aws payload tagging

LICENSE-3rdparty.csv

@@ -15,6 +15,7 @@ require,int64-buffer,MIT,Copyright 2015-2016 Yusuke Kawasaki
 require,ipaddr.js,MIT,Copyright 2011-2017 whitequark
 require,istanbul-lib-coverage,BSD-3-Clause,Copyright 2012-2015 Yahoo! Inc.
 require,jest-docblock,MIT,Copyright Meta Platforms, Inc. and affiliates.
+require,jsonpath,MIT,Copyright 2014-2016 David Chester
 require,koalas,MIT,Copyright 2013-2017 Brian Woodward
 require,limiter,MIT,Copyright 2011 John Hurliman
 require,lodash.sortby,MIT,Copyright JS Foundation and other contributors
@@ -29,6 +30,7 @@ require,pprof-format,MIT,Copyright 2022 Stephen Belanger
 require,protobufjs,BSD-3-Clause,Copyright 2016 Daniel Wirtz
 require,tlhunter-sorted-set,MIT,Copyright (c) 2023 Datadog Inc.
 require,retry,MIT,Copyright 2011 Tim Koschützki Felix Geisendörfer
+require,rfdc,MIT,Copyright 2019 David Mark Clements
 require,semver,ISC,Copyright Isaac Z. Schlueter and Contributors
 require,shell-quote,mit,Copyright (c) 2013 James Halliday
 dev,@types/node,MIT,Copyright Authors

index.d.ts

@@ -712,6 +712,26 @@ declare namespace tracer {
      * The selection and priority order of context propagation injection and extraction mechanisms.
      */
     propagationStyle?: string[] | PropagationStyle
+
+    /**
+     * Cloud payload report as tags
+     */
+    cloudPayloadTagging?: {
+      /**
+       *  Additional JSONPath queries to replace with `redacted` in request payloads
+       *  Undefined or invalid JSONPath queries disable the feature for requests.
+       */
+      request?: string,
+      /**
+       *  Additional JSONPath queries to replace with `redacted` in response payloads
+       *  Undefined or invalid JSONPath queries disable the feature for responses.
+       */
+      response?: string,
+      /**
+       *  Maximum depth of payload traversal for tags
+       */
+      maxDepth?: number
+    }
   }
 
   /**

package.json

@@ -86,6 +86,7 @@
     "ipaddr.js": "^2.1.0",
     "istanbul-lib-coverage": "3.2.0",
     "jest-docblock": "^29.7.0",
+    "jsonpath": "^1.1.1",
     "koalas": "^1.0.2",
     "limiter": "1.1.5",
     "lodash.sortby": "^4.7.0",
@@ -99,6 +100,7 @@
     "pprof-format": "^2.1.0",
     "protobufjs": "^7.2.5",
     "retry": "^0.13.1",
+    "rfdc": "^1.3.1",
     "semver": "^7.5.4",
     "shell-quote": "^1.8.1",
     "tlhunter-sorted-set": "^0.1.0"
@@ -119,7 +121,7 @@
     "eslint": "^8.23.0",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.8.0",
-    "eslint-plugin-mocha": "^10.1.0",
+    "eslint-plugin-mocha": "<10.3.0",
     "eslint-plugin-n": "^15.7.0",
     "eslint-plugin-promise": "^3.6.0",
     "eslint-plugin-standard": "^3.0.1",

packages/datadog-plugin-aws-sdk/src/base.js

@@ -4,9 +4,11 @@ const analyticsSampler = require('../../dd-trace/src/analytics_sampler')
 const ClientPlugin = require('../../dd-trace/src/plugins/client')
 const { storage } = require('../../datadog-core')
 const { isTrue } = require('../../dd-trace/src/util')
+const { tagsFromRequest, tagsFromResponse } = require('../../dd-trace/src/payload-tagging')
 
 class BaseAwsSdkPlugin extends ClientPlugin {
   static get id () { return 'aws' }
+  static get isPayloadReporter () { return false }
 
   get serviceIdentifier () {
     const id = this.constructor.id.toLowerCase()
@@ -19,6 +21,12 @@ class BaseAwsSdkPlugin extends ClientPlugin {
     return id
   }
 
+  get cloudTaggingConfig () { return this._tracerConfig.cloudPayloadTagging }
+
+  get payloadTaggingRules () {
+    return this.cloudTaggingConfig.rules['aws']?.[this.constructor.id]
+  }
+
   constructor (...args) {
     super(...args)
 
@@ -50,6 +58,12 @@ class BaseAwsSdkPlugin extends ClientPlugin {
 
       this.requestInject(span, request)
 
+      if (this.constructor.isPayloadReporter && this.cloudTaggingConfig.requestsEnabled) {
+        const maxDepth = this.cloudTaggingConfig.maxDepth
+        const requestTags = tagsFromRequest(this.payloadTaggingRules, request.params, { maxDepth })
+        span.addTags(requestTags)
+      }
+
       const store = storage.getStore()
 
       this.enter(span, store)
@@ -109,13 +123,30 @@ class BaseAwsSdkPlugin extends ClientPlugin {
     const params = response.request.params
     const operation = response.request.operation
     const extraTags = this.generateTags(params, operation, response) || {}
+
     const tags = Object.assign({
       'aws.response.request_id': response.requestId,
       'resource.name': operation,
       'span.kind': 'client'
     }, extraTags)
 
     span.addTags(tags)
+
+    if (this.constructor.isPayloadReporter && this.cloudTaggingConfig.responsesEnabled) {
+      const maxDepth = this.cloudTaggingConfig.maxDepth
+      const responseBody = this.extractResponseBody(response)
+      const responseTags = tagsFromResponse(this.payloadTaggingRules, responseBody, { maxDepth })
+      span.addTags(responseTags)
+    }
+  }
+
+  extractResponseBody (response) {
+    if (response.hasOwnProperty('data')) {
+      return response.data
+    }
+    return Object.fromEntries(
+      Object.entries(response).filter(([key]) => !['request', 'requestId', 'error', '$metadata'].includes(key))
+    )
   }
 
   generateTags () {

packages/datadog-plugin-aws-sdk/src/services/sns.js

@@ -7,6 +7,7 @@ const BaseAwsSdkPlugin = require('../base')
 class Sns extends BaseAwsSdkPlugin {
   static get id () { return 'sns' }
   static get peerServicePrecursors () { return ['topicname'] }
+  static get isPayloadReporter () { return true }
 
   generateTags (params, operation, response) {
     if (!params) return {}
@@ -20,6 +21,7 @@ class Sns extends BaseAwsSdkPlugin {
 
     // Get the topic name from the last part of the ARN
     const topicName = arnParts[arnParts.length - 1]
+
     return {
       'resource.name': `${operation} ${params.TopicArn || response.data.TopicArn}`,
       'aws.sns.topic_arn': TopicArn,