[Julio-Guerra]

Throwaway prototype. Do not merge. Cross-component prototype for the RFC "CADR for AWS Lambda" (Multica JULIO-11, epic APPSEC-71674). Companion PRs: datadog-lambda-extension and system-tests (linked from the Multica issue).

What does this PR do?

Behind DD_APPSEC_AWS_ACCESS_KEY_ID_TAG_ENABLED (default false), when tracer AppSec monitors an HTTP invocation, set aws.lambda.access_key_id on the aws.lambda span to the execution environment's AWS_ACCESS_KEY_ID.

• datadog_lambda/config.py: new appsec_aws_access_key_id_enabled key.
• datadog_lambda/asm.py: _get_aws_access_key_id() reads AWS_ACCESS_KEY_ID once, at the first monitored invocation (after a SnapStart restore, never before the snapshot), and keeps it only if it matches ^(ASIA|AKIA)[A-Z0-9]{16}$. asm_start_request sets the tag on the span it already receives. AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN are never read.

Motivation

Every CADR correlation starts from a Workload Protection signal, and Workload Protection does not run on Lambda. The access key ID is constant for an execution environment's life and CloudTrail records it as userIdentity.accessKeyId, so it can join AAP signals on Lambda to Cloud SIEM signals. This PR checks that the RFC design core (D1 to D8) can be built in the reference component.

Testing Guidelines

• pytest tests/: 1006 passed, including 17 new cases in tests/test_asm.py: tag set on Function URL, API Gateway REST and HTTP, and ALB events (S1); off when unset, false or 0 (S2); no tag and no log above debug for empty, missing and malformed values (S5); read once (S6); no tag on SQS; the secret and the token are never read (the test fails if they are, checked by mutation).
• black --check clean; flake8 clean on the changed files (the other E231 hits are pre-existing).
• End to end through system-tests (APPSEC_LAMBDA_AWS_ACCESS_KEY_ID, ..._DEFAULT) with a v8.130.0 layer with these two modules recompiled in: tag present on the backend payload next to the crs-930-120 event, absent by default, no canary in any payload or log.
• Cost: about 0.16 µs per invocation (cached read and set_tag), 0.31 µs for the first read, measured locally with timeit.

Additional Notes

• SnapStart: with SnapStart on, Lambda does not set AWS_ACCESS_KEY_ID; the runtime uses AWS_CONTAINER_CREDENTIALS_FULL_URI instead (AWS docs). This code then emits no tag, which is safe, but SnapStart functions are not covered. Raised as an RFC addendum on the Multica issue.
• Before the extension v102 wrapper, tracer AppSec and extension AppSec both run when DD_SERVERLESS_APPSEC_ENABLED is set. This code then tags too (same key, same value, same span).

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog
• This PR passes the integration tests (ask a Datadog member to run the tests)

🤖 Generated with Claude Code