dd-trace 5.110.0 → 5.112.0

package/packages/dd-trace/src/aiguard/integrations/vercel-ai.js

@@ -11,45 +11,59 @@ const doGenerateAfterChannel = channel('dd-trace:vercel-ai:doGenerate:after')
 const doStreamBeforeChannel = channel('dd-trace:vercel-ai:doStream:before')
 const doStreamAfterChannel = channel('dd-trace:vercel-ai:doStream:after')
 
+let isEnabled = false
+let aiguard
+let opts
+
 /**
  * Subscribes AI Guard to Vercel AI lifecycle channels.
  *
- * @param {object} aiguard
+ * @param {object} aiguardInstance
  * @param {boolean} block
- * @returns {() => void}
  */
-function enable (aiguard, block) {
-  const opts = { block, source: SOURCE_AUTO, integration: 'ai' }
-
-  function onBefore (ctx) {
-    pushEvaluation(ctx, aiguard, convertVercelPromptToMessages(ctx.prompt), opts)
-  }
-
-  function onGenerateAfter (ctx) {
-    const inputMessages = convertVercelPromptToMessages(ctx.prompt)
-    if (!inputMessages.length || !ctx.result?.content?.length) return
-
-    pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, ctx.result.content), opts)
-  }
+function enable (aiguardInstance, block) {
+  if (isEnabled) return
 
-  function onStreamAfter (ctx) {
-    const inputMessages = convertVercelPromptToMessages(ctx.prompt)
-    if (!inputMessages.length || !ctx.chunks?.length) return
-
-    pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, getStreamContent(ctx.chunks)), opts)
-  }
+  aiguard = aiguardInstance
+  opts = { block, source: SOURCE_AUTO, integration: 'ai' }
 
   doGenerateBeforeChannel.subscribe(onBefore)
   doGenerateAfterChannel.subscribe(onGenerateAfter)
   doStreamBeforeChannel.subscribe(onBefore)
   doStreamAfterChannel.subscribe(onStreamAfter)
 
-  return function disable () {
-    doGenerateBeforeChannel.unsubscribe(onBefore)
-    doGenerateAfterChannel.unsubscribe(onGenerateAfter)
-    doStreamBeforeChannel.unsubscribe(onBefore)
-    doStreamAfterChannel.unsubscribe(onStreamAfter)
-  }
+  isEnabled = true
+}
+
+function disable () {
+  if (!isEnabled) return
+
+  doGenerateBeforeChannel.unsubscribe(onBefore)
+  doGenerateAfterChannel.unsubscribe(onGenerateAfter)
+  doStreamBeforeChannel.unsubscribe(onBefore)
+  doStreamAfterChannel.unsubscribe(onStreamAfter)
+
+  aiguard = undefined
+  opts = undefined
+  isEnabled = false
+}
+
+function onBefore (ctx) {
+  pushEvaluation(ctx, aiguard, convertVercelPromptToMessages(ctx.prompt), opts)
+}
+
+function onGenerateAfter (ctx) {
+  const inputMessages = convertVercelPromptToMessages(ctx.prompt)
+  if (!inputMessages.length || !ctx.result?.content?.length) return
+
+  pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, ctx.result.content), opts)
+}
+
+function onStreamAfter (ctx) {
+  const inputMessages = convertVercelPromptToMessages(ctx.prompt)
+  if (!inputMessages.length || !ctx.chunks?.length) return
+
+  pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, getStreamContent(ctx.chunks)), opts)
 }
 
 /**
@@ -75,4 +89,4 @@ function getStreamContent (chunks) {
   return text ? [{ type: 'text', text }] : []
 }
 
-module.exports = { enable }
+module.exports = { enable, disable }

package/packages/dd-trace/src/aiguard/sdk.js

@@ -93,14 +93,14 @@ class AIGuard extends NoopAIGuard {
   constructor (tracer, config) {
     super()
 
-    if (!config.apiKey || !config.DD_APP_KEY) {
+    if (!config.DD_API_KEY || !config.DD_APP_KEY) {
       log.error('AIGuard: missing api and/or app keys, use env DD_API_KEY and DD_APP_KEY')
       this.#initialized = false
       return
     }
     this.#tracer = tracer
     this.#headers = {
-      'DD-API-KEY': config.apiKey,
+      'DD-API-KEY': config.DD_API_KEY,
       'DD-APPLICATION-KEY': config.DD_APP_KEY,
       'DD-AI-GUARD-VERSION': tracerVersion,
       'DD-AI-GUARD-SOURCE': 'SDK',

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -31,11 +31,11 @@ class NoopTTLCache {
 }
 
 function configure ({ appsec, apmTracingEnabled }) {
-  enabled = appsec.apiSecurity.enabled
+  enabled = appsec.DD_API_SECURITY_ENABLED
   asmStandaloneEnabled = apmTracingEnabled === false
-  sampledRequests = appsec.apiSecurity.sampleDelay === 0
+  sampledRequests = appsec.DD_API_SECURITY_SAMPLE_DELAY === 0
     ? new NoopTTLCache()
-    : new TTLCache({ max: MAX_SIZE, ttl: appsec.apiSecurity.sampleDelay * 1000 })
+    : new TTLCache({ max: MAX_SIZE, ttl: appsec.DD_API_SECURITY_SAMPLE_DELAY * 1000 })
 }
 
 function disable () {

package/packages/dd-trace/src/appsec/channels.js

@@ -27,6 +27,8 @@ module.exports = {
   httpClientResponseFinish: dc.channel('apm:http:client:response:finish'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
+  lambdaStartInvocation: dc.channel('datadog:lambda:start-invocation'),
+  lambdaEndInvocation: dc.channel('datadog:lambda:end-invocation'),
   multerParser: dc.channel('datadog:multer:read:finish'),
   mysql2OuterQueryStart: dc.channel('datadog:mysql2:outerquery:start'),
   nextBodyParsed: dc.channel('apm:next:body-parsed'),
@@ -43,7 +45,7 @@ module.exports = {
   routerParam: dc.channel('datadog:router:param:start'),
   setCookieChannel: dc.channel('datadog:iast:set-cookie'),
   setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
-  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  startGraphqlResolver: dc.channel('datadog:graphql:resolver:start'),
   stripeCheckoutSessionCreate: dc.channel('datadog:stripe:checkoutSession:create:finish'),
   stripeConstructEvent: dc.channel('datadog:stripe:constructEvent:finish'),
   stripePaymentIntentCreate: dc.channel('datadog:stripe:paymentIntent:create:finish'),

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -41,7 +41,7 @@ function enable (_config) {
   downstreamAnalysisCount = new WeakMap()
   responseBodyIgnoredCount = new WeakMap()
 
-  const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
+  const bodyAnalysisSampleRate = config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE
   samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
 
   if (samplingRate !== bodyAnalysisSampleRate) {
@@ -105,7 +105,7 @@ function recordResponseBodyIgnored (req, tag) {
  * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
-  const maxBytes = config.appsec.apiSecurity.maxDownstreamBodyBytes
+  const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
 
   const mime = extractMimeType(res.headers?.['content-type'])
   if (!mime || !SUPPORTED_RESPONSE_BODY_MIME_TYPES.has(mime)) {
@@ -137,7 +137,7 @@ function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
 
   const currentCount = bodyAnalysisCount.get(req) || 0
-  if (currentCount >= config.appsec.apiSecurity?.maxDownstreamRequestBodyAnalysis) {
+  if (currentCount >= config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS) {
     return false
   }
 
@@ -166,7 +166,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config?.appsec.apiSecurity) {
+  if (!config) {
     return
   }
 

package/packages/dd-trace/src/appsec/graphql.js

@@ -12,7 +12,7 @@ const {
 const waf = require('./waf')
 const addresses = require('./addresses')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
@@ -32,7 +32,7 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolve ({ context, resolverInfo }) {
+function onGraphqlStartResolver ({ abortController, resolverInfo }) {
   const req = getActiveRequest()
 
   if (!req) return
@@ -46,7 +46,7 @@ function onGraphqlStartResolve ({ context, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      context?.abortController?.abort()
+      abortController?.abort()
     }
   }
 }
@@ -72,14 +72,17 @@ function enterInApolloServerCoreRequest () {
 
 function enterInApolloRequest () {
   const req = getActiveRequest()
+  if (!req) return
 
-  const requestData = graphqlRequestData.get(req)
-  if (requestData) {
-    // Set isInGraphqlRequest=true since this function only runs for GraphQL requests
-    // This works for both Apollo v4 (middleware) and v5 (HTTP server) contexts
-    requestData.isInGraphqlRequest = true
-    addSpecificEndpoint(req, specificBlockingTypes.GRAPHQL)
+  let requestData = graphqlRequestData.get(req)
+  if (!requestData) {
+    // executeHTTPGraphQLRequest is the GraphQL request boundary, so seed here
+    // when no upstream hook (express4 middleware, drainHttpServer) has run.
+    requestData = { blocked: false }
+    graphqlRequestData.set(req, requestData)
   }
+  requestData.isInGraphqlRequest = true
+  addSpecificEndpoint(req, specificBlockingTypes.GRAPHQL)
 }
 
 function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
@@ -153,11 +156,11 @@ function disableApollo () {
 }
 
 function enableGraphql () {
-  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+  startGraphqlResolver.subscribe(onGraphqlStartResolver)
 }
 
 function disableGraphql () {
-  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+  if (startGraphqlResolver.hasSubscribers) startGraphqlResolver.unsubscribe(onGraphqlStartResolver)
 }
 
 module.exports = {

package/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js

@@ -15,6 +15,20 @@ const EXCLUDED_PATHS_FROM_STACK = getNodeModulesPaths('mongodb', 'mongoose', 'mq
 const SAFE_OPERATORS = new Set(['$eq', '$gt', '$gte', '$in', '$lt', '$lte', '$ne', '$nin',
   '$exists', '$type', '$mod', '$bitsAllClear', '$bitsAllSet', '$bitsAnyClear', '$bitsAnySet'])
 
+// Scope a marked child store for a query's deferred execution so the nested mongodb
+// driver query skips re-analysis. `bindStore` enters the child only for that async
+// scope and restores the parent on its own, so no marker can be stranded for a later
+// request to inherit, and two concurrent queries of the same request each branch from
+// the shared parent rather than from each other.
+function markExecStore () {
+  const store = storage('legacy').getStore()
+  if (store && !store.nosqlAnalyzed && getIastContext(store)) {
+    return { ...store, nosqlAnalyzed: true }
+  }
+
+  return store
+}
+
 class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
   constructor () {
     super(NOSQL_MONGODB_INJECTION)
@@ -27,39 +41,25 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     // Anything that accesses the storage is context dependent
     const onStart = ({ filters }) => {
       const store = storage('legacy').getStore()
-      if (store && !store.nosqlAnalyzed && filters?.length) {
+      if (store && !store.nosqlAnalyzed && filters?.length && getIastContext(store)) {
         for (const filter of filters) {
           this.analyze({ filter }, store)
         }
       }
-
-      return store
-    }
-
-    const onStartAndEnterWithStore = (message) => {
-      const store = onStart(message || {})
-      if (store) {
-        storage('legacy').enterWith({ ...store, nosqlAnalyzed: true, nosqlParentStore: store })
-      }
-    }
-
-    // Anything that accesses the storage is context dependent
-    // eslint-disable-next-line unicorn/consistent-function-scoping
-    const onFinish = () => {
-      const store = storage('legacy').getStore()
-      if (store?.nosqlParentStore) {
-        storage('legacy').enterWith(store.nosqlParentStore)
-      }
     }
 
     this.addSub('datadog:mongodb:collection:filter:start', onStart)
 
-    this.addSub('datadog:mongoose:model:filter:start', onStartAndEnterWithStore)
-    this.addSub('datadog:mongoose:model:filter:finish', onFinish)
+    // A mongoose query builds, executes, and reaches the driver in separate async
+    // steps. The filters are analyzed at the build, but the marker is bound around
+    // the execution channel, where the driver call still runs under the parent store.
+    this.addSub('datadog:mongoose:model:filter:start', onStart)
+    this.addBind('datadog:mongoose:model:filter:exec', markExecStore)
 
+    // mquery analyzes filters at the prepare step and marks the execution scope at
+    // tracing start, where the deferred driver call runs under the marked store.
     this.addSub('datadog:mquery:filter:prepare', onStart)
-    this.addSub('tracing:datadog:mquery:filter:start', onStartAndEnterWithStore)
-    this.addSub('tracing:datadog:mquery:filter:asyncEnd', onFinish)
+    this.addBind('tracing:datadog:mquery:filter:start', markExecStore)
   }
 
   configureSanitizers () {

package/packages/dd-trace/src/appsec/iast/security-controls/index.js

@@ -21,10 +21,10 @@ let controlsKeys
 let hooks
 
 function configure (iastConfig) {
-  if (!iastConfig?.securityControlsConfiguration) return
+  if (!iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION) return
 
   try {
-    controls = parse(iastConfig.securityControlsConfiguration)
+    controls = parse(iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION)
     if (controls?.size > 0) {
       hooks = new WeakSet()
       controlsKeys = [...controls.keys()]

package/packages/dd-trace/src/appsec/iast/telemetry/index.js

@@ -6,7 +6,8 @@ const { initRequestNamespace, finalizeRequestNamespace, globalNamespace } = requ
 
 class Telemetry {
   configure (config, verbosity) {
-    const telemetryAndMetricsEnabled = config?.telemetry?.enabled && config.telemetry.metrics
+    const telemetryAndMetricsEnabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED &&
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 
     this.verbosity = telemetryAndMetricsEnabled ? getVerbosity(verbosity) : Verbosity.OFF
     this.enabled = this.verbosity !== Verbosity.OFF

package/packages/dd-trace/src/appsec/index.js

@@ -16,6 +16,8 @@ const {
   fastifyCookieParser,
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
+  lambdaStartInvocation,
+  lambdaEndInvocation,
   passportVerify,
   passportUser,
   expressSession,
@@ -43,6 +45,7 @@ const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction }
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
 const graphql = require('./graphql')
+const lambda = require('./lambda')
 const rasp = require('./rasp')
 
 const responseAnalyzedSet = new WeakSet()
@@ -99,11 +102,15 @@ function enable (_config) {
     stripeCheckoutSessionCreate.subscribe(onStripeCheckoutSessionCreate)
     stripePaymentIntentCreate.subscribe(onStripePaymentIntentCreate)
     stripeConstructEvent.subscribe(onStripeConstructEvent)
+    lambdaStartInvocation.subscribe(lambda.onLambdaStartInvocation)
+    lambdaEndInvocation.subscribe(lambda.onLambdaEndInvocation)
 
     isEnabled = true
     config = _config
   } catch (err) {
-    if (!IS_SERVERLESS) {
+    if (IS_SERVERLESS) {
+      log.debug('[ASM] Serverless mode: suppressing error log, calling disable()')
+    } else {
       log.error('[ASM] Unable to start AppSec', err)
     }
 
@@ -544,6 +551,8 @@ function disable () {
   if (stripeCheckoutSessionCreate.hasSubscribers) stripeCheckoutSessionCreate.unsubscribe(onStripeCheckoutSessionCreate)
   if (stripePaymentIntentCreate.hasSubscribers) stripePaymentIntentCreate.unsubscribe(onStripePaymentIntentCreate)
   if (stripeConstructEvent.hasSubscribers) stripeConstructEvent.unsubscribe(onStripeConstructEvent)
+  if (lambdaStartInvocation.hasSubscribers) lambdaStartInvocation.unsubscribe(lambda.onLambdaStartInvocation)
+  if (lambdaEndInvocation.hasSubscribers) lambdaEndInvocation.unsubscribe(lambda.onLambdaEndInvocation)
 }
 
 /**

package/packages/dd-trace/src/appsec/lambda.js

@@ -0,0 +1,135 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
+
+const log = require('../log')
+const addresses = require('./addresses')
+const Reporter = require('./reporter')
+const waf = require('./waf')
+
+// Tracks spans for which start-invocation has been processed, so that
+// end-invocation can gate correctly
+const activeInvocations = new WeakSet()
+
+/**
+ * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
+ * runs the WAF, and reports results on the span.
+ *
+ * @param {{ span: object, headers: Record<string, string>, method: string, path: string,
+ *           query: Record<string, string | string[]> | undefined, body: string | object | undefined,
+ *           isBase64Encoded: boolean, clientIp: string | undefined,
+ *           pathParams: Record<string, string> | undefined,
+ *           cookies: Record<string, string> | undefined,
+ *           route: string | undefined }} data
+ */
+function onLambdaStartInvocation (data) {
+  try {
+    const { span, headers, method, path, query, body, clientIp, pathParams, cookies } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda start invocation')
+      return
+    }
+
+    activeInvocations.add(span)
+
+    span.addTags({
+      '_dd.appsec.enabled': 1,
+      '_dd.runtime_family': 'nodejs',
+    })
+
+    const persistent = {}
+
+    if (path) {
+      persistent[addresses.HTTP_INCOMING_URL] = path
+    }
+
+    if (method) {
+      persistent[addresses.HTTP_INCOMING_METHOD] = method
+    }
+
+    if (headers) {
+      // Cookie header is already stripped by the Lambda layer's event-data-extractor
+      persistent[addresses.HTTP_INCOMING_HEADERS] = headers
+    }
+
+    if (clientIp) {
+      span.setTag(HTTP_CLIENT_IP, clientIp)
+      persistent[addresses.HTTP_CLIENT_IP] = clientIp
+    }
+
+    if (query) {
+      persistent[addresses.HTTP_INCOMING_QUERY] = query
+    }
+
+    if (body !== undefined && body !== null) {
+      persistent[addresses.HTTP_INCOMING_BODY] = body
+    }
+
+    if (pathParams) {
+      persistent[addresses.HTTP_INCOMING_PARAMS] = pathParams
+    }
+
+    if (cookies) {
+      persistent[addresses.HTTP_INCOMING_COOKIES] = cookies
+    }
+
+    waf.run({ persistent }, span, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda start-invocation handler', err)
+  }
+}
+
+/**
+ * Maps response data to WAF addresses, runs a final WAF pass,
+ * disposes the WAF context, and finishes the request report.
+ *
+ * @param {{ span: object, statusCode: string | undefined,
+ *           responseHeaders: Record<string, string> | undefined }} data
+ */
+function onLambdaEndInvocation (data) {
+  try {
+    const { span, statusCode, responseHeaders } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda end invocation')
+      return
+    }
+
+    if (!activeInvocations.has(span)) {
+      return
+    }
+
+    activeInvocations.delete(span)
+
+    let hasPersistentData = false
+    const persistent = {}
+
+    if (statusCode) {
+      persistent[addresses.HTTP_INCOMING_RESPONSE_CODE] = String(statusCode)
+      hasPersistentData = true
+    }
+
+    if (responseHeaders) {
+      const filteredHeaders = { ...responseHeaders }
+      delete filteredHeaders['set-cookie']
+      persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS] = filteredHeaders
+      hasPersistentData = true
+    }
+
+    if (hasPersistentData) {
+      waf.run({ persistent }, span, undefined, span)
+    }
+
+    waf.disposeContext(span)
+
+    Reporter.finishRequest(span, null, {}, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda end-invocation handler', err)
+  }
+}
+
+module.exports = {
+  onLambdaStartInvocation,
+  onLambdaEndInvocation,
+}

package/packages/dd-trace/src/appsec/reporter.js

@@ -318,13 +318,21 @@ function reportWafConfigUpdate (product, rcConfigId, diagnostics, wafVersion) {
   }
 }
 
-function reportMetrics (metrics, raspRule, req) {
+/**
+ * @param {object} metrics - WAF run metrics
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportMetrics (metrics, raspRule, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
-  const rootSpan = req && web.root(req)
+  if (!rootSpan) {
+    rootSpan = req && web.root(req)
+  }
 
-  if (!rootSpan) return
+  if (!req || !rootSpan) return
 
   if (metrics.rulesVersion) {
     rootSpan.setTag('_dd.appsec.event_rules.version', metrics.rulesVersion)
@@ -353,13 +361,26 @@ function reportTruncationMetrics (rootSpan, metrics) {
   }
 }
 
-function reportAttack ({ events: attackData, actions }, req) {
+// NOTE: `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage. In Lambda, it is a plain context key ({}) with no
+// HTTP properties. Always guard HTTP-specific property access
+// See tests in lambda.spec.js for enforcement.
+
+/**
+ * @param {{ events: Array, actions: object }} result - WAF result with attack data
+ * @param {object} [req] - Request key. May be an HTTP IncomingMessage or a plain object (Lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttack ({ events: attackData, actions }, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
-  if (!rootSpan) return
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
+
+  if (!req || !rootSpan) return
 
   const spanContext = rootSpan.context()
 
@@ -494,14 +515,21 @@ function isSchemaAttribute (attribute) {
   return attribute.startsWith('_dd.appsec.s.')
 }
 
-function reportAttributes (attributes, req) {
+/**
+ * @param {object} [attributes] - WAF result attributes
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttributes (attributes, req, rootSpan) {
   if (!attributes) return
 
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
 
   if (!rootSpan) return
 
@@ -517,8 +545,17 @@ function reportAttributes (attributes, req) {
   rootSpan.addTags(tags)
 }
 
-function finishRequest (req, res, storedResponseHeaders, requestBody) {
-  const rootSpan = web.root(req)
+/**
+ * @param {object} [req] - Request key (null for Lambda)
+ * @param {object} [res] - Response object (null for lambda)
+ * @param {object} storedResponseHeaders
+ * @param {object} [requestBody]
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function finishRequest (req, res, storedResponseHeaders, requestBody, rootSpan) {
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
   if (!rootSpan) return
 
   if (metricsQueue.size) {
@@ -569,6 +606,8 @@ function finishRequest (req, res, storedResponseHeaders, requestBody) {
     rootSpan.setTag('_dd.appsec.rasp.rule.eval', metrics.raspEvalCount)
   }
 
+  if (!req) return
+
   incrementWafRequestsMetric(req)
 
   const tags = rootSpan.context().getTags()

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -27,7 +27,7 @@ const metricsStoreMap = new WeakMap()
 let enabled = false
 
 function enable (config) {
-  enabled = config.telemetry?.enabled && config.telemetry?.metrics
+  enabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED && config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 }
 
 function disable () {

package/packages/dd-trace/src/appsec/waf/index.js

@@ -110,7 +110,19 @@ function removeConfig (configPath) {
   }
 }
 
-function run (data, req, raspRule) {
+// `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage (it is a plain object for lambda).
+// Always guard HTTP-specific property access.
+// @see packages/dd-trace/test/appsec/lambda.spec.js
+
+/**
+ * @param {object} data - WAF address data ({ persistent, ephemeral })
+ * @param {object} req - Request key for WAF context lookup. May be an HTTP
+ *   IncomingMessage or a plain object (Lambda invocation key).
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [rootSpan] - Root span to tag (required for Lambda)
+ */
+function run (data, req, raspRule, rootSpan) {
   if (!req) {
     req = getActiveRequest()
     if (!req) {
@@ -120,12 +132,12 @@ function run (data, req, raspRule) {
   }
 
   const wafContext = waf.wafManager.getWAFContext(req)
-  const result = wafContext.run(data, raspRule, req)
+  const result = wafContext.run(data, raspRule, req, rootSpan)
 
   if (result?.keep) {
     if (limiter.isAllowed()) {
-      const rootSpan = web.root(req)
-      keepTrace(rootSpan, ASM)
+      const span = rootSpan || web.root(req)
+      keepTrace(span, ASM)
     } else {
       updateRateLimitedMetric(req)
     }