[APPSEC]: fix Lambda not appearing on the Appsec API Security Endpoint Catalog #654
Conversation
florentinl
force-pushed
the
florentinl/APPSEC-58777/fix-apisec
branch
from
c342a79 to
fe56770
Compare
| @@ -8,8 +8,6 @@ | |||
| "DD_APPSEC_ENABLED", "false" | |||
| ) | |||
|
|
|||
| if os.environ.get("DD_API_SECURITY_ENABLED") is None: | |||
| os.environ["DD_API_SECURITY_ENABLED"] = "False" | |||
There was a problem hiding this comment.
@florentinl question: what does the DD_API_SECURITY_ENABLED env var do? What impact will there be from removing this?
There was a problem hiding this comment.
This env controls the enablement of the API Security feature of Appsec. It extracts the schema of the request and runs additional security rules.
On all tracers, it is enabled by default and discussing it with the security ecosystems team there is no reason to change the default for lambda.
Of course, this feature is a sub feature of Appsec and is automatically disabled when DD_APPSEC_ENABLED is not set to a truthy value (see APIManager enablement in dd-trace-py)
| @@ -288,7 +288,7 @@ def extract_http_tags(event): | |||
| """ | |||
| Extracts HTTP facet tags from the triggering event | |||
| """ | |||
| http_tags = {} | |||
| http_tags = {"span.kind": "server"} | |||
There was a problem hiding this comment.
Good catch, I originally made changes to add this tag to all the related synthetic spans but missed it on the actual aws.lambda span. Is there a plan on the roadmap for getting this done in the Node Layer and the Rust extension as well?
There was a problem hiding this comment.
Nothing formally planned yet. But we are interested in having it across all lambda layers to fix API Security in lambda (already available through the go and now rust extension).
I can look into it, if you want.
What does this PR do?
This PR adds the
span.kindtag with the valueserverfor all events that represent an HTTP Request. The api security backend expects it to be present and omits endpoints that do not have this tag. (documentation for this attribute can be found here)Additionally API Security should be enabled by default, there is no need to intentionally disable it for Appsec in lambda.
Motivation
The goal of this PR is to make Lambda services with Appsec API Security enabled show up on the API Security Catalog.
Testing Guidelines
Updated existing tests
Additional Notes
This issue also impacts API Security when it is enabled through the extension.
As of today, the API Security Endpoint Catalog uses the
resource_nameto display the endpoint and expects it to be in the formatGET /path/to/resourcebut lambda sets it to the function name instead. This should maybe be solved in the backend and will be done at a later time.Types of Changes
Check all that apply