dd-trace 5.108.0 → 5.110.0

package/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js

@@ -0,0 +1,114 @@
+'use strict'
+
+const { storage } = require('../../datadog-core')
+const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const { addOpMeta, unwrapDurableError } = require('./util')
+
+// Span names whose direct children must keep the default resource.
+// These can have very high cardinality which is undesireable in the resource.
+const HIGH_CARDINALITY_PARENT_SPAN_NAMES = new Set([
+  'aws.durable.map',
+  'aws.durable.parallel',
+])
+
+// The SDK emits these subTypes as internal scaffolding around map/parallel iterations
+// and waitForCallback; not user-visible operations.
+const SUPPRESSED_CHILD_CONTEXT_SUBTYPES = new Set([
+  'Map',
+  'Parallel',
+  'MapIteration',
+  'ParallelBranch',
+  'WaitForCallback',
+])
+
+class BaseContextPlugin extends TracingPlugin {
+  static id = 'aws-durable-execution-sdk-js'
+  static type = 'serverless'
+  static kind = 'internal'
+
+  constructor (...args) {
+    super(...args)
+    this.addSub(this.constructor.settleChannel, ctx => this.settle(ctx))
+  }
+
+  bindStart (ctx) {
+    const spanName = this.constructor.spanName
+    const parentName = this.activeSpan?.context()._name
+    const operationName = this.getOperationName(ctx)
+    const resource = HIGH_CARDINALITY_PARENT_SPAN_NAMES.has(parentName) ? undefined : operationName
+
+    const meta = {}
+    if (operationName) {
+      meta['aws.durable.operation_name'] = operationName
+    }
+    addOpMeta(meta, ctx.self)
+
+    this.startSpan(spanName, {
+      resource,
+      kind: this.constructor.kind,
+      meta,
+    }, ctx)
+
+    return ctx.currentStore
+  }
+
+  // All context methods have two overloads: method(name, …) and method(…); args[0] is the name in the first form.
+  getOperationName (ctx) {
+    const args = ctx.arguments || []
+    return typeof args[0] === 'string' ? args[0] : undefined
+  }
+
+  settle (ctx) {
+    if (ctx.suppressed) return
+    if (ctx.error !== undefined) {
+      ctx.currentStore?.span?.setTag('error', unwrapDurableError(ctx))
+    }
+    this.finish(ctx)
+  }
+
+  error (ctxOrError) {
+    this.settle(ctxOrError)
+  }
+}
+
+function makeContextPlugin (method, spanName) {
+  return class extends BaseContextPlugin {
+    static prefix = `tracing:orchestrion:@aws/durable-execution-sdk-js:DurableContextImpl_${method}`
+    static settleChannel = `apm:aws-durable-execution-sdk-js:${method}:settle`
+    static spanName = spanName
+  }
+}
+
+class RunInChildContextPlugin extends BaseContextPlugin {
+  static prefix = 'tracing:orchestrion:@aws/durable-execution-sdk-js:DurableContextImpl_runInChildContext'
+  static settleChannel = 'apm:aws-durable-execution-sdk-js:runInChildContext:settle'
+  static spanName = 'aws.durable.child_context'
+
+  bindStart (ctx) {
+    if (SUPPRESSED_CHILD_CONTEXT_SUBTYPES.has(getRunInChildContextSubType(ctx))) {
+      // Pass the active store through unchanged so any nested spans
+      // remain parented to the surrounding map/parallel span
+      ctx.suppressed = true
+      return storage('legacy').getStore()
+    }
+    return super.bindStart(ctx)
+  }
+}
+
+// runInChildContext has two overloads: `(name, fn, options)` and `(fn, options)`.
+function getRunInChildContextSubType (ctx) {
+  const args = ctx.arguments || []
+  const opts = typeof args[0] === 'function' ? args[1] : args[2]
+  return opts?.subType
+}
+
+module.exports = {
+  step: makeContextPlugin('step', 'aws.durable.step'),
+  wait: makeContextPlugin('wait', 'aws.durable.wait'),
+  waitForCondition: makeContextPlugin('waitForCondition', 'aws.durable.wait_for_condition'),
+  waitForCallback: makeContextPlugin('waitForCallback', 'aws.durable.wait_for_callback'),
+  createCallback: makeContextPlugin('createCallback', 'aws.durable.create_callback'),
+  map: makeContextPlugin('map', 'aws.durable.map'),
+  parallel: makeContextPlugin('parallel', 'aws.durable.parallel'),
+  runInChildContext: RunInChildContextPlugin,
+}

package/packages/datadog-plugin-aws-durable-execution-sdk-js/src/handler.js

@@ -0,0 +1,128 @@
+'use strict'
+
+const log = require('../../dd-trace/src/log')
+const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const { saveTraceContextCheckpointIfUpdated } = require('./trace-checkpoint')
+
+// Termination reasons that indicate the execution is suspending rather than exiting permanently.
+// Sourced from (`@aws/durable-execution-sdk-js`'s termination-manager/types.ts).
+const PENDING_TERMINATION_REASONS = new Set([
+  'OPERATION_TERMINATED',
+  'RETRY_SCHEDULED',
+  'RETRY_INTERRUPTED_STEP',
+  'WAIT_SCHEDULED',
+  'CALLBACK_PENDING',
+  'CUSTOM',
+])
+
+const DEFAULT_TERMINATION_REASON = 'OPERATION_TERMINATED'
+
+// Published by the instrumentation when the SDK's terminationManager.terminate() is called.
+// The instrumentation owns the wrapping; this plugin only reacts.
+const TERMINATE_CHANNEL = 'apm:aws-durable-execution-sdk-js:terminate'
+
+class AwsDurableExecutionSdkJsHandlerPlugin extends TracingPlugin {
+  static id = 'aws-durable-execution-sdk-js'
+  static type = 'serverless'
+  static kind = 'internal'
+  static prefix = 'tracing:orchestrion:@aws/durable-execution-sdk-js:withDurableExecution'
+
+  constructor (...args) {
+    super(...args)
+    // Gate the subscription on the feature flag: the instrumentation only wraps terminate() while
+    // this channel has subscribers, so not subscribing keeps the wrapping off entirely.
+    if (this._tracerConfig.DD_DURABLE_CROSS_INVOCATION_TRACING_ENABLED) {
+      this.addSub(TERMINATE_CHANNEL, ctx => this.#onTerminate(ctx))
+    }
+  }
+
+  bindStart (ctx) {
+    const args = ctx.arguments || []
+    const event = args[0]
+    const durableExecutionMode = args[3]
+    const handler = args[5]
+
+    const meta = {
+      'aws.durable.replayed': durableExecutionMode === 'ReplayMode' ? 'true' : 'false',
+    }
+    const arn = event?.DurableExecutionArn
+    if (arn) {
+      meta['aws.durable.execution_arn'] = arn
+    }
+
+    this.startSpan(this.operationName(), {
+      resource: handler?.name,
+      kind: this.constructor.kind,
+      meta,
+    }, ctx)
+
+    return ctx.currentStore
+  }
+
+  // Fired (synchronously, before the SDK's terminate() runs) when the execution suspends. On a
+  // PENDING reason we persist the current trace context as a `_datadog` checkpoint, which
+  // subsequent invocations consume to extract the parent trace context. `ctx` is the shared
+  // withDurableExecution context: bindStart put the execute span on it, and the instrumentation
+  // put the captured durableContext and termination reason on it.
+  #onTerminate (ctx) {
+    const reason = ctx.terminationReason ?? DEFAULT_TERMINATION_REASON
+    if (!PENDING_TERMINATION_REASONS.has(reason)) return
+    void maybeSaveCheckpoint(this.tracer, ctx)
+  }
+
+  asyncEnd (ctx) {
+    const span = ctx?.currentStore?.span
+    const status = ctx?.result?.Status
+    if (span && typeof status === 'string') {
+      span.setTag('aws.durable.invocation_status', status.toLowerCase())
+    }
+    // Operation child spans rely on user code awaiting the returned DurablePromise to settle;
+    // suspended (PENDING) ops never settle, and fire-and-forget ops on terminal handler exits
+    // are never awaited at all. Finish any still-open owned children so the trace can flush.
+    if (span) finishOpenChildSpans(span)
+    super.finish(ctx)
+  }
+}
+
+function finishOpenChildSpans (executeSpan) {
+  const trace = executeSpan?._spanContext?._trace
+  if (!trace?.started) return
+
+  for (const span of trace.started) {
+    if (span === executeSpan) continue
+    if (span._integrationName !== AwsDurableExecutionSdkJsHandlerPlugin.id) continue
+    if (span._duration === undefined) {
+      span.finish()
+    }
+  }
+}
+
+// Save state is kept on the shared `ctx` so repeated terminate() calls within one execution
+// save at most once. The execute span is also the anchor we propagate, so its span id is the
+// `firstExecutionSpanId` passed downstream.
+function maybeSaveCheckpoint (tracer, ctx) {
+  if (ctx.checkpointSaved || ctx.checkpointSavePromise) return ctx.checkpointSavePromise
+
+  const span = ctx.currentStore?.span
+  const durableContext = ctx.durableContext
+  if (!span || !durableContext) return
+
+  // Fire-and-forget boundary (#onTerminate calls us with `void`): swallow every failure here so a
+  // rejected checkpoint-manager call can never surface as an unhandled rejection in customer code.
+  ctx.checkpointSavePromise = saveTraceContextCheckpointIfUpdated(
+    tracer,
+    span,
+    durableContext,
+    span.context?.()?.toSpanId?.(),
+    ctx.arguments?.[0],
+  ).catch(error => {
+    log.debug('Failed to save trace context checkpoint', error)
+  }).finally(() => {
+    ctx.checkpointSaved = true
+    ctx.checkpointSavePromise = undefined
+  })
+
+  return ctx.checkpointSavePromise
+}
+
+module.exports = AwsDurableExecutionSdkJsHandlerPlugin

package/packages/datadog-plugin-aws-durable-execution-sdk-js/src/index.js

@@ -0,0 +1,19 @@
+'use strict'
+
+const CompositePlugin = require('../../dd-trace/src/plugins/composite')
+const checkpointPlugin = require('./checkpoint')
+const clientPlugin = require('./client')
+const contextPlugins = require('./context')
+const handlerPlugin = require('./handler')
+
+class AwsDurableExecutionSdkJsPlugin extends CompositePlugin {
+  static id = 'aws-durable-execution-sdk-js'
+  static plugins = {
+    handler: handlerPlugin,
+    client: clientPlugin,
+    checkpoint: checkpointPlugin,
+    ...contextPlugins,
+  }
+}
+
+module.exports = AwsDurableExecutionSdkJsPlugin

package/packages/datadog-plugin-aws-durable-execution-sdk-js/src/trace-checkpoint.js

@@ -0,0 +1,224 @@
+'use strict'
+
+const crypto = require('crypto')
+const log = require('../../dd-trace/src/log')
+const TextMapPropagator = require('../../dd-trace/src/opentracing/propagation/text_map')
+
+const CHECKPOINT_NAME_PREFIX = '_datadog_'
+
+// Propagator that injects only Datadog-style headers (`x-datadog-*`) regardless of the user's
+// `DD_TRACE_PROPAGATION_STYLE_INJECT`. Checkpoints are written and read entirely by Datadog code,
+// so honoring user style preferences would only complicate the payload contract. AWS runs a single
+// tracer, so one lazily-built propagator suffices.
+let datadogOnlyPropagator
+
+function getDatadogOnlyPropagator (tracer) {
+  if (datadogOnlyPropagator) return datadogOnlyPropagator
+  const config = tracer._config
+  // Shadow `tracePropagationStyle.inject` while inheriting every other field (x-datadog-tags length
+  // cap, etc.) from the live config. Disable `legacyBaggageEnabled` only to keep `ot-baggage-*` out
+  // of the checkpoint payload we persist (sensitive-data concern) — not a serverless-wide change.
+  const shadowConfig = Object.create(config)
+  shadowConfig.tracePropagationStyle = {
+    ...config.tracePropagationStyle,
+    inject: ['datadog'],
+  }
+  shadowConfig.legacyBaggageEnabled = false
+  datadogOnlyPropagator = new TextMapPropagator(shadowConfig)
+  return datadogOnlyPropagator
+}
+
+/**
+ * Build the Datadog-format headers dict from a span context.
+ * Mirrors ddtrace-py HTTPPropagator.inject output so the same payload
+ * can be consumed by either language's datadog-lambda wrapper.
+ * @param {object} tracer
+ * @param {object} span
+ * @returns {Record<string, string>}
+ */
+function injectHeaders (tracer, span) {
+  const headers = {}
+  const propagator = getDatadogOnlyPropagator(tracer)
+  const ctx = typeof span?.context === 'function' ? span.context() : span
+  propagator.inject(ctx, headers)
+  return headers
+}
+
+/**
+ * Mutate headers in-place to set parent_id to the provided value.
+ * @param {Record<string, string>} headers
+ * @param {string | number | undefined} parentId
+ */
+function overrideParentId (headers, parentId) {
+  if (!parentId) return
+  if (headers['x-datadog-trace-id']) {
+    headers['x-datadog-parent-id'] = String(parentId)
+  }
+}
+
+/**
+ * Whether the current trace context warrants a new checkpoint over the previously-saved one.
+ * @param {Record<string, string>} currentHeaders
+ * @param {Record<string, string>} previousHeaders
+ * @returns {boolean}
+ */
+function needsCheckpointUpdate (currentHeaders, previousHeaders) {
+  for (const key of Object.keys(currentHeaders)) {
+    if (currentHeaders[key] !== previousHeaders[key]) return true
+  }
+  return false
+}
+
+/**
+ * Find the checkpoint with the highest N for _datadog_{N} in the event's operations.
+ * @param {unknown} event
+ * @returns {{ checkpointNumber: number, operation: object } | undefined}
+ */
+function findLastCheckpoint (event) {
+  if (!event || typeof event !== 'object') return
+
+  const operations = event.InitialExecutionState?.Operations
+  if (!Array.isArray(operations)) return
+
+  let highest
+  for (const op of operations) {
+    const name = op?.Name
+    if (typeof name !== 'string' || !name.startsWith(CHECKPOINT_NAME_PREFIX)) continue
+    const suffix = name.slice(CHECKPOINT_NAME_PREFIX.length)
+    const checkpointNumber = Number.parseInt(suffix, 10)
+    if (Number.isNaN(checkpointNumber) || String(checkpointNumber) !== suffix) continue
+
+    if (!highest || checkpointNumber > highest.checkpointNumber) {
+      highest = { checkpointNumber, operation: op }
+    }
+  }
+
+  return highest
+}
+
+/**
+ * Parse the JSON payload from a checkpoint STEP operation's Payload or StepDetails.Result.
+ * @param {object} op
+ * @returns {Record<string, string> | undefined}
+ */
+function parseCheckpointPayload (op) {
+  try {
+    const raw = op?.Payload ?? op?.StepDetails?.Result
+    if (!raw || typeof raw !== 'string') return
+    const parsed = JSON.parse(raw)
+    return parsed && typeof parsed === 'object' ? parsed : undefined
+  } catch {
+    log.debug('Failed to parse checkpoint payload')
+  }
+}
+
+/**
+ * Save a _datadog_{number} STEP operation via the SDK's checkpoint manager.
+ * Uses a deterministic blake2b hash of (name:arn) as the stepId so the save is
+ * idempotent within an execution.
+ * @param {object} checkpointManager
+ * @param {string} executionArn
+ * @param {number} number
+ * @param {Record<string, string>} headers
+ * @returns {Promise<void>}
+ */
+async function saveCheckpoint (checkpointManager, executionArn, number, headers) {
+  const name = `${CHECKPOINT_NAME_PREFIX}${number}`
+  const stepId = crypto
+    .createHash('blake2b512')
+    .update(`${name}:${executionArn}`)
+    .digest('hex')
+    .slice(0, 64)
+  const payload = JSON.stringify(headers)
+
+  // Queue START and SUCCEED back-to-back before awaiting. This allows callers
+  // to trigger save right before termination without losing the second update.
+  const startPromise = checkpointManager.checkpoint(stepId, {
+    Id: stepId,
+    Action: 'START',
+    Type: 'STEP',
+    SubType: 'STEP',
+    Name: name,
+  })
+  const succeedPromise = checkpointManager.checkpoint(stepId, {
+    Id: stepId,
+    Action: 'SUCCEED',
+    Type: 'STEP',
+    SubType: 'STEP',
+    Name: name,
+    Payload: payload,
+  })
+  await Promise.all([
+    startPromise,
+    succeedPromise,
+  ])
+  log.debug('Saved trace context checkpoint %s', name)
+}
+
+/**
+ * Save a new trace-context checkpoint when the current context differs from
+ * the most recent `_datadog_{N}` operation already in the event.
+ *
+ * Every checkpoint across the durable execution carries the same
+ * `x-datadog-parent-id` so all resumed invocations attach to the same anchor:
+ * - First checkpoint (no previous): anchor at `firstExecutionSpanId`.
+ * - Subsequent: reuse the prior checkpoint's `x-datadog-parent-id` verbatim —
+ *   that value originated from the first save and is the anchor we've been
+ *   carrying forward.
+ *
+ * Caller is responsible for invoking this only when a save is appropriate — i.e.
+ * the SDK is about to return Status: PENDING (see PENDING_TERMINATION_REASONS in
+ * handler.js). This function does not re-check that.
+ *
+ * Errors (including a rejected checkpoint-manager call) propagate to the caller, which swallows
+ * them at the fire-and-forget boundary.
+ *
+ * @param {object} tracer
+ * @param {object} span - aws.durable.execute span
+ * @param {object} durableContext - SDK's DurableContextImpl
+ * @param {string | undefined} firstExecutionSpanId - span id of the first
+ *   invocation's `aws.durable.execute` span. Only consulted on the very
+ *   first save; ignored once a prior `_datadog_{N}` exists. We anchor at
+ *   this span (which this integration owns) rather than its parent so the
+ *   anchor doesn't depend on whatever upstream context happens to be
+ *   active when `bindStart` fires.
+ * @param {unknown} event - raw invocation event (has InitialExecutionState)
+ * @returns {Promise<void>}
+ */
+async function saveTraceContextCheckpointIfUpdated (
+  tracer, span, durableContext, firstExecutionSpanId, event,
+) {
+  const checkpointManager = durableContext.checkpoint ?? durableContext.checkpointManager
+  if (typeof checkpointManager?.checkpoint !== 'function') return
+
+  const currentHeaders = injectHeaders(tracer, span)
+  if (currentHeaders['x-datadog-trace-id'] === undefined) return
+
+  const latest = findLastCheckpoint(event)
+
+  let newNumber
+  if (latest) {
+    const previousHeaders = parseCheckpointPayload(latest.operation)
+    if (!previousHeaders) return
+
+    // x-datadog-parent-id reflects the active span at save time and always differs, so exclude it
+    // from the comparison. Capture the previous anchor first to carry it forward on a real update.
+    // needsCheckpointUpdate only reads currentHeaders' keys, so deleting it from there is enough.
+    const anchoredSpanId = previousHeaders['x-datadog-parent-id']
+    delete currentHeaders['x-datadog-parent-id']
+    if (!needsCheckpointUpdate(currentHeaders, previousHeaders)) return
+
+    newNumber = latest.checkpointNumber + 1
+    overrideParentId(currentHeaders, anchoredSpanId)
+  } else {
+    newNumber = 0
+    if (firstExecutionSpanId) overrideParentId(currentHeaders, firstExecutionSpanId)
+  }
+
+  const executionArn = event?.DurableExecutionArn || ''
+  await saveCheckpoint(checkpointManager, executionArn, newNumber, currentHeaders)
+}
+
+module.exports = {
+  saveTraceContextCheckpointIfUpdated,
+}

package/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js

@@ -0,0 +1,43 @@
+'use strict'
+
+const { createHash } = require('node:crypto')
+
+/**
+ * Populates the replay and operation_id tags for the op the DurableContextImpl is about to
+ * run, deriving both from a single `getNextStepId()` call. `aws.durable.replayed` is always
+ * set ('true' when the next stepId already has a SUCCEEDED checkpoint entry, i.e. the op will
+ * be served from the SDK's checkpoint). `aws.durable.operation_id` — the 16-hex-char MD5 of
+ * the stepId, mirroring the SDK's internal calculation — is only added when a stepId exists.
+ * @param {Record<string, string>} meta - The span meta/tags object to populate.
+ * @param {object} [ctxImpl] - The DurableContextImpl about to run the op.
+ * @returns {void}
+ */
+function addOpMeta (meta, ctxImpl) {
+  const stepId = ctxImpl?.getNextStepId?.()
+  if (!stepId) {
+    meta['aws.durable.replayed'] = 'false'
+    return
+  }
+  const stepData = ctxImpl?._executionContext?.getStepData?.(stepId)
+  meta['aws.durable.replayed'] = String(stepData?.Status === 'SUCCEEDED')
+  meta['aws.durable.operation_id'] = createHash('md5').update(stepId).digest('hex').slice(0, 16)
+}
+
+/**
+ * The SDK wraps user errors in typed classes (StepError, ChildContextError, etc.); we follow the
+ * `.cause` chain to recover the user's original Error. SDK wrappers expose a string `errorType`
+ * field, so the loop stops once we leave the wrapper hierarchy.
+ * @param {{ error?: unknown }} ctx
+ * @returns {unknown} the unwrapped error, or `ctx.error` unchanged when it isn't an Error
+ */
+function unwrapDurableError (ctx) {
+  let err = ctx?.error
+  if (!(err instanceof Error)) return err
+
+  while (typeof err.errorType === 'string' && err.cause instanceof Error) {
+    err = err.cause
+  }
+  return err
+}
+
+module.exports = { addOpMeta, unwrapDurableError }

package/packages/datadog-plugin-aws-sdk/src/base.js

@@ -108,7 +108,7 @@ class BaseAwsSdkPlugin extends ClientPlugin {
       const span = this.startSpan(this.operationFromRequest(request), {
         childOf,
         meta,
-        service: this.serviceName(),
+        service: this.serviceName(request),
         integrationName: 'aws-sdk',
       }, ctx)
 
@@ -172,18 +172,12 @@ class BaseAwsSdkPlugin extends ClientPlugin {
     })
 
     this.addSub(`apm:aws:request:complete:${this.serviceIdentifier}`, ctx => {
-      const { response, cbExists = false, currentStore } = ctx
+      const { response, currentStore } = ctx
       if (!currentStore) return
       const { span } = currentStore
       if (!span) return
 
       storage('legacy').run(currentStore, () => {
-        // try to extract DSM context from response if no callback exists as extraction normally happens in CB
-        if (!cbExists && this.serviceIdentifier === 'sqs') {
-          const params = response.request.params
-          const operation = response.request.operation
-          this.responseExtractDSMContext(operation, params, response.data ?? response, span)
-        }
         this.addResponseTags(span, response)
 
         if (this._tracerConfig?.DD_TRACE_AWS_ADD_SPAN_POINTERS) {
@@ -222,14 +216,18 @@ class BaseAwsSdkPlugin extends ClientPlugin {
     })
   }
 
-  serviceName () {
-    return this.config.service ||
-      super.serviceName({
-        id: 'aws',
-        type: 'web',
-        kind: 'client',
-        awsService: this.serviceIdentifier,
-      })
+  /**
+   * @param {{ params?: object }} request
+   */
+  serviceName (request) {
+    return super.serviceName({
+      id: 'aws',
+      type: 'web',
+      kind: 'client',
+      awsService: this.serviceIdentifier,
+      pluginConfig: this.config,
+      params: request.params,
+    })
   }
 
   isEnabled (request) {

package/packages/datadog-plugin-aws-sdk/src/services/eventbridge.js

@@ -2,6 +2,34 @@
 const log = require('../../../dd-trace/src/log')
 const BaseAwsSdkPlugin = require('../base')
 
+// EventBridge enforces this limit over the whole PutEvents request (the sum of
+// every entry), not over a single entry. 1 MiB == 1,048,576 bytes.
+const MAX_PUT_EVENTS_BYTES = 1024 * 1024
+
+/**
+ * Size a single `PutEventsRequestEntry` the way EventBridge does server-side:
+ * the UTF-8 byte length of `Source`, `DetailType`, `Detail`, and each
+ * `Resources` ARN, plus a flat 14 bytes when `Time` is set.
+ *
+ * @param {object} entry a single PutEvents request entry
+ * @param {string} [detail] overrides `entry.Detail`, used to size the entry as
+ *   it would be sent with the injected `_datadog` context
+ * @returns {number}
+ * @see https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-putevents.html
+ */
+function putEventEntrySize (entry, detail = entry.Detail) {
+  let size = entry.Time == null ? 0 : 14
+  if (entry.Source != null) size += Buffer.byteLength(entry.Source)
+  if (entry.DetailType != null) size += Buffer.byteLength(entry.DetailType)
+  if (detail != null) size += Buffer.byteLength(detail)
+  if (entry.Resources != null) {
+    for (const resource of entry.Resources) {
+      if (resource != null) size += Buffer.byteLength(resource)
+    }
+  }
+  return size
+}
+
 class EventBridge extends BaseAwsSdkPlugin {
   static id = 'eventbridge'
   static isPayloadReporter = true
@@ -25,7 +53,8 @@ class EventBridge extends BaseAwsSdkPlugin {
    * Docs: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEventsRequestEntry.html
    * We cannot use the traceHeader field as that's reserved for X-Ray.
    * Detail must be a valid JSON string
-   * Max size per event is 256kb (https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-putevent-size.html)
+   * Max PutEvents request size is 1mb, summed over all entries
+   * (https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-putevent-size.html)
    */
   requestInject (span, request) {
     const operation = request.operation
@@ -34,6 +63,7 @@ class EventBridge extends BaseAwsSdkPlugin {
       request.params.Entries &&
       request.params.Entries.length > 0 &&
       request.params.Entries[0].Detail) {
+      const entries = request.params.Entries
       const injected = {}
       this.tracer.inject(span, 'text_map', injected)
 
@@ -42,19 +72,26 @@ class EventBridge extends BaseAwsSdkPlugin {
       // it so the rest of the body stays in V8's optimisable surface.
       let finalData
       try {
-        finalData = BaseAwsSdkPlugin.injectFieldIntoJsonObject(
-          request.params.Entries[0].Detail, '_datadog', injected
-        )
+        finalData = BaseAwsSdkPlugin.injectFieldIntoJsonObject(entries[0].Detail, '_datadog', injected)
       } catch (error) {
         log.error('EventBridge error injecting request', error)
         return
       }
 
-      if (Buffer.byteLength(finalData) >= 1024 * 256) {
+      // EventBridge applies the 1 MiB cap to the whole request, so size every
+      // entry as it would be sent (the first with `_datadog` injected) and skip
+      // rather than tip a request AWS would otherwise accept over the limit. The
+      // running total only needs to clear the cap, so stop summing the moment it
+      // does instead of byte-counting the rest of a batch we already know is over.
+      let requestSize = putEventEntrySize(entries[0], finalData)
+      for (let i = 1; requestSize < MAX_PUT_EVENTS_BYTES && i < entries.length; i++) {
+        requestSize += putEventEntrySize(entries[i])
+      }
+      if (requestSize >= MAX_PUT_EVENTS_BYTES) {
         log.info('Payload size too large to pass context')
         return
       }
-      request.params.Entries[0].Detail = finalData
+      entries[0].Detail = finalData
     }
   }
 }