datadog_lambda 8.113.0__py3-none-any.whl → 8.114.0__py3-none-any.whl

datadog_lambda/__init__.py

@@ -3,10 +3,11 @@ import os
 
 
 if os.environ.get("DD_INSTRUMENTATION_TELEMETRY_ENABLED") is None:
-    os.environ["DD_INSTRUMENTATION_TELEMETRY_ENABLED"] = "false"
+    # Telemetry is required for Appsec Software Composition Analysis
+    os.environ["DD_INSTRUMENTATION_TELEMETRY_ENABLED"] = os.environ.get(
+        "DD_APPSEC_ENABLED", "false"
+    )
 
-if os.environ.get("DD_API_SECURITY_ENABLED") is None:
-    os.environ["DD_API_SECURITY_ENABLED"] = "False"
 
 initialize_cold_start_tracing()
 

datadog_lambda/asm.py

@@ -73,17 +73,16 @@ def asm_start_request(
     route: Optional[str] = None
 
     if event_source.event_type == EventTypes.ALB:
-        headers = event.get("headers")
-        multi_value_request_headers = event.get("multiValueHeaders")
-        if multi_value_request_headers:
-            request_headers = _to_single_value_headers(multi_value_request_headers)
-        else:
-            request_headers = headers or {}
-
         raw_uri = event.get("path")
-        parsed_query = event.get("multiValueQueryStringParameters") or event.get(
-            "queryStringParameters"
-        )
+
+        if event_source.subtype == EventSubtypes.ALB:
+            request_headers = event.get("headers", {})
+            parsed_query = event.get("queryStringParameters")
+        if event_source.subtype == EventSubtypes.ALB_MULTI_VALUE_HEADERS:
+            request_headers = _to_single_value_headers(
+                event.get("multiValueHeaders", {})
+            )
+            parsed_query = event.get("multiValueQueryStringParameters")
 
     elif event_source.event_type == EventTypes.LAMBDA_FUNCTION_URL:
         request_headers = event.get("headers", {})
@@ -226,15 +225,27 @@ def get_asm_blocked_response(
         content_type = blocked.get("content-type", "application/json")
         content = http_utils._get_blocked_template(content_type)
 
-    response_headers = {
-        "content-type": content_type,
-    }
-    if "location" in blocked:
-        response_headers["location"] = blocked["location"]
-
-    return {
+    response = {
         "statusCode": blocked.get("status_code", 403),
-        "headers": response_headers,
         "body": content,
         "isBase64Encoded": False,
     }
+
+    needs_multi_value_headers = event_source.equals(
+        EventTypes.ALB, EventSubtypes.ALB_MULTI_VALUE_HEADERS
+    )
+
+    if needs_multi_value_headers:
+        response["multiValueHeaders"] = {
+            "content-type": [content_type],
+        }
+        if "location" in blocked:
+            response["multiValueHeaders"]["location"] = [blocked["location"]]
+    else:
+        response["headers"] = {
+            "content-type": content_type,
+        }
+        if "location" in blocked:
+            response["headers"]["location"] = blocked["location"]
+
+    return response

datadog_lambda/trigger.py

@@ -54,6 +54,10 @@ class EventSubtypes(_stringTypedEnum):
     WEBSOCKET = "websocket"
     HTTP_API = "http-api"
 
+    ALB = "alb"  # regular alb
+    # ALB with the multi-value headers option checked on the target group
+    ALB_MULTI_VALUE_HEADERS = "alb-multi-value-headers"
+
 
 class _EventSource:
     """
@@ -133,7 +137,12 @@ def parse_event_source(event: dict) -> _EventSource:
             event_source.subtype = EventSubtypes.WEBSOCKET
 
     if request_context and request_context.get("elb"):
-        event_source = _EventSource(EventTypes.ALB)
+        if "multiValueHeaders" in event:
+            event_source = _EventSource(
+                EventTypes.ALB, EventSubtypes.ALB_MULTI_VALUE_HEADERS
+            )
+        else:
+            event_source = _EventSource(EventTypes.ALB, EventSubtypes.ALB)
 
     if event.get("awslogs"):
         event_source = _EventSource(EventTypes.CLOUDWATCH_LOGS)
@@ -288,7 +297,7 @@ def extract_http_tags(event):
     """
     Extracts HTTP facet tags from the triggering event
     """
-    http_tags = {}
+    http_tags = {"span.kind": "server"}
 
     # Safely get request_context and ensure it's a dictionary
     request_context = event.get("requestContext")

datadog_lambda/version.py

@@ -1 +1 @@
-__version__ = "8.113.0"
+__version__ = "8.114.0"

datadog_lambda/wrapper.py

@@ -53,6 +53,9 @@ if config.appsec_enabled:
         asm_start_request,
         get_asm_blocked_response,
     )
+    from ddtrace.internal.appsec.product import start
+
+    start()
 
 if config.profiling_enabled:
     from ddtrace.profiling import profiler
@@ -281,6 +284,34 @@ class _LambdaDecorator(object):
     def _after(self, event, context):
         try:
             status_code = extract_http_status_code_tag(self.trigger_tags, self.response)
+
+            if self.span:
+                if config.appsec_enabled and not self.blocking_response:
+                    asm_start_response(
+                        self.span,
+                        status_code,
+                        self.event_source,
+                        response=self.response,
+                    )
+                    self.blocking_response = get_asm_blocked_response(self.event_source)
+
+                if self.blocking_response:
+                    status_code = str(self.blocking_response.get("statusCode"))
+                    if config.capture_payload_enabled and self.response:
+                        tag_object(
+                            self.span, "function.blocked_response", self.response
+                        )
+                    self.response = self.blocking_response
+
+                if config.capture_payload_enabled:
+                    tag_object(self.span, "function.request", event)
+                    tag_object(self.span, "function.response", self.response)
+
+                if status_code:
+                    self.span.set_tag("http.status_code", status_code)
+
+                self.span.finish()
+
             if status_code:
                 self.trigger_tags["http.status_code"] = status_code
                 mark_trace_as_error_for_5xx_responses(context, status_code, self.span)
@@ -295,25 +326,6 @@ class _LambdaDecorator(object):
             if should_trace_cold_start:
                 trace_ctx = tracer.current_trace_context()
 
-            if self.span:
-                if config.capture_payload_enabled:
-                    tag_object(self.span, "function.request", event)
-                    tag_object(self.span, "function.response", self.response)
-
-                if status_code:
-                    self.span.set_tag("http.status_code", status_code)
-
-                if config.appsec_enabled and not self.blocking_response:
-                    asm_start_response(
-                        self.span,
-                        status_code,
-                        self.event_source,
-                        response=self.response,
-                    )
-                    self.blocking_response = get_asm_blocked_response(self.event_source)
-
-                self.span.finish()
-
             if self.inferred_span:
                 if status_code:
                     self.inferred_span.set_tag("http.status_code", status_code)

{datadog_lambda-8.113.0.dist-info → datadog_lambda-8.114.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: datadog_lambda
-Version: 8.113.0
+Version: 8.114.0
 Summary: The Datadog AWS Lambda Library
 Home-page: https://github.com/DataDog/datadog-lambda-python
 License: Apache-2.0

{datadog_lambda-8.113.0.dist-info → datadog_lambda-8.114.0.dist-info}/RECORD

@@ -1,6 +1,6 @@
-datadog_lambda/__init__.py,sha256=uAqki08Fd26eUXZtoptJX68kTFhK-ZkCyLVCtE0MS4k,802
+datadog_lambda/__init__.py,sha256=rAQyhhjO-TzPu3_EtL111hr03gdeeQRmm1Zsz2dKKTw,816
 datadog_lambda/api.py,sha256=FqQ9vjNSxD5BxjeHDDKbim_NIN08dshW-52wNzqw5yo,5249
-datadog_lambda/asm.py,sha256=pYgtSKtOj8KTd701iPiXvOXQ32D1nH_k1BzOmMU7L1k,7767
+datadog_lambda/asm.py,sha256=RyGUIvQMR8OSsfJ-B9hum5pMTYZa_OC157bk3Lwny-U,8175
 datadog_lambda/cold_start.py,sha256=NfE4EtRUHuc2ub26U8sAwMVEDNINbw1OTh2MAklQGyk,8032
 datadog_lambda/config.py,sha256=QoEZrSL_zSHY5lV9RznAwPONEZe0i3mCWp2jPoO8aEw,5260
 datadog_lambda/constants.py,sha256=0y6O9s_8RLflYR507SDMQjKmYY16tr1yi2KQuuF1GaY,1696
@@ -18,13 +18,13 @@ datadog_lambda/tag_object.py,sha256=NNvMVi07kNYRBMPpB7Lk7_-z5ccmxo2UmTWnvWVPhiM,
 datadog_lambda/tags.py,sha256=wy6uH8eAGMn7cfZEdHpL9uEGoM85bVyyXhYwSQtfHHc,2532
 datadog_lambda/thread_stats_writer.py,sha256=VfD6G65zNHDA0nABhGOO0it7yqvn-p6ereQ329DA7r8,2894
 datadog_lambda/tracing.py,sha256=A7uUXlWBwfxOa2PFVLg2Tgft8Ft14xz-kSOjvOaA8JQ,57396
-datadog_lambda/trigger.py,sha256=7EhNoCtJbnuYaqCvv1i2tAqZxfXx7ccsnMkwnWvmd7w,14212
-datadog_lambda/version.py,sha256=VIVUGpBGnx4PNj35gsO1Xf4OfZ_Naws0GXp54dMVxj0,24
-datadog_lambda/wrapper.py,sha256=ZCszRfSAbBplOcPJ_RI5XTMSkNBfvgEJYbYEdhlhbwQ,14270
+datadog_lambda/trigger.py,sha256=LfdyPvU8Qq2D9-3QMmq_5XBJ-E64B7NDBnXZ_eQIqKo,14598
+datadog_lambda/version.py,sha256=MBl-08iJNVy_nyamBQviE0yhqUjioZtisRer_BnpeJ4,24
+datadog_lambda/wrapper.py,sha256=yfzneYh0LtW7ytkuXIZOrcULGQIrPdH9g7sextuOH4g,14738
 datadog_lambda/xray.py,sha256=jvA4Fk76PLMgsjUoUZ7gp2otv53hFt39Nvso1ZNaivg,3749
-datadog_lambda-8.113.0.dist-info/LICENSE,sha256=4yQmjpKp1MKL7DdRDPVHkKYc2W0aezm5SIDske8oAdM,11379
-datadog_lambda-8.113.0.dist-info/LICENSE-3rdparty.csv,sha256=9CDAR1GKawwTbZkqt1RP0uwEcaRM3RhOeTB5tWXr8Ts,1381
-datadog_lambda-8.113.0.dist-info/METADATA,sha256=eOT372rwVMUz4fdAIrkcEfT3Bx1Kuro2vWGymFpQY38,7727
-datadog_lambda-8.113.0.dist-info/NOTICE,sha256=Jue-d8mQ1ENIHDZdYc2-X8mVYtScXb8pzF1pTLN-kRc,141
-datadog_lambda-8.113.0.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
-datadog_lambda-8.113.0.dist-info/RECORD,,
+datadog_lambda-8.114.0.dist-info/LICENSE,sha256=4yQmjpKp1MKL7DdRDPVHkKYc2W0aezm5SIDske8oAdM,11379
+datadog_lambda-8.114.0.dist-info/LICENSE-3rdparty.csv,sha256=9CDAR1GKawwTbZkqt1RP0uwEcaRM3RhOeTB5tWXr8Ts,1381
+datadog_lambda-8.114.0.dist-info/METADATA,sha256=dKOTfbF5ue0qu8OwTtnH4WHjB5fjIab0aXsA2cYLqAI,7727
+datadog_lambda-8.114.0.dist-info/NOTICE,sha256=Jue-d8mQ1ENIHDZdYc2-X8mVYtScXb8pzF1pTLN-kRc,141
+datadog_lambda-8.114.0.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
+datadog_lambda-8.114.0.dist-info/RECORD,,