[APPSEC-61865] Add inferred span and AppSec calls for API Gateway by Strech · Pull Request #136 · DataDog/datadog-lambda-rb

Strech · 2026-03-25T15:23:02Z

What does this PR do?

Compute inferred span for AWS Lambda that suppose to be a service-entry span. In addition - initialize AppSec component (if possible), push events to it and flush captured security events.

Motivation

Part of Endpoint Discovery & Correlation from Inferred Spans RFC

Testing Guidelines

Additional Notes

I would need some assistance to get more context over testing.

Types of changes

Bug fix
New feature
Breaking change
Misc (docs, refactoring, dependency upgrade, etc.)

Remove all AppSec lifecycle management (context creation, Event.record, export_metrics, Context.deactivate) — now owned by dd-trace-rb watcher. Listener becomes a dumb data provider: just pushes raw event/response hashes. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Lambda::AppSec owns full context lifecycle (create, activate, record, export, deactivate). Lambda::Trace::InferredSpan owns span creation and finishing. Listener becomes thin orchestrator. AppSec context now targets the inferred span (service-entry), so tags land there directly — tag propagation hack removed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Remove [DEBUG:inject_appsec] debug logging from inject_appsec_data - Restore removed comments in send_end_invocation_request - Revert unnecessary ::Datadog:: namespace prefixes in lambda.rb Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…vices check F29: Move `instrument(:aws_lambda)` from per-invocation `AppSec.on_start` to `configure_apm` after yield block. The `instrument` method is a no-op when appsec is disabled (checks `enabled` internally), so no guard needed. Matches Python's pattern of one-time initialization. F30: Reuse `Datadog::Lambda.trace_managed_services?` in InferredSpan instead of duplicating the ENV reading logic. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

F31: 44 new examples covering: - AppSec.on_start: enabled/disabled, context creation, gateway push, fallback to active trace/span, missing security engine, error handling - AppSec.on_finish: no active context, gateway push, Event.record, metrics/telemetry export, context deactivation, deactivation on error - InferredSpan.create: managed services disabled, non-hash events, missing requestContext/stage/httpMethod, v1 span name/tags/resource_key, v2 span name/tags/resource_key, trace_digest continuation, empty domain, error handling - InferredSpan.finish: nil span, statusCode tagging, non-hash response, nil response, error handling Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

F25: `Datadog::Tracing.trace()` returns a SpanOperation, not a TraceOperation. Rename `@trace` to `@span` in Listener to reflect the actual type. Remove stale class-level `@trace = nil`. AppSec.on_start now always uses `Datadog::Tracing.active_trace` for the TraceOperation (matching Rack's RequestMiddleware pattern) and receives only the target span (inferred span) as an argument, with fallback to `active_span`. F26: Pass `@inferred_span || @span` to `inject_appsec_data` so the extension reads tags from the span where AppSec actually sets them. F32: Variable renamed from `@trace` to `@span`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Rewrite specs to test behavior instead of internals * Remove obsolete appsec files

Split the god method into ApiGatewayV1/V2 parser classes with a uniform interface, and rewire InferredSpan.create as a PARSERS dispatcher + build_span builder. Existing behavior tests pass unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

http.status_code on the inferred span is not in the RFC and not checked by system tests. Without it, finish() just delegates to span.finish — the listener now calls @inferred_span&.finish directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Removes hidden dependency on Datadog::Tracing.active_trace and active_span — the listener now passes both explicitly. Span selection policy (prefer inferred span over lambda span) moves to the caller. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

DD_TRACE_MANAGED_SERVICES controls outbound AWS SDK call tracing, not inbound inferred spans. The guard was added by mistake during extraction. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…nstants Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…in continue_from test Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Strech and others added 15 commits March 18, 2026 17:44

EXPERIMENTAL

04ef96d

EXPERIMENTAL Add appsec to the request flow

1da82aa

EXPERIMENTAL Add inferred span

0b6c3da

Remove unnecessary change

7596aee

Remove appsec request headers injection

84cb13f

Ignore test/ directory in RuboCop

9851294

Move InferredSpan outside of Trace folder

8790c58

* Rewrite specs to test behavior instead of internals * Remove obsolete appsec files