213
. : milestone, 18026,
appsec (18.564 ms) : 18374, 18754
. : milestone, 18564,
code_origins (17.694 ms) : 17516, 17871
. : milestone, 17694,
iast (19.012 ms) : 18823, 19201
. : milestone, 19012,
profiling (18.813 ms) : 18624, 19001
. : milestone, 18813,
tracing (19.81 ms) : 19609, 20011
. : milestone, 19810,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section baseline
no_agent (1.182 ms) : 1171, 1194
. : milestone, 1182,
iast (3.02 ms) : 2982, 3059
. : milestone, 3020,
iast_FULL (5.679 ms) : 5622, 5735
. : milestone, 5679,
iast_GLOBAL (3.52 ms) : 3459, 3581
. : milestone, 3520,
profiling (2.326 ms) : 2302, 2350
. : milestone, 2326,
tracing (1.742 ms) : 1728, 1756
. : milestone, 1742,
section candidate
no_agent (1.252 ms) : 1238, 1266
. : milestone, 1252,
iast (3.179 ms) : 3138, 3220
. : milestone, 3179,
iast_FULL (5.909 ms) : 5850, 5968
. : milestone, 5909,
iast_GLOBAL (3.51 ms) : 3455, 3565
. : milestone, 3510,
profiling (2.43 ms) : 2404, 2456
. : milestone, 2430,
tracing (1.814 ms) : 1798, 1830
. : milestone, 1814,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section baseline
no_agent (14.806 s) : 14806000, 14806000
. : milestone, 14806000,
appsec (14.853 s) : 14853000, 14853000
. : milestone, 14853000,
iast (18.364 s) : 18364000, 18364000
. : milestone, 18364000,
iast_GLOBAL (17.932 s) : 17932000, 17932000
. : milestone, 17932000,
profiling (14.722 s) : 14722000, 14722000
. : milestone, 14722000,
tracing (14.661 s) : 14661000, 14661000
. : milestone, 14661000,
section candidate
no_agent (14.829 s) : 14829000, 14829000
. : milestone, 14829000,
appsec (14.971 s) : 14971000, 14971000
. : milestone, 14971000,
iast (17.933 s) : 17933000, 17933000
. : milestone, 17933000,
iast_GLOBAL (17.822 s) : 17822000, 17822000
. : milestone, 17822000,
profiling (15.043 s) : 15043000, 15043000
. : milestone, 15043000,
tracing (15.09 s) : 15090000, 15090000
. : milestone, 15090000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.60.0-SNAPSHOT~06ba1cf584, baseline=1.60.0-SNAPSHOT~f3e5e5b89b
dateFormat X
axisFormat %s
section baseline
no_agent (1.478 ms) : 1466, 1489
. : milestone, 1478,
appsec (3.739 ms) : 3520, 3957
. : milestone, 3739,
iast (2.257 ms) : 2188, 2326
. : milestone, 2257,
iast_GLOBAL (2.308 ms) : 2238, 2377
. : milestone, 2308,
profiling (2.079 ms) : 2024, 2133
. : milestone, 2079,
tracing (2.067 ms) : 2013, 2120
. : milestone, 2067,
section candidate
no_agent (1.48 ms) : 1469, 1492
. : milestone, 1480,
appsec (3.772 ms) : 3551, 3993
. : milestone, 3772,
iast (2.257 ms) : 2188, 2325
. : milestone, 2257,
iast_GLOBAL (2.299 ms) : 2230, 2368
. : milestone, 2299,
profiling (2.088 ms) : 2033, 2143
. : milestone, 2088,
tracing (2.077 ms) : 2023, 2130
. : milestone, 2077,
|
jandro996
force-pushed
the
alejandro.gonzalez/rfc-1076
branch
from
35abdf1 to
9e4cfe6
Compare
jandro996
requested review from
daniel-romano-DD,
manuel-alvarez-alvarez and
smola
Contributor
|
Hi! 👋 Thanks for your pull request! 🎉 To help us review it, please make sure to:
If you need help, please check our contributing guidelines. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06ba1cf584
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // Http.url - value of x-dd-proxy-domain-name + x-dd-proxy-path | ||
| span.setTag(HTTP_URL, domainName != null ? domainName + path : path); | ||
| // Http.url - https:// + x-dd-proxy-domain-name + x-dd-proxy-path | ||
| span.setTag(HTTP_URL, domainName != null ? "https://" + domainName + path : path); |
There was a problem hiding this comment.
This now treats any non-null x-dd-proxy-domain-name as usable, so an empty header value produces http.url like https:///path instead of a valid path-only URL. The code already treats empty domain as missing for service-name fallback, and before this change an empty domain naturally yielded just path; this regression can generate malformed URL tags and hurt endpoint correlation/parsing when gateways forward blank domain headers.
Useful? React with 👍 / 👎.
Comment on lines
+212
to
+213
| if (rootSpan != null && rootSpan != this.span) { | ||
| // Copy _dd.appsec.enabled metric (always 1 if present) |
There was a problem hiding this comment.
The new AppSec copy path is gated on rootSpan != this.span, but inferred proxy spans are created before the framework server span in HttpServerDecorator.startSpan, so for incoming distributed requests this inferred span is typically the local root and the condition is false. In the exact distributed-tracing scenario this change targets, _dd.appsec.enabled/_dd.appsec.json therefore never get copied, making the new propagation behavior ineffective.
Useful? React with 👍 / 👎.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
This PR implements standardized tags for inferred proxy spans produced by the Java tracer when instrumenting AWS API Gateway (v1 REST and v2 HTTP APIs). The changes align proxy spans with the cross-platform contract defined in RFC-1081 for endpoint discovery and correlation.
Mandatory tags implemented:
aws.httpapi(v2 HTTP API) in addition toaws.apigateway(v1 REST API)serverfor all proxy spansweb, maintained for consistencyhttps://scheme (prevents backend parsing issues)x-dd-proxy-resource-pathheader (resource template path)<Method> <Route>when route available, fallback to<Method> <Path>_dd.appsec.enabledmetric and_dd.appsec.jsontag from root span to proxy span in distributed tracing scenariosOptional tags implemented:
x-dd-proxy-account-idheaderx-dd-proxy-api-idheaderx-dd-proxy-regionheaderarn:aws:apigateway:{region}::/restapis|apis/{api-id}Motivation
This implementation is required by RFC-1081: Endpoint Discovery & Correlation from Inferred Spans
This PR covers the Inferred Proxy Spans portion of the RFC. The Inferred Lambda Spans portion will be addressed in a separate PR.
Additional Notes
aws_user exclusion: The optional
aws_usertag was intentionally excluded per RFC guidance due to PII concerns (assumed-role session names may contain user identifiers). Implementation requires explicit approval.Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-61198
Note: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.