Skip to content

Commit 95b00f0

Browse files
astuyvejoeyzhao2018
astuyve
and
joeyzhao2018
authored
aj/authorizer trace context (#300)
* wip: auth trace context * wip * wip stash * feat: working surrogate authorizer span and propagation. * feat: Use the tracer implementation of inject * refactor: Clean up trace header extraction into common method * refactor: clean up unneeded vars * feat: Config for encodeAuthorizerContext. * feat: Update default config tests * feat: working authorization propagation for token-based authorizers * feat: Add spec, remove unused attribute * feat: Specs for context and span inferrer * feat: Parse JSON with try * feat: fix bad autoimport * feat: remove unused variable * feat: remove unused id class * fix: and remove unused id export * feat: Remove more POC code * feat: Coalesce isTracedAuthorizerInvocation into a bool, add comments to describe when we can't create an inferred span * httpapi + restapi handled * move the injection from onEndingInvocation to onCompleteInvocation * lint fixes * all base64encode and all use authorizing requestId * add cached test cases and websocket test cases * fix token-type authorizer * fix the endTime() of SpanWrapper * fix no-string-throw error * padding ms to ns to be compatible with lambdas in other languages * add config.decodeAuthorizerContext and httpapi no zero-length span Co-authored-by: Joey Zhao <[email protected]>
1 parent 6a12c46 commit 95b00f0

20 files changed

+1194
-164
lines changed

‎event_samples/api-gateway-traced-authorizer-request-v1-cached.json

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"resource": "/hello",
3+
"path": "/hello",
4+
"httpMethod": "POST",
5+
"headers": {
6+
"Accept": "*/*",
7+
"Accept-Encoding": "gzip, deflate, br",
8+
"Authorization": "password",
9+
"CloudFront-Forwarded-Proto": "https",
10+
"CloudFront-Is-Desktop-Viewer": "true",
11+
"CloudFront-Is-Mobile-Viewer": "false",
12+
"CloudFront-Is-SmartTV-Viewer": "false",
13+
"CloudFront-Is-Tablet-Viewer": "false",
14+
"CloudFront-Viewer-ASN": "174",
15+
"CloudFront-Viewer-Country": "US",
16+
"Host": "3gsxz7lha4.execute-api.sa-east-1.amazonaws.com",
17+
"Postman-Token": "62ccb3d9-a44f-427c-9952-418c0a2eb1c3",
18+
"User-Agent": "PostmanRuntime/7.29.0",
19+
"Via": "1.1 xxx (CloudFront)",
20+
"X-Amz-Cf-Id": "90JXZEr6stVabQV78Zwn5EADW0evkpWINdmt3jzkuHQh9KtqowKejw==",
21+
"X-Amzn-Trace-Id": "Root=1-62ffee4f-373bdfda15f09a065a39ac73",
22+
"X-Forwarded-For": "38.142.177.195, 64.252.135.71",
23+
"X-Forwarded-Port": "443",
24+
"X-Forwarded-Proto": "https"
25+
},
26+
"multiValueHeaders": {
27+
"Accept": ["*/*"],
28+
"Accept-Encoding": ["gzip, deflate, br"],
29+
"Authorization": ["password"],
30+
"CloudFront-Forwarded-Proto": ["https"],
31+
"CloudFront-Is-Desktop-Viewer": ["true"],
32+
"CloudFront-Is-Mobile-Viewer": ["false"],
33+
"CloudFront-Is-SmartTV-Viewer": ["false"],
34+
"CloudFront-Is-Tablet-Viewer": ["false"],
35+
"CloudFront-Viewer-ASN": ["174"],
36+
"CloudFront-Viewer-Country": ["US"],
37+
"Host": ["3gsxz7lha4.execute-api.sa-east-1.amazonaws.com"],
38+
"Postman-Token": ["62ccb3d9-a44f-427c-9952-418c0a2eb1c3"],
39+
"User-Agent": ["PostmanRuntime/7.29.0"],
40+
"Via": ["1.1 xxx.cloudfront.net (CloudFront)"],
41+
"X-Amz-Cf-Id": ["90JXZEr6stVabQV78Zwn5EADW0evkpWINdmt3jzkuHQh9KtqowKejw=="],
42+
"X-Amzn-Trace-Id": ["Root=1-62ffee4f-373bdfda15f09a065a39ac73"],
43+
"X-Forwarded-For": ["38.142.177.195, 64.252.135.71"],
44+
"X-Forwarded-Port": ["443"],
45+
"X-Forwarded-Proto": ["https"]
46+
},
47+
"queryStringParameters": null,
48+
"multiValueQueryStringParameters": null,
49+
"pathParameters": null,
50+
"stageVariables": null,
51+
"requestContext": {
52+
"resourceId": "oozq9u",
53+
"authorizer": {
54+
"_datadog": "eyJ4LWRhdGFkb2ctdHJhY2UtaWQiOiIyMDk1MzE5NzYxMDg0NzEwNzQ3IiwieC1kYXRhZG9nLXBhcmVudC1pZCI6IjIwOTUzMTk3NjEwODQ3MTA3NDciLCJ4LWRhdGFkb2ctc2FtcGxpbmctcHJpb3JpdHkiOiIxIiwieC1kYXRhZG9nLXBhcmVudC1zcGFuLWZpbmlzaC10aW1lIjoxNjYwOTM5ODU3MDUyLCJ4LWRhdGFkb2ctYXV0aG9yaXppbmctcmVxdWVzdGlkIjoiZjFmOGQ0NmQtZWY2Zi00NmFmLWEzZWQtN2EyMGEyNmUyNjUxIn0=",
55+
"principalId": "foo",
56+
"integrationLatency": 0,
57+
"preserve": "this key set by a customer"
58+
},
59+
"resourcePath": "/hello",
60+
"httpMethod": "POST",
61+
"extendedRequestId": "XIIseElXGjQFvXg=",
62+
"requestTime": "19/Aug/2022:20:10:55 +0000",
63+
"path": "/dev/hello",
64+
"accountId": "601427279990",
65+
"protocol": "HTTP/1.1",
66+
"stage": "dev",
67+
"domainPrefix": "3gsxz7lha4",
68+
"requestTimeEpoch": 1660939855656,
69+
"requestId": "f1f8d46d-ef6f-46af-a3ed-7a20a26e2652",
70+
"identity": {
71+
"cognitoIdentityPoolId": null,
72+
"accountId": null,
73+
"cognitoIdentityId": null,
74+
"caller": null,
75+
"sourceIp": "38.142.177.195",
76+
"principalOrgId": null,
77+
"accessKey": null,
78+
"cognitoAuthenticationType": null,
79+
"cognitoAuthenticationProvider": null,
80+
"userArn": null,
81+
"userAgent": "PostmanRuntime/7.29.0",
82+
"user": null
83+
},
84+
"domainName": "3gsxz7lha4.execute-api.sa-east-1.amazonaws.com",
85+
"apiId": "3gsxz7lha4"
86+
},
87+
"body": null,
88+
"isBase64Encoded": false
89+
}

‎event_samples/api-gateway-traced-authorizer-request-v1.json

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"resource": "/hello",
3+
"path": "/hello",
4+
"httpMethod": "POST",
5+
"headers": {
6+
"Accept": "*/*",
7+
"Accept-Encoding": "gzip, deflate, br",
8+
"Authorization": "password",
9+
"CloudFront-Forwarded-Proto": "https",
10+
"CloudFront-Is-Desktop-Viewer": "true",
11+
"CloudFront-Is-Mobile-Viewer": "false",
12+
"CloudFront-Is-SmartTV-Viewer": "false",
13+
"CloudFront-Is-Tablet-Viewer": "false",
14+
"CloudFront-Viewer-ASN": "174",
15+
"CloudFront-Viewer-Country": "US",
16+
"Host": "3gsxz7lha4.execute-api.sa-east-1.amazonaws.com",
17+
"Postman-Token": "62ccb3d9-a44f-427c-9952-418c0a2eb1c3",
18+
"User-Agent": "PostmanRuntime/7.29.0",
19+
"Via": "1.1 xxx.cloudfront.net (CloudFront)",
20+
"X-Amz-Cf-Id": "90JXZEr6stVabQV78Zwn5EADW0evkpWINdmt3jzkuHQh9KtqowKejw==",
21+
"X-Amzn-Trace-Id": "Root=1-62ffee4f-373bdfda15f09a065a39ac73",
22+
"X-Forwarded-For": "38.142.177.195, 64.252.135.71",
23+
"X-Forwarded-Port": "443",
24+
"X-Forwarded-Proto": "https"
25+
},
26+
"multiValueHeaders": {
27+
"Accept": ["*/*"],
28+
"Accept-Encoding": ["gzip, deflate, br"],
29+
"Authorization": ["password"],
30+
"CloudFront-Forwarded-Proto": ["https"],
31+
"CloudFront-Is-Desktop-Viewer": ["true"],
32+
"CloudFront-Is-Mobile-Viewer": ["false"],
33+
"CloudFront-Is-SmartTV-Viewer": ["false"],
34+
"CloudFront-Is-Tablet-Viewer": ["false"],
35+
"CloudFront-Viewer-ASN": ["174"],
36+
"CloudFront-Viewer-Country": ["US"],
37+
"Host": ["3gsxz7lha4.execute-api.sa-east-1.amazonaws.com"],
38+
"Postman-Token": ["62ccb3d9-a44f-427c-9952-418c0a2eb1c3"],
39+
"User-Agent": ["PostmanRuntime/7.29.0"],
40+
"Via": ["1.1 xxx.cloudfront.net (CloudFront)"],
41+
"X-Amz-Cf-Id": ["90JXZEr6stVabQV78Zwn5EADW0evkpWINdmt3jzkuHQh9KtqowKejw=="],
42+
"X-Amzn-Trace-Id": ["Root=1-62ffee4f-373bdfda15f09a065a39ac73"],
43+
"X-Forwarded-For": ["38.142.177.195, 64.252.135.71"],
44+
"X-Forwarded-Port": ["443"],
45+
"X-Forwarded-Proto": ["https"]
46+
},
47+
"queryStringParameters": null,
48+
"multiValueQueryStringParameters": null,
49+
"pathParameters": null,
50+
"stageVariables": null,
51+
"requestContext": {
52+
"resourceId": "oozq9u",
53+
"authorizer": {
54+
"_datadog": "eyJ4LWRhdGFkb2ctdHJhY2UtaWQiOiIyMDk1MzE5NzYxMDg0NzEwNzQ3IiwieC1kYXRhZG9nLXBhcmVudC1pZCI6IjIwOTUzMTk3NjEwODQ3MTA3NDciLCJ4LWRhdGFkb2ctc2FtcGxpbmctcHJpb3JpdHkiOiIxIiwieC1kYXRhZG9nLXBhcmVudC1zcGFuLWZpbmlzaC10aW1lIjoxNjYwOTM5ODU3MDUyMDAwMDAwLCJ4LWRhdGFkb2ctYXV0aG9yaXppbmctcmVxdWVzdGlkIjoiZjFmOGQ0NmQtZWY2Zi00NmFmLWEzZWQtN2EyMGEyNmUyNjUxIn0=",
55+
"principalId": "foo",
56+
"integrationLatency": 1419,
57+
"preserve": "this key set by a customer"
58+
},
59+
"resourcePath": "/hello",
60+
"httpMethod": "POST",
61+
"extendedRequestId": "XIIseElXGjQFvXg=",
62+
"requestTime": "19/Aug/2022:20:10:55 +0000",
63+
"path": "/dev/hello",
64+
"accountId": "601427279990",
65+
"protocol": "HTTP/1.1",
66+
"stage": "dev",
67+
"domainPrefix": "3gsxz7lha4",
68+
"requestTimeEpoch": 1660939855656,
69+
"requestId": "f1f8d46d-ef6f-46af-a3ed-7a20a26e2651",
70+
"identity": {
71+
"cognitoIdentityPoolId": null,
72+
"accountId": null,
73+
"cognitoIdentityId": null,
74+
"caller": null,
75+
"sourceIp": "38.142.177.195",
76+
"principalOrgId": null,
77+
"accessKey": null,
78+
"cognitoAuthenticationType": null,
79+
"cognitoAuthenticationProvider": null,
80+
"userArn": null,
81+
"userAgent": "PostmanRuntime/7.29.0",
82+
"user": null
83+
},
84+
"domainName": "3gsxz7lha4.execute-api.sa-east-1.amazonaws.com",
85+
"apiId": "3gsxz7lha4"
86+
},
87+
"body": null,
88+
"isBase64Encoded": false
89+
}

‎event_samples/api-gateway-traced-authorizer-request-v2-cached.json

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"version": "2.0",
3+
"routeKey": "GET /hello",
4+
"rawPath": "/hello",
5+
"rawQueryString": "",
6+
"headers": {
7+
"accept": "*/*",
8+
"accept-encoding": "gzip, deflate, br",
9+
"authorization": "secretT0k3n",
10+
"authorizationtoken": "secretT0k3n",
11+
"cache-control": "no-cache",
12+
"content-length": "0",
13+
"host": "l9flvsey83.execute-api.sa-east-1.amazonaws.com",
14+
"postman-token": "e0a783f5-8f72-427f-99bb-81d28ac3b37b",
15+
"user-agent": "PostmanRuntime/7.29.2",
16+
"userid": "27",
17+
"x-amzn-trace-id": "Root=1-6346fdb8-74147ee52ffc4c685787d44c",
18+
"x-forwarded-for": "24.193.182.233",
19+
"x-forwarded-port": "443",
20+
"x-forwarded-proto": "https"
21+
},
22+
"requestContext": {
23+
"accountId": "601427279990",
24+
"apiId": "l9flvsey83",
25+
"authorizer": {
26+
"lambda": {
27+
"_datadog": "eyJ4LWRhdGFkb2ctdHJhY2UtaWQiOiIzNzI2NzU1MTU4Mjk1OTIxMDQiLCJ4LWRhdGFkb2ctcGFyZW50LWlkIjoiMzcyNjc1NTE1ODI5NTkyMTA0IiwieC1kYXRhZG9nLXNhbXBsaW5nLXByaW9yaXR5IjoiMSIsIngtZGF0YWRvZy1wYXJlbnQtc3Bhbi1maW5pc2gtdGltZSI6MTY2NTU5Njc3MTgxMiwieC1kYXRhZG9nLWF1dGhvcml6aW5nLXJlcXVlc3RpZCI6Ilo1eUhmaDVFR2pRRUpCZz0ifQ==",
28+
"scope": "this is just a string"
29+
}
30+
},
31+
"domainName": "l9flvsey83.execute-api.sa-east-1.amazonaws.com",
32+
"domainPrefix": "l9flvsey83",
33+
"http": {
34+
"method": "GET",
35+
"path": "/hello",
36+
"protocol": "HTTP/1.1",
37+
"sourceIp": "24.193.182.233",
38+
"userAgent": "PostmanRuntime/7.29.2"
39+
},
40+
"requestId": "Z5yU6jHVmjQEJ4Q=",
41+
"routeKey": "GET /hello",
42+
"stage": "$default",
43+
"time": "12/Oct/2022:17:47:36 +0000",
44+
"timeEpoch": 1665596856876
45+
},
46+
"isBase64Encoded": false
47+
}

‎event_samples/api-gateway-traced-authorizer-request-v2.json

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"version": "2.0",
3+
"routeKey": "GET /hello",
4+
"rawPath": "/hello",
5+
"rawQueryString": "",
6+
"headers": {
7+
"accept": "*/*",
8+
"accept-encoding": "gzip, deflate, br",
9+
"authorization": "secretT0k3n",
10+
"authorizationtoken": "secretT0k3n",
11+
"cache-control": "no-cache",
12+
"content-length": "0",
13+
"host": "l9flvsey83.execute-api.sa-east-1.amazonaws.com",
14+
"postman-token": "e7c0d4f6-6af1-46dc-81ad-76dd8b02af8c",
15+
"user-agent": "PostmanRuntime/7.29.2",
16+
"userid": "27",
17+
"x-amzn-trace-id": "Root=1-6346fd62-123a3d6477d3393b1509b50b",
18+
"x-forwarded-for": "24.193.182.233",
19+
"x-forwarded-port": "443",
20+
"x-forwarded-proto": "https"
21+
},
22+
"requestContext": {
23+
"accountId": "601427279990",
24+
"apiId": "l9flvsey83",
25+
"authorizer": {
26+
"lambda": {
27+
"_datadog": "eyJ4LWRhdGFkb2ctdHJhY2UtaWQiOiIzNzI2NzU1MTU4Mjk1OTIxMDQiLCJ4LWRhdGFkb2ctcGFyZW50LWlkIjoiMzcyNjc1NTE1ODI5NTkyMTA0IiwieC1kYXRhZG9nLXNhbXBsaW5nLXByaW9yaXR5IjoiMSIsIngtZGF0YWRvZy1wYXJlbnQtc3Bhbi1maW5pc2gtdGltZSI6MTY2NTU5Njc3MTgxMjAwMDAwMCwieC1kYXRhZG9nLWF1dGhvcml6aW5nLXJlcXVlc3RpZCI6Ilo1eUhmaDVFR2pRRUpCZz0ifQ==",
28+
"scope": "this is just a string"
29+
}
30+
},
31+
"domainName": "l9flvsey83.execute-api.sa-east-1.amazonaws.com",
32+
"domainPrefix": "l9flvsey83",
33+
"http": {
34+
"method": "GET",
35+
"path": "/hello",
36+
"protocol": "HTTP/1.1",
37+
"sourceIp": "24.193.182.233",
38+
"userAgent": "PostmanRuntime/7.29.2"
39+
},
40+
"requestId": "Z5yHfh5EGjQEJBg=",
41+
"routeKey": "GET /hello",
42+
"stage": "$default",
43+
"time": "12/Oct/2022:17:46:10 +0000",
44+
"timeEpoch": 1665596770926
45+
},
46+
"isBase64Encoded": false
47+
}

‎event_samples/api-gateway-traced-authorizer-request-websocket-connect.json

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"headers": {
3+
"Auth": "secretT0k3n",
4+
"Host": "85fj5nw29d.execute-api.sa-east-1.amazonaws.com",
5+
"Sec-WebSocket-Extensions": "permessage-deflate; client_max_window_bits",
6+
"Sec-WebSocket-Key": "4v5yA3WKtAK6EK1KUvSxew==",
7+
"Sec-WebSocket-Version": "13",
8+
"X-Amzn-Trace-Id": "Root=1-6356cf5d-355baf3954d8ebee6af753ef",
9+
"X-Forwarded-For": "24.193.182.233",
10+
"X-Forwarded-Port": "443",
11+
"X-Forwarded-Proto": "https"
12+
},
13+
"multiValueHeaders": {
14+
"Auth": ["secretT0k3n"],
15+
"Host": ["85fj5nw29d.execute-api.sa-east-1.amazonaws.com"],
16+
"Sec-WebSocket-Extensions": ["permessage-deflate; client_max_window_bits"],
17+
"Sec-WebSocket-Key": ["4v5yA3WKtAK6EK1KUvSxew=="],
18+
"Sec-WebSocket-Version": ["13"],
19+
"X-Amzn-Trace-Id": ["Root=1-6356cf5d-355baf3954d8ebee6af753ef"],
20+
"X-Forwarded-For": ["24.193.182.233"],
21+
"X-Forwarded-Port": ["443"],
22+
"X-Forwarded-Proto": ["https"]
23+
},
24+
"requestContext": {
25+
"routeKey": "$connect",
26+
"authorizer": {
27+
"_datadog": "eyJ4LWRhdGFkb2ctdHJhY2UtaWQiOiI2NTQ1NDA2NzQ3NDUzNjg0NjAwIiwieC1kYXRhZG9nLXBhcmVudC1pZCI6IjY1NDU0MDY3NDc0NTM2ODQ2MDAiLCJ4LWRhdGFkb2ctc2FtcGxpbmctcHJpb3JpdHkiOiIxIiwieC1kYXRhZG9nLXBhcmVudC1zcGFuLWZpbmlzaC10aW1lIjoxNjY2NjMzNTY2OTMxMDAwMDAwLCJ4LWRhdGFkb2ctYXV0aG9yaXppbmctcmVxdWVzdGlkIjoiYWhWV3NIVkFtalFGcTZnPSJ9",
28+
"scope": "this is just a string",
29+
"principalId": "foo",
30+
"integrationLatency": 1119
31+
},
32+
"eventType": "CONNECT",
33+
"extendedRequestId": "ahVWsHVAmjQFq6g=",
34+
"requestTime": "24/Oct/2022:17:46:05 +0000",
35+
"messageDirection": "IN",
36+
"stage": "dev",
37+
"connectedAt": 1666633565827,
38+
"requestTimeEpoch": 1666633565828,
39+
"identity": {
40+
"sourceIp": "24.193.182.233"
41+
},
42+
"requestId": "ahVWsHVAmjQFq6g=",
43+
"domainName": "85fj5nw29d.execute-api.sa-east-1.amazonaws.com",
44+
"connectionId": "ahVWscZqmjQCI1w=",
45+
"apiId": "85fj5nw29d"
46+
},
47+
"isBase64Encoded": false
48+
}

‎event_samples/api-gateway-traced-authorizer-request-websocket-message.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"requestContext": {
3+
"routeKey": "hello",
4+
"authorizer": {
5+
"_datadog": "eyJ4LWRhdGFkb2ctdHJhY2UtaWQiOiI2NTQ1NDA2NzQ3NDUzNjg0NjAwIiwieC1kYXRhZG9nLXBhcmVudC1pZCI6IjY1NDU0MDY3NDc0NTM2ODQ2MDAiLCJ4LWRhdGFkb2ctc2FtcGxpbmctcHJpb3JpdHkiOiIxIiwieC1kYXRhZG9nLXBhcmVudC1zcGFuLWZpbmlzaC10aW1lIjoxNjY2NjMzNTY2OTMxLCJ4LWRhdGFkb2ctYXV0aG9yaXppbmctcmVxdWVzdGlkIjoiYWhWV3NIVkFtalFGcTZnPSJ9",
6+
"scope": "this is just a string",
7+
"principalId": "foo"
8+
},
9+
"messageId": "ahVmYcavmjQCI1w=",
10+
"eventType": "MESSAGE",
11+
"extendedRequestId": "ahVmYGOMmjQFhyg=",
12+
"requestTime": "24/Oct/2022:17:47:46 +0000",
13+
"messageDirection": "IN",
14+
"stage": "dev",
15+
"connectedAt": 1666633565827,
16+
"requestTimeEpoch": 1666633666203,
17+
"identity": {
18+
"sourceIp": "24.193.182.233"
19+
},
20+
"requestId": "ahVmYGOMmjQFhyg=",
21+
"domainName": "85fj5nw29d.execute-api.sa-east-1.amazonaws.com",
22+
"connectionId": "ahVWscZqmjQCI1w=",
23+
"apiId": "85fj5nw29d"
24+
},
25+
"body": "{\"action\": \"hello\", \"message\":\"in\"}",
26+
"isBase64Encoded": false
27+
}

0 commit comments

Comments
 (0)