ddtrace 3.11.0rc1__cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl → 3.11.0rc3__cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl

ddtrace/_logger.py

@@ -20,6 +20,7 @@ class LogInjectionState(object):
     # Log injection is enabled, but not yet configured
     ENABLED = "true"
     # Log injection is enabled and configured for structured logging
+    # This value is deprecated, but kept for backwards compatibility
     STRUCTURED = "structured"
 
 
@@ -108,17 +109,15 @@ def set_log_formatting():
         handler.setFormatter(logging.Formatter(DD_LOG_FORMAT))
 
 
-def get_log_injection_state(raw_config: Optional[str]) -> str:
+def get_log_injection_state(raw_config: Optional[str]) -> bool:
     """Returns the current log injection state."""
     if raw_config:
         normalized = raw_config.lower().strip()
-        if normalized == LogInjectionState.STRUCTURED:
-            return LogInjectionState.STRUCTURED
-        elif normalized in ("true", "1"):
-            return LogInjectionState.ENABLED
+        if normalized == LogInjectionState.STRUCTURED or normalized in ("true", "1"):
+            return True
         elif normalized not in ("false", "0"):
             logging.warning(
                 "Invalid log injection state '%s'. Expected 'true', 'false', or 'structured'. Defaulting to 'false'.",
                 normalized,
             )
-    return LogInjectionState.DISABLED
+    return False

ddtrace/_trace/product.py

@@ -215,7 +215,7 @@ def apm_tracing_rc(lib_config, dd_config):
             new_rc_configs["_trace_sampling_rules"] = trace_sampling_rules
 
     if "log_injection_enabled" in lib_config:
-        new_rc_configs["_logs_injection"] = str(lib_config["log_injection_enabled"]).lower()
+        new_rc_configs["_logs_injection"] = lib_config["log_injection_enabled"]
 
     if "tracing_tags" in lib_config:
         tags = lib_config["tracing_tags"]

ddtrace/_trace/sampling_rule.py

@@ -60,7 +60,7 @@ class SamplingRule(object):
             number of characters, and "?" meaning any one character. If all tags specified in a SamplingRule are
             matches with a given span, that span is considered to have matching tags with the rule.
         """
-        self.sample_rate = float(min(1, max(0, sample_rate)))
+        self.sample_rate = min(1.0, max(0.0, float(sample_rate)))
         # since span.py converts None to 'None' for tags, and does not accept 'None' for metrics
         # we can just create a GlobMatcher for 'None' and it will match properly
         self._tag_value_matchers = (
@@ -111,46 +111,38 @@ class SamplingRule(object):
         :returns: Whether this span matches or not
         :rtype: :obj:`bool`
         """
-        tags_match = self.tags_match(span)
-        return tags_match and self._matches((span.service, span.name, span.resource))
+        return self.tags_match(span) and self._matches((span.service, span.name, span.resource))
 
     def tags_match(self, span: Span) -> bool:
-        tag_match = True
-        if self._tag_value_matchers:
-            tag_match = self.check_tags(span.get_tags(), span.get_metrics())
-        return tag_match
+        if not self._tag_value_matchers:
+            return True
 
-    def check_tags(self, meta, metrics):
-        if meta is None and metrics is None:
+        meta = span._meta or {}
+        metrics = span._metrics or {}
+        if not meta and not metrics:
             return False
 
-        tag_match = False
-        for tag_key in self._tag_value_matchers.keys():
-            value = meta.get(tag_key)
-            # it's because we're not checking metrics first before continuing
+        for tag_key, pattern in self._tag_value_matchers.items():
+            value = meta.get(tag_key, metrics.get(tag_key))
             if value is None:
-                value = metrics.get(tag_key)
-                if value is None:
-                    continue
-                # Floats: Matching floating point values with a non-zero decimal part is not supported.
-                # For floating point values with a non-zero decimal part, any all * pattern always returns true.
-                # Other patterns always return false.
-                if isinstance(value, float):
-                    if not value.is_integer():
-                        if all(c == "*" for c in self._tag_value_matchers[tag_key].pattern):
-                            tag_match = True
-                            continue
-                        else:
-                            return False
-                    else:
-                        value = int(value)
-
-            tag_match = self._tag_value_matchers[tag_key].match(str(value))
-            # if we don't match with all specified tags for a rule, it's not a match
-            if tag_match is False:
+                # If the tag is not present, we failed the match
+                # (Metrics and meta do not support the value None)
+                return False
+
+            if isinstance(value, float):
+                # Floats: Convert floats that represent integers to int for matching. This is because
+                # SamplingRules only support integers for matfching or glob patterns.
+                if value.is_integer():
+                    value = int(value)
+                elif set(pattern.pattern) - {"?", "*"}:
+                    # Only match floats to patterns that only contain wildcards (ex: * or ?*)
+                    # This is because we do not want to match floats to patterns like `23.*`.
+                    return False
+
+            if not pattern.match(str(value)):
                 return False
 
-        return tag_match
+        return True
 
     def sample(self, span):
         """

ddtrace/_trace/trace_handlers.py

@@ -661,13 +661,9 @@ def _on_botocore_patched_bedrock_api_call_started(ctx, request_params):
 
     span.set_tag_str("bedrock.request.model_provider", ctx["model_provider"])
     span.set_tag_str("bedrock.request.model", ctx["model_name"])
-    for k, v in request_params.items():
-        if k == "prompt":
-            if integration.is_pc_sampled_span(span):
-                v = integration.trunc(str(v))
-        span.set_tag_str("bedrock.request.{}".format(k), str(v))
-        if k == "n":
-            ctx.set_item("num_generations", str(v))
+
+    if "n" in request_params:
+        ctx.set_item("num_generations", str(request_params["n"]))
 
 
 def _on_botocore_patched_bedrock_api_call_exception(ctx, exc_info):
@@ -680,16 +676,6 @@ def _on_botocore_patched_bedrock_api_call_exception(ctx, exc_info):
     span.finish()
 
 
-def _on_botocore_patched_bedrock_api_call_success(ctx, reqid, latency, input_token_count, output_token_count):
-    span = ctx.span
-    span.set_tag_str("bedrock.response.id", reqid)
-    span.set_tag_str("bedrock.response.duration", latency)
-    if input_token_count:
-        span.set_metric("bedrock.response.usage.prompt_tokens", int(input_token_count))
-    if output_token_count:
-        span.set_metric("bedrock.response.usage.completion_tokens", int(output_token_count))
-
-
 def _propagate_context(ctx, headers):
     distributed_tracing_enabled = ctx["integration_config"].distributed_tracing_enabled
     span = ctx.span
@@ -731,38 +717,13 @@ def _on_botocore_bedrock_process_response_converse(
 def _on_botocore_bedrock_process_response(
     ctx: core.ExecutionContext,
     formatted_response: Dict[str, Any],
-    metadata: Dict[str, Any],
-    body: Dict[str, List[Dict]],
-    should_set_choice_ids: bool,
 ) -> None:
-    text = formatted_response["text"]
-    span = ctx.span
-    model_name = ctx["model_name"]
-    if should_set_choice_ids:
-        for i in range(len(text)):
-            span.set_tag_str("bedrock.response.choices.{}.id".format(i), str(body["generations"][i]["id"]))
-    integration = ctx["bedrock_integration"]
-    if metadata is not None:
-        for k, v in metadata.items():
-            if k in ["usage.completion_tokens", "usage.prompt_tokens"] and v:
-                span.set_metric("bedrock.response.{}".format(k), int(v))
-            else:
-                span.set_tag_str("bedrock.{}".format(k), str(v))
-    if "embed" in model_name:
-        span.set_metric("bedrock.response.embedding_length", len(formatted_response["text"][0]))
-        span.finish()
-        return
-    for i in range(len(formatted_response["text"])):
-        if integration.is_pc_sampled_span(span):
-            span.set_tag_str(
-                "bedrock.response.choices.{}.text".format(i),
-                integration.trunc(str(formatted_response["text"][i])),
-            )
-        span.set_tag_str(
-            "bedrock.response.choices.{}.finish_reason".format(i), str(formatted_response["finish_reason"][i])
-        )
-    integration.llmobs_set_tags(span, args=[ctx], kwargs={}, response=formatted_response)
-    span.finish()
+    with ctx.span as span:
+        model_name = ctx["model_name"]
+        integration = ctx["bedrock_integration"]
+        if "embed" in model_name:
+            return
+        integration.llmobs_set_tags(span, args=[ctx], kwargs={}, response=formatted_response)
 
 
 def _on_botocore_sqs_recvmessage_post(
@@ -872,10 +833,12 @@ def _on_azure_functions_service_bus_trigger_span_modifier(
     span = ctx.span
     _set_azure_function_tags(span, azure_functions_config, function_name, trigger, span_kind)
     span.set_tag_str(MESSAGING_DESTINATION_NAME, entity_name)
-    span.set_tag_str(MESSAGING_MESSAGE_ID, message_id)
     span.set_tag_str(MESSAGING_OPERATION, "receive")
     span.set_tag_str(MESSAGING_SYSTEM, azure_servicebusx.SERVICE)
 
+    if message_id is not None:
+        span.set_tag_str(MESSAGING_MESSAGE_ID, message_id)
+
 
 def _on_azure_servicebus_send_message_modifier(ctx, azure_servicebus_config, entity_name, fully_qualified_namespace):
     span = ctx.span
@@ -929,7 +892,6 @@ def listen():
     core.on("botocore.client_context.update_messages", _on_botocore_update_messages)
     core.on("botocore.patched_bedrock_api_call.started", _on_botocore_patched_bedrock_api_call_started)
     core.on("botocore.patched_bedrock_api_call.exception", _on_botocore_patched_bedrock_api_call_exception)
-    core.on("botocore.patched_bedrock_api_call.success", _on_botocore_patched_bedrock_api_call_success)
     core.on("botocore.bedrock.process_response", _on_botocore_bedrock_process_response)
     core.on("botocore.bedrock.process_response_converse", _on_botocore_bedrock_process_response_converse)
     core.on("botocore.sqs.ReceiveMessage.post", _on_botocore_sqs_recvmessage_post)

ddtrace/_trace/utils_botocore/span_tags.py

@@ -12,11 +12,52 @@ from ddtrace.ext import SpanKind
 from ddtrace.ext import aws
 from ddtrace.ext import http
 from ddtrace.internal.constants import COMPONENT
+from ddtrace.internal.serverless import in_aws_lambda
 from ddtrace.internal.utils.formats import deep_getattr
 
 
 _PAYLOAD_TAGGER = AWSPayloadTagging()
 
+SERVICE_MAP = {
+    "eventbridge": "events",
+    "events": "events",
+    "sqs": "sqs",
+    "sns": "sns",
+    "kinesis": "kinesis",
+    "dynamodb": "dynamodb",
+    "dynamodbdocument": "dynamodb",
+}
+
+
+# Helper to build AWS hostname from service, region and parameters
+def _derive_peer_hostname(service: str, region: str, params: Optional[Dict[str, Any]] = None) -> Optional[str]:
+    """Return hostname for given AWS service according to Datadog peer hostname rules.
+
+    Only returns hostnames for specific AWS services:
+        - eventbridge/events -> events.<region>.amazonaws.com
+        - sqs               -> sqs.<region>.amazonaws.com
+        - sns               -> sns.<region>.amazonaws.com
+        - kinesis           -> kinesis.<region>.amazonaws.com
+        - dynamodb          -> dynamodb.<region>.amazonaws.com
+        - s3                -> <bucket>.s3.<region>.amazonaws.com (if Bucket param present)
+                              s3.<region>.amazonaws.com          (otherwise)
+
+    Other services return ``None``.
+    """
+
+    if not region:
+        return None
+
+    aws_service = service.lower()
+
+    if aws_service == "s3":
+        bucket = params.get("Bucket") if params else None
+        return f"{bucket}.s3.{region}.amazonaws.com" if bucket else f"s3.{region}.amazonaws.com"
+
+    mapped = SERVICE_MAP.get(aws_service)
+
+    return f"{mapped}.{region}.amazonaws.com" if mapped else None
+
 
 def set_botocore_patched_api_call_span_tags(span: Span, instance, args, params, endpoint_name, operation):
     span.set_tag_str(COMPONENT, config.botocore.integration_name)
@@ -51,6 +92,13 @@ def set_botocore_patched_api_call_span_tags(span: Span, instance, args, params,
         span.set_tag_str("aws.region", region_name)
         span.set_tag_str("region", region_name)
 
+        # Derive peer hostname only in serverless environments to avoid
+        # unnecessary tag noise in traditional hosts/containers.
+        if in_aws_lambda():
+            hostname = _derive_peer_hostname(endpoint_name, region_name, params)
+            if hostname:
+                span.set_tag_str("peer.service", hostname)
+
 
 def set_botocore_response_metadata_tags(
     span: Span, result: Dict[str, Any], is_error_code_fn: Optional[Callable] = None

ddtrace/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.11.0rc1'
-__version_tuple__ = version_tuple = (3, 11, 0, 'rc1')
+__version__ = version = '3.11.0rc3'
+__version_tuple__ = version_tuple = (3, 11, 0, 'rc3')

ddtrace/appsec/_asm_request_context.py

@@ -1,6 +1,7 @@
 import functools
 import json
 import re
+from types import TracebackType
 from typing import Any
 from typing import Callable
 from typing import Dict
@@ -8,6 +9,7 @@ from typing import List
 from typing import Literal
 from typing import Optional
 from typing import Set
+from typing import Tuple
 from typing import Union
 from urllib import parse
 
@@ -534,7 +536,7 @@ def end_context(span: Span):
         finalize_asm_env(env)
 
 
-def _on_context_ended(ctx):
+def _on_context_ended(ctx, _exc_info: Tuple[Optional[type], Optional[BaseException], Optional[TracebackType]]):
     env = ctx.get_local_item(_ASM_CONTEXT)
     if env is not None:
         finalize_asm_env(env)

ddtrace/appsec/_constants.py

@@ -275,6 +275,12 @@ class API_SECURITY(metaclass=Constant_Class):
     SAMPLE_RATE: Literal["DD_API_SECURITY_REQUEST_SAMPLE_RATE"] = "DD_API_SECURITY_REQUEST_SAMPLE_RATE"
     SAMPLE_DELAY: Literal["DD_API_SECURITY_SAMPLE_DELAY"] = "DD_API_SECURITY_SAMPLE_DELAY"
     MAX_PAYLOAD_SIZE: Literal[0x1000000] = 0x1000000  # 16MB maximum size
+    ENDPOINT_COLLECTION: Literal[
+        "DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED"
+    ] = "DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED"
+    ENDPOINT_COLLECTION_LIMIT: Literal[
+        "DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT"
+    ] = "DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT"
 
 
 class WAF_CONTEXT_NAMES(metaclass=Constant_Class):
@@ -348,6 +354,7 @@ class DEFAULT(metaclass=Constant_Class):
         r"|ey[I-L][\w=-]+\.(ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?)|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}([^\-]+)[\-]"
         r"{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*([a-z0-9\/\.+]{100,})"
     )
+    ENDPOINT_COLLECTION_LIMIT = 300
 
 
 class EXPLOIT_PREVENTION(metaclass=Constant_Class):

ddtrace/appsec/_handlers.py

@@ -4,6 +4,7 @@ import json
 from typing import Any
 from typing import Dict
 from typing import Optional
+from typing import Union
 
 import xmltodict
 
@@ -11,6 +12,7 @@ from ddtrace._trace.span import Span
 from ddtrace.appsec._asm_request_context import _call_waf
 from ddtrace.appsec._asm_request_context import _call_waf_first
 from ddtrace.appsec._asm_request_context import get_blocked
+from ddtrace.appsec._asm_request_context import set_body_response
 from ddtrace.appsec._constants import SPAN_DATA_NAMES
 from ddtrace.appsec._http_utils import extract_cookies_from_headers
 from ddtrace.appsec._http_utils import normalize_headers
@@ -157,6 +159,14 @@ def _on_lambda_start_response(
     _call_waf(("aws_lambda",))
 
 
+def _on_lambda_parse_body(
+    response_body: Optional[Union[str, Dict[str, Any]]],
+):
+    if asm_config._api_security_feature_active:
+        if response_body:
+            set_body_response(response_body)
+
+
 # ASGI
 
 
@@ -408,6 +418,7 @@ def listen():
 
     core.on("aws_lambda.start_request", _on_lambda_start_request)
     core.on("aws_lambda.start_response", _on_lambda_start_response)
+    core.on("aws_lambda.parse_body", _on_lambda_parse_body)
 
     core.on("grpc.server.response.message", _on_grpc_server_response)
     core.on("grpc.server.data", _on_grpc_server_data)

ddtrace/appsec/_iast/_listener.py

@@ -1,3 +1,7 @@
+from types import TracebackType
+from typing import Optional
+from typing import Tuple
+
 from ddtrace.appsec._iast._handlers import _iast_on_wrapped_view
 from ddtrace.appsec._iast._handlers import _on_asgi_finalize_response
 from ddtrace.appsec._iast._handlers import _on_django_finalize_response_pre
@@ -19,6 +23,12 @@ from ddtrace.internal import core
 
 
 def iast_listen():
+    def _iast_context_end(
+        ctx: core.ExecutionContext,
+        _exc_info: Tuple[Optional[type], Optional[BaseException], Optional[TracebackType]],
+    ):
+        _iast_end_request(ctx)
+
     core.on("grpc.client.response.message", _on_grpc_response)
     core.on("grpc.server.response.message", _on_grpc_server_response)
 
@@ -37,8 +47,8 @@ def iast_listen():
     core.on("flask.finalize_request.post", _on_flask_finalize_request_post)
     core.on("werkzeug.render_debugger_html", _on_werkzeug_render_debugger_html)
 
-    core.on("context.ended.wsgi.__call__", _iast_end_request)
-    core.on("context.ended.asgi.__call__", _iast_end_request)
+    core.on("context.ended.wsgi.__call__", _iast_context_end)
+    core.on("context.ended.asgi.__call__", _iast_context_end)
 
     # Sink points
     core.on("db_query_check", _on_report_sqli)

ddtrace/appsec/_processor.py

@@ -189,7 +189,7 @@ class AppSecSpanProcessor(SpanProcessor):
             if skip_event:
                 core.discard_item("appsec_skip_next_lambda_event")
                 log.debug(
-                    "appsec: ignoring unsupported lamdba event",
+                    "appsec: ignoring unsupported lambda event",
                 )
                 span.set_metric(APPSEC.UNSUPPORTED_EVENT_TYPE, 1.0)
                 return

ddtrace/contrib/integration_registry/registry.yaml

@@ -393,6 +393,16 @@ integrations:
       min: 20.12.1
       max: 24.11.1
 
+- integration_name: gunicorn
+  is_external_package: true
+  is_tested: true
+  dependency_names:
+  - gunicorn
+  tested_versions_by_dependency:
+    gunicorn:
+      min: 20.0.4
+      max: 23.0.0
+
 - integration_name: google_genai
   is_external_package: true
   is_tested: true

ddtrace/contrib/internal/aiobotocore/patch.py

@@ -5,6 +5,7 @@ import aiobotocore.client
 import wrapt
 
 from ddtrace import config
+from ddtrace._trace.utils_botocore.span_tags import _derive_peer_hostname
 from ddtrace.constants import _SPAN_MEASURED_KEY
 from ddtrace.constants import SPAN_KIND
 from ddtrace.contrib.internal.trace_utils import ext_service
@@ -16,6 +17,7 @@ from ddtrace.ext import http
 from ddtrace.internal.constants import COMPONENT
 from ddtrace.internal.schema import schematize_cloud_api_operation
 from ddtrace.internal.schema import schematize_service_name
+from ddtrace.internal.serverless import in_aws_lambda
 from ddtrace.internal.utils import ArgumentError
 from ddtrace.internal.utils import get_argument_value
 from ddtrace.internal.utils.formats import asbool
@@ -145,6 +147,12 @@ async def _wrapped_api_call(original_func, instance, args, kwargs):
 
         region_name = deep_getattr(instance, "meta.region_name")
 
+        if in_aws_lambda():
+            # Derive the peer hostname now that we have both service and region.
+            hostname = _derive_peer_hostname(endpoint_name, region_name, params)
+            if hostname:
+                span.set_tag_str("peer.service", hostname)
+
         meta = {
             "aws.agent": "aiobotocore",
             "aws.operation": operation,

ddtrace/contrib/internal/avro/__init__.py

@@ -0,0 +1,17 @@
+"""
+The Avro integration will trace all Avro read / write calls made with the ``avro``
+library. This integration is enabled by default.
+
+Enabling
+~~~~~~~~
+
+The avro integration is enabled by default. Use
+:func:`patch()<ddtrace.patch>` to enable the integration::
+
+    from ddtrace import patch
+    patch(avro=True)
+
+Configuration
+~~~~~~~~~~~~~
+
+"""

ddtrace/contrib/internal/azure_functions/patch.py

@@ -12,6 +12,7 @@ from ddtrace.internal.utils.formats import asbool
 from ddtrace.trace import Pin
 
 from .utils import create_context
+from .utils import message_list_has_single_context
 from .utils import wrap_function_with_tracing
 
 
@@ -97,24 +98,34 @@ def _wrap_service_bus_trigger(pin, func, function_name, trigger_arg_name, trigge
     def context_factory(kwargs):
         resource_name = f"{trigger_type} {function_name}"
         msg = kwargs.get(trigger_arg_name)
-        return create_context(
-            "azure.functions.patched_service_bus", pin, resource_name, headers=msg.application_properties
-        )
+
+        # Reparent trace if single message or list of messages all with same context
+        if isinstance(msg, azure_functions.ServiceBusMessage):
+            application_properties = msg.application_properties
+        elif (
+            isinstance(msg, list)
+            and msg
+            and isinstance(msg[0], azure_functions.ServiceBusMessage)
+            and message_list_has_single_context(msg)
+        ):
+            application_properties = msg[0].application_properties
+        else:
+            application_properties = None
+
+        return create_context("azure.functions.patched_service_bus", pin, resource_name, headers=application_properties)
 
     def pre_dispatch(ctx, kwargs):
         msg = kwargs.get(trigger_arg_name)
+
+        if isinstance(msg, azure_functions.ServiceBusMessage):
+            message_id = msg.message_id
+        else:
+            message_id = None
+
         entity_name = trigger_details.get("topicName") or trigger_details.get("queueName")
         return (
             "azure.functions.service_bus_trigger_modifier",
-            (
-                ctx,
-                config.azure_functions,
-                function_name,
-                trigger_type,
-                SpanKind.CONSUMER,
-                entity_name,
-                msg.message_id,
-            ),
+            (ctx, config.azure_functions, function_name, trigger_type, SpanKind.CONSUMER, entity_name, message_id),
         )
 
     return wrap_function_with_tracing(func, context_factory, pre_dispatch=pre_dispatch)

ddtrace/contrib/internal/azure_functions/utils.py

@@ -1,11 +1,15 @@
 import functools
 import inspect
+from typing import List
+
+import azure.functions as azure_functions
 
 from ddtrace import config
 from ddtrace.contrib.internal.trace_utils import int_service
 from ddtrace.ext import SpanTypes
 from ddtrace.internal import core
 from ddtrace.internal.schema import schematize_cloud_faas_operation
+from ddtrace.propagation.http import HTTPPropagator
 
 
 def create_context(context_name, pin, resource=None, headers=None):
@@ -59,3 +63,13 @@ def wrap_function_with_tracing(func, context_factory, pre_dispatch=None, post_di
                     core.dispatch(*post_dispatch(ctx, res))
 
     return wrapper
+
+
+def message_list_has_single_context(msg_list: List[azure_functions.ServiceBusMessage]):
+    first_context = HTTPPropagator.extract(msg_list[0].application_properties)
+    for message in msg_list[1:]:
+        context = HTTPPropagator.extract(message.application_properties)
+        if first_context != context:
+            return False
+
+    return True

ddtrace/contrib/internal/boto/patch.py

@@ -7,6 +7,7 @@ import boto.connection
 import wrapt
 
 from ddtrace import config
+from ddtrace._trace.utils_botocore.span_tags import _derive_peer_hostname
 from ddtrace.constants import _SPAN_MEASURED_KEY
 from ddtrace.constants import SPAN_KIND
 from ddtrace.ext import SpanKind
@@ -16,6 +17,7 @@ from ddtrace.ext import http
 from ddtrace.internal.constants import COMPONENT
 from ddtrace.internal.schema import schematize_cloud_api_operation
 from ddtrace.internal.schema import schematize_service_name
+from ddtrace.internal.serverless import in_aws_lambda
 from ddtrace.internal.utils import get_argument_value
 from ddtrace.internal.utils.formats import asbool
 from ddtrace.internal.utils.wrappers import unwrap
@@ -122,6 +124,12 @@ def patched_query_request(original_func, instance, args, kwargs):
             meta[aws.REGION] = region_name
             meta[aws.AWSREGION] = region_name
 
+            if in_aws_lambda():
+                # Derive the peer hostname now that we have both service and region.
+                hostname = _derive_peer_hostname(endpoint_name, region_name, params)
+                if hostname:
+                    meta["peer.service"] = hostname
+
         span.set_tags(meta)
 
         # Original func returns a boto.connection.HTTPResponse object
@@ -183,6 +191,12 @@ def patched_auth_request(original_func, instance, args, kwargs):
             meta[aws.REGION] = region_name
             meta[aws.AWSREGION] = region_name
 
+            if in_aws_lambda():
+                # Derive the peer hostname
+                hostname = _derive_peer_hostname(endpoint_name, region_name, None)
+                if hostname:
+                    meta["peer.service"] = hostname
+
         span.set_tags(meta)
 
         # Original func returns a boto.connection.HTTPResponse object