datadog-lambda 3.28.0 → 3.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e2d8635a06b2c62e65a431f5fede05eb2f2de447fe310541a62dfbdbedc41b5
-  data.tar.gz: 6fc01a5fa9b25beb6296a2127de07962ea2cb2166b738c4e32a69a8d0acd9e28
+  metadata.gz: 16d17173aa40606df94b042f5b548443b57bc2d548a5da80d984c59a377ddcd5
+  data.tar.gz: 8ea8bf2a3559c0748405f249f169581783fb1e0a1ab23703378b119abc8362a8
 SHA512:
-  metadata.gz: d7f386673cb7bf6ec500e7b144821d811921129a853f21d96a9cf54804321f17bd2ce18fdd420f272f77f192f581d983b6d2d079d97bfb5179252cc026d6f32f
-  data.tar.gz: e9f6f80d1330d0ef908c11035c89f23ba3c4460a6de7f51f3c25cee65813fdf3ff17877836d649421144b457820b23cb79a08e9309b2eb7dfb2ab58b0ce2a105
+  metadata.gz: f117a37f4d08a925ff382dc29b01d89d73216351e3ea6452fcb98debeba8a0c07b2cc5b004526c19e8f47bca25034cf3134466c93813d2844df8a36e889d7a1f
+  data.tar.gz: b6ea614f6057797c8af1e1ba3385c2fd744fe4c346d9ce3d1cafd21eceb98ff247d312b460f17f63322d6324b9e6940c96d2fe22d29c047f6660a03e0e2b710d

data/lib/datadog/lambda/appsec/event_normalizer.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Normalizes API Gateway v1/v2 event payloads into a standard key set.
+      #
+      # NOTE: The REST API (v1) event does NOT have a version field.
+      #       Only the HTTP API events have "version": "1.0" or "version": "2.0".
+      #
+      # @see https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html#http-api-develop-integrations-lambda.proxy-format-structure
+      module EventNormalizer
+        module_function
+
+        def normalize(event)
+          event.key?('httpMethod') ? normalize_v1(event) : normalize_v2(event)
+        end
+
+        def normalize_v1(event)
+          data = {
+            'method' => event['httpMethod'],
+            'path' => event['path'],
+            'headers' => event['headers'],
+            'query' => event['multiValueQueryStringParameters'] || event['queryStringParameters'],
+            'source_ip' => event.dig('requestContext', 'identity', 'sourceIp'),
+            'body' => event['body'],
+            'base64_encoded' => event['isBase64Encoded'],
+            'path_params' => event['pathParameters']
+          }
+          data.compact!
+          data
+        end
+
+        def normalize_v2(event)
+          data = {
+            'method' => event.dig('requestContext', 'http', 'method'),
+            'path' => event['rawPath'],
+            'headers' => event['headers'],
+            'cookies' => event['cookies'],
+            'query' => event['queryStringParameters'],
+            'query_string' => event['rawQueryString'],
+            'source_ip' => event.dig('requestContext', 'http', 'sourceIp'),
+            'body' => event['body'],
+            'base64_encoded' => event['isBase64Encoded'],
+            'path_params' => event['pathParameters']
+          }
+          data.compact!
+          data
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec/request.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Minimal request object for AppSec event recording.
+      #
+      # WARNING: It's a minimal data for interface compliance
+      #
+      # @see Datadog::AppSec::Event.record
+      # @see Datadog::AppSec::Contrib::Rack::Gateway::Request
+      class Request
+        attr_reader :host, :user_agent, :remote_addr, :headers,
+                    :request_method, :path
+
+        class << self
+          def from_normalized(event)
+            new(
+              remote_addr: event['source_ip'],
+              headers: lowercase_headers(event),
+              request_method: event['method'],
+              path: event['path']
+            )
+          end
+
+          private
+
+          def lowercase_headers(event)
+            (event['headers'] || {}).each_with_object({}) do |(key, value), hash|
+              hash[key.downcase] = value
+            end
+          end
+        end
+
+        def initialize(remote_addr:, headers:, request_method:, path:)
+          @headers = headers
+          @host = headers['host']
+          @user_agent = headers['user-agent']
+          @remote_addr = remote_addr
+          @request_method = request_method
+          @path = path
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec/response.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Minimal response object for AppSec event recording.
+      #
+      # WARNING: It's a minimal data for interface compliance
+      #
+      # @see Datadog::AppSec::APISecurity.sample?
+      # @see Datadog::AppSec::Contrib::Rack::Gateway::Response
+      class Response
+        attr_reader :status, :headers, :body
+
+        def self.from_normalized(normalized)
+          new(
+            status: normalized['status_code'].to_i,
+            headers: normalized['headers'] || {},
+            body: normalized['body']
+          )
+        end
+
+        def initialize(status:, headers:, body:)
+          @status = status
+          @headers = headers
+          @body = body
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec/response_normalizer.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Normalizes Lambda handler return values into a standard key set.
+      #
+      # @see https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-proxy-integrations.html#api-gateway-simple-proxy-for-lambda-output-format
+      module ResponseNormalizer
+        module_function
+
+        def normalize(response)
+          data = {
+            'status_code' => response['statusCode'],
+            'headers' => merge_headers(response),
+            'body' => response['body'],
+            'base64_encoded' => response['isBase64Encoded']
+          }
+          data.compact!
+          data
+        end
+
+        # Merges single-value and multi-value headers into one hash with
+        # multi-value entries take priority when a key appears in both.
+        def merge_headers(response)
+          headers = response['headers']
+          multi_headers = response['multiValueHeaders']
+
+          return headers unless multi_headers
+          return multi_headers unless headers
+
+          headers.merge(multi_headers)
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec/tagging.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'json'
+
+require 'datadog/tracing/client_ip'
+require 'datadog/core/header_collection'
+require 'datadog/appsec/default_header_tags'
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Applies AppSec request, response, and keep-decision tags to the Lambda span
+      module Tagging
+        module_function
+
+        def tag_request(request, context:)
+          span = context.span
+          return unless span
+
+          headers = Datadog::Core::HeaderCollection.from_hash(request.headers)
+          Datadog::AppSec::DefaultHeaderTags.tag_request(span, headers)
+
+          return if span.get_tag(Datadog::Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP)
+
+          Datadog::Tracing::ClientIp.set_client_ip_tag!(
+            span, headers: headers, remote_ip: request.remote_addr
+          )
+        end
+
+        def tag_response(response, context:)
+          span = context.span
+          return unless span
+
+          headers = Datadog::Core::HeaderCollection.from_hash(response.headers)
+          Datadog::AppSec::DefaultHeaderTags.tag_response(span, headers)
+
+          return if headers.get('content-length')
+
+          if (body = response.body)
+            span.set_tag('http.response.headers.content-length', body.bytesize.to_s)
+          end
+        end
+
+        def tag_and_keep(context, cold_start:)
+          span = context.span
+          trace = context.trace
+
+          return unless trace && span
+
+          span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
+          span.set_tag('_dd.runtime_family', 'ruby')
+          span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+
+          ruleset_version = context.waf_runner_ruleset_version
+          return unless ruleset_version
+
+          span.set_tag('_dd.appsec.event_rules.version', ruleset_version)
+
+          return unless cold_start
+
+          trace.keep!
+          trace.set_tag(
+            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Datadog::Tracing::Sampling::Ext::Decision::ASM
+          )
+          span.set_tag(
+            '_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require 'datadog/appsec/api_security'
+
+require_relative 'appsec/tagging'
+require_relative 'appsec/request'
+require_relative 'appsec/response'
+require_relative 'appsec/event_normalizer'
+require_relative 'appsec/response_normalizer'
+
+module Datadog
+  module Lambda
+    # AppSec integration for AWS Lambda invocations.
+    module AppSec
+      class << self
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        def on_start(event, trace:, span:, cold_start: false)
+          @request = nil
+          return unless enabled?
+
+          context = create_context(trace, span)
+          return unless Datadog::AppSec::Context.active
+
+          Tagging.tag_and_keep(context, cold_start: cold_start)
+
+          event = EventNormalizer.normalize(event)
+          @request = Request.from_normalized(event)
+
+          Tagging.tag_request(@request, context: context)
+          payload = Datadog::AppSec::Instrumentation::Gateway::DataContainer.new(
+            event, context: context
+          )
+
+          interrupt_params = catch(Datadog::AppSec::Ext::INTERRUPT) do
+            Datadog::AppSec::Instrumentation.gateway.push('aws_lambda.request.start', payload)
+            nil
+          end
+
+          return unless interrupt_params
+
+          context.mark_as_interrupted!
+          response_override(interrupt_params, headers: @request.headers)
+        rescue StandardError => e
+          Datadog::AppSec::Context.deactivate if context
+          Datadog::Utils.logger.debug("failed to start AppSec: #{e}")
+        end
+        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
+
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity
+        def on_finish(response)
+          return unless enabled?
+
+          context = Datadog::AppSec::Context.active
+          return unless context
+
+          normalized = ResponseNormalizer.normalize(response)
+          response = Response.from_normalized(normalized)
+
+          interrupt_params = nil
+          unless context.interrupted?
+            Tagging.tag_response(response, context: context)
+            payload = Datadog::AppSec::Instrumentation::Gateway::DataContainer.new(
+              normalized, context: context
+            )
+
+            interrupt_params = catch(Datadog::AppSec::Ext::INTERRUPT) do
+              Datadog::AppSec::Instrumentation.gateway.push('aws_lambda.response.start', payload)
+              nil
+            end
+
+            context.mark_as_interrupted! if interrupt_params
+          end
+
+          extract_api_security_schema(context, request: @request, response: response)
+
+          Datadog::AppSec::Event.record(context, request: @request)
+          context.export_metrics
+          context.export_request_telemetry
+
+          response_override(interrupt_params, headers: @request.headers) if interrupt_params
+        rescue StandardError => e
+          Datadog::Utils.logger.debug "failed to finish AppSec: #{e}"
+        ensure
+          Datadog::AppSec::Context.deactivate if context
+        end
+        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity
+
+        def catch_interrupt
+          interrupt_params = catch(Datadog::AppSec::Ext::INTERRUPT) { return yield }
+
+          if (context = Datadog::AppSec::Context.active)
+            context.mark_as_interrupted!
+          end
+
+          response_override(interrupt_params, headers: @request.headers)
+        end
+
+        private
+
+        def extract_api_security_schema(context, request:, response:)
+          return unless request && response
+
+          if Datadog::AppSec::APISecurity.enabled? &&
+             Datadog::AppSec::APISecurity.sample_trace?(context.trace) &&
+             Datadog::AppSec::APISecurity.sample?(request, response)
+            context.extract_schema!
+          end
+        end
+
+        def enabled?
+          defined?(Datadog::AppSec) &&
+            Datadog::AppSec.respond_to?(:enabled?) &&
+            Datadog::AppSec.enabled?
+        end
+
+        def create_context(trace, span)
+          return if trace.nil? || span.nil?
+
+          security_engine = Datadog::AppSec.security_engine
+          return unless security_engine
+
+          context = Datadog::AppSec::Context.new(trace, span, security_engine.new_runner)
+          Datadog::AppSec::Context.activate(context)
+
+          context
+        end
+
+        def response_override(interrupt_params, headers:)
+          response = Datadog::AppSec::Response.from_interrupt_params(
+            interrupt_params, headers['accept']
+          )
+
+          {
+            'statusCode' => response.status,
+            'headers' => response.headers,
+            'body' => response.body.join
+          }
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/trace/listener.rb

@@ -11,11 +11,16 @@
 require 'datadog/lambda/trace/context'
 require 'datadog/lambda/trace/patch_http'
 require 'datadog/lambda/trace/ddtrace'
+require 'datadog/lambda/appsec'
 
 module Datadog
   module Trace
     # TraceListener tracks tracing context information
     class Listener
+      # AppSec blocking response that replaces the handler result.
+      # Set during either on_start or on_end when WAF decides to block.
+      attr_reader :response_override
+
       @trace = nil
       def initialize(handler_name:, function_name:, patch_http:,
                      merge_xray_traces:)
@@ -50,10 +55,21 @@ module Datadog
         @trace = Datadog::Tracing.trace('aws.lambda', **options)
 
         Datadog::Trace.apply_datadog_trace_context(Datadog::Trace.trace_context)
+        @response_override = Datadog::Lambda::AppSec.on_start(
+          event, trace: Datadog::Tracing.active_trace, span: @trace, cold_start: cold_start
+        )
       end
       # rubocop:enable Metrics/AbcSize
 
+      def with_appsec(&block)
+        @response_override || Datadog::Lambda::AppSec.catch_interrupt(&block)
+      end
+
       def on_end(response:, request_context:)
+        if (override = Datadog::Lambda::AppSec.on_finish(response))
+          @response_override = override
+        end
+
         Datadog::Utils.send_end_invocation_request(response:, span_id: @trace.id, request_context:)
         @trace&.finish
       end

data/lib/datadog/lambda/version.rb

@@ -12,7 +12,7 @@ module Datadog
   module Lambda
     module VERSION
       MAJOR = 3
-      MINOR = 28
+      MINOR = 30
       PATCH = 0
       PRE = nil
 

data/lib/datadog/lambda.rb

@@ -29,6 +29,8 @@ module Datadog
     # Configures Datadog's APM tracer with lambda specific defaults.
     # Same options can be given as Datadog.configure in tracer
     # See https://github.com/DataDog/dd-trace-rb/blob/master/docs/GettingStarted.md#quickstart-for-ruby-applications
+    #
+    # rubocop:disable Metrics/AbcSize
     def self.configure_apm
       require 'datadog/tracing'
       require 'datadog/tracing/transport/io'
@@ -48,30 +50,37 @@ module Datadog
         c.tracing.instrument :aws if trace_managed_services?
 
         yield(c) if block_given?
+
+        c.appsec.instrument(:aws_lambda)
       end
     end
+    # rubocop:enable Metrics/AbcSize
 
     # Wrap the body of a lambda invocation
     # @param event [Object] event sent to lambda
     # @param context [Object] lambda context
     # @param block [Proc] implementation of the handler function.
+    # rubocop:disable Metrics/CyclomaticComplexity
     def self.wrap(event, context, &block)
+      @response = nil
       @listener ||= initialize_listener
       record_enhanced('invocations', context)
       begin
         cold = @is_cold_start
         @listener&.on_start(event:, request_context: context, cold_start: cold)
-        @response = block.call
+        @response = @listener ? @listener.with_appsec(&block) : block.call
       rescue StandardError => e
         record_enhanced('errors', context)
         raise e
       ensure
         @listener&.on_end(response: @response, request_context: context)
+        @response = @listener&.response_override || @response
         @is_cold_start = false
         @metrics_client.close
       end
       @response
     end
+    # rubocop:enable Metrics/CyclomaticComplexity
 
     # Gets the current tracing context
     def self.trace_context

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: datadog-lambda
 version: !ruby/object:Gem::Version
-  version: 3.28.0
+  version: 3.30.0
 platform: ruby
 authors:
 - Datadog, Inc.
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-14 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-xray-sdk
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.30'
+        version: '2.40'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.30'
+        version: '2.40'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -119,6 +119,12 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/datadog/lambda.rb
+- lib/datadog/lambda/appsec.rb
+- lib/datadog/lambda/appsec/event_normalizer.rb
+- lib/datadog/lambda/appsec/request.rb
+- lib/datadog/lambda/appsec/response.rb
+- lib/datadog/lambda/appsec/response_normalizer.rb
+- lib/datadog/lambda/appsec/tagging.rb
 - lib/datadog/lambda/metrics.rb
 - lib/datadog/lambda/trace/constants.rb
 - lib/datadog/lambda/trace/context.rb
@@ -134,7 +140,7 @@ licenses:
 - Apache-2.0
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -149,8 +155,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.5
-signing_key: 
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: Instruments your Ruby AWS Lambda functions with Datadog
 test_files: []