[Julio-Guerra]

Throwaway prototype for a design review. Do not merge.

What does this PR do?

On the tracer AppSec path, it tags the aws.lambda span of each HTTP invocation that AppSec monitors with aws.lambda.access_key_id. The value is the execution environment's AWS_ACCESS_KEY_ID. The tag is off by default, behind DD_APPSEC_AWS_ACCESS_KEY_ID_TAG_ENABLED.

• datadog_lambda/config.py: new appsec_aws_access_key_id_enabled (DD_APPSEC_AWS_ACCESS_KEY_ID_TAG_ENABLED, default false).
• datadog_lambda/asm.py: asm_start_request sets the tag before it dispatches aws_lambda.start_request, so the tag is in place before the WAF runs, including on blocked requests.
  • AWS_ACCESS_KEY_ID is read once per process, at the first monitored invocation, not at import.
  • The value must fully match (ASIA|AKIA)[A-Z0-9]{16}. Otherwise there is no tag and one debug line, without the value.
  • On SnapStart (AWS_LAMBDA_INITIALIZATION_TYPE=snap-start), it does not read and does not tag, because os.environ comes from the snapshot.
• The secret access key and the session token are never read. wrapper.py is unchanged.

Motivation

CADR links AAP, Workload Protection and Cloud SIEM signals, but every correlation starts from a Workload Protection signal, and Workload Protection does not run on AWS Lambda. The execution environment's access key ID stays the same for the environment's life, and CloudTrail records it as userIdentity.accessKeyId, so it can join an AAP signal on Lambda to Cloud SIEM signals. This prototype backs the datadog-lambda-python LLD of the "CADR for AWS Lambda" RFC (APPSEC-71674).

Testing Guidelines

• pytest tests: 1042 passed, 53 of them new. Local run on Python 3.12.8 with ddtrace 4.16.4.
  • Unit tests in tests/test_asm.py: every HTTP event type, the feature off, canary secret and token, malformed and missing values, read-once caching, SnapStart, and non-HTTP triggers.
  • Wrapper tests in tests/test_wrapper.py: the tag is on aws.lambda and not on the inferred span; no tag with AppSec off; no tag with only DD_SERVERLESS_APPSEC_ENABLED; the same value on two invocations.
  • One wrapper test runs the real WAF in a fresh interpreter: crs-930-120 fires, the tag is set, and neither canary appears.
• black --check datadog_lambda/ tests (black 25.11.0): clean. flake8 on the changed files: clean.
• Micro benchmark test_benchmarks.py::test_asm_start_request_access_key_id: median 12.88 µs with the feature off and 14.08 µs on, so about +1.2 µs per monitored invocation.

Additional Notes

• Draft and throwaway: the real change goes through a later build PR, after the RFC is accepted.
• The tag name is still open, pending the APM span-tag owners and a privacy review.
• DD_SERVERLESS_APPSEC_ENABLED does not turn tracer AppSec off in Python. If a function sets it together with DD_APPSEC_ENABLED, both AppSec paths run on the same span. The extension should therefore not tag tracer spans that carry _dd.appsec.serverless.tracer. This is proposed as an RFC addendum.

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog
• This PR passes the integration tests (ask a Datadog member to run the tests)

🤖 Generated with Claude Code