Skip to content

Commit 3867fa6

Browse files
ezhang6811ezhang6811
committed
fix SecretsManager attribute extraction and add negative test cases for SecretsManager and SNS
1 parent a7ab1a0 commit 3867fa6

File tree

6 files changed

+92
-2
lines changed

6 files changed

+92
-2
lines changed

‎src/OpenTelemetry.Instrumentation.AWS/Implementation/AWSServiceHelper.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ internal class AWSServiceHelper
1414
{ AWSServiceType.S3Service, new List<string> { "BucketName" } },
1515
{ AWSServiceType.KinesisService, new List<string> { "StreamName" } },
1616
{ AWSServiceType.LambdaService, new List<string> { "UUID" } },
17+
{ AWSServiceType.SecretsManagerService, new List<string> { "SecretId" } },
1718
{ AWSServiceType.SNSService, new List<string> { "TopicArn" } },
1819
{ AWSServiceType.StepFunctionsService, new List<string> { "ActivityArn", "StateMachineArn" } },
1920
{ AWSServiceType.BedrockRuntimeService, new List<string> { "ModelId" } },
@@ -38,6 +39,7 @@ internal class AWSServiceHelper
3839
{ "StreamName", AWSSemanticConventions.AttributeAWSKinesisStreamName },
3940
{ "TopicArn", AWSSemanticConventions.AttributeAWSSNSTopicArn },
4041
{ "ARN", AWSSemanticConventions.AttributeAWSSecretsManagerSecretArn },
42+
{ "SecretId", AWSSemanticConventions.AttributeAWSSecretsManagerSecretArn },
4143
{ "ActivityArn", AWSSemanticConventions.AttributeAWSStepFunctionsActivityArn },
4244
{ "StateMachineArn", AWSSemanticConventions.AttributeAWSStepFunctionsStateMachineArn },
4345
{ "UUID", AWSSemanticConventions.AttributeAWSLambdaResourceMappingId },

‎src/OpenTelemetry.Instrumentation.AWS/Implementation/AWSTracingPipelineHandler.cs‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,20 @@ private static void AddRequestSpecificInformation(Activity activity, IRequestCon
164164
}
165165
}
166166

167+
// for secrets manager, only extract SecretId from request if it is a secret ARN.
168+
if (AWSServiceType.IsSecretsManagerService(service) && parameter == "SecretId")
169+
{
170+
var secretId = property.GetValue(request);
171+
if (secretId != null)
172+
{
173+
var secretIdString = secretId.ToString();
174+
if (secretIdString != null && !secretIdString.StartsWith("arn:aws:secretsmanager:"))
175+
{
176+
continue;
177+
}
178+
}
179+
}
180+
167181
if (AWSServiceHelper.ParameterAttributeMap.TryGetValue(parameter, out var attribute))
168182
{
169183
activity.SetTag(attribute, property.GetValue(request));

‎test/contract-tests/images/applications/TestSimpleApp.AWSSDK.Core/Program.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,9 @@
139139
.WithName("get-secret-value")
140140
.WithOpenApi();
141141

142+
app.MapGet("secretsmanager/fault", (SecretsManagerTests secretsManager) => secretsManager.Fault()).WithName("secretsmanager-fault").WithOpenApi();
143+
app.MapGet("secretsmanager/error", (SecretsManagerTests secretsManager) => secretsManager.Error()).WithName("secretsmanager-error").WithOpenApi();
144+
142145
app.MapGet("sns/createtopic/some-topic", (SNSTests sns) => sns.CreateTopic())
143146
.WithName("create-topic")
144147
.WithOpenApi();
@@ -147,6 +150,9 @@
147150
.WithName("publish")
148151
.WithOpenApi();
149152

153+
app.MapGet("sns/fault", (SNSTests sns) => sns.Fault()).WithName("sns-fault").WithOpenApi();
154+
app.MapGet("sns/error", (SNSTests sns) => sns.Error()).WithName("sns-error").WithOpenApi();
155+
150156
app.MapGet("bedrock/getguardrail/get-guardrail", (BedrockTests bedrock) => bedrock.GetGuardrail())
151157
.WithName("get-guardrail")
152158
.WithOpenApi();

‎test/contract-tests/images/applications/TestSimpleApp.AWSSDK.Core/SNSTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ protected override Task CreateFault(CancellationToken cancellationToken)
2626

2727
protected override Task CreateError(CancellationToken cancellationToken)
2828
{
29-
return errorSns.DeleteTopicAsync(new DeleteTopicRequest { TopicArn = "arn:aws:sns:us-east-1:000000000000:test-topic-error" });
29+
return errorSns.PublishAsync(new PublishRequest { TopicArn = "arn:aws:sns:us-east-1:000000000000:test-topic-error" });
3030
}
3131
}

‎test/contract-tests/images/applications/TestSimpleApp.AWSSDK.Core/SecretsManagerTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,6 @@ protected override Task CreateFault(CancellationToken cancellationToken)
2828

2929
protected override Task CreateError(CancellationToken cancellationToken)
3030
{
31-
return errorSecretsManager.DeleteSecretAsync(new DeleteSecretRequest { SecretId = "arn:aws:us-east-1:000000000000:test-secret-error" });
31+
return errorSecretsManager.DescribeSecretAsync(new DescribeSecretRequest { SecretId = "arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error" });
3232
}
3333
}

‎test/contract-tests/tests/test/amazon/awssdk/awssdk_test.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,43 @@ def test_secretsmanager_get_secret_value(self):
356356
},
357357
span_name="Secrets Manager.GetSecretValue",
358358
)
359+
360+
def test_secretsmanager_error(self):
361+
self.do_test_requests(
362+
"secretsmanager/error",
363+
"GET",
364+
400,
365+
1,
366+
0,
367+
rpc_service="Secrets Manager",
368+
remote_service="AWS::SecretsManager",
369+
remote_operation="DescribeSecret",
370+
remote_resource_type="AWS::SecretsManager::Secret",
371+
remote_resource_identifier="arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
372+
request_response_specific_attributes={
373+
_AWS_SECRETSMANAGER_SECRET_ARN: "arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
374+
},
375+
span_name="Secrets Manager.DescribeSecret",
376+
)
377+
378+
# TODO: https://github.com/aws-observability/aws-otel-dotnet-instrumentation/issues/83
379+
# def test_secretsmanager_fault(self):
380+
# self.do_test_requests(
381+
# "secretsmanager/fault",
382+
# "GET",
383+
# 500,
384+
# 0,
385+
# 1,
386+
# rpc_service="Secrets Manager",
387+
# remote_service="AWS::SecretsManager",
388+
# remote_operation="CreateSecret",
389+
# remote_resource_type="AWS::SecretsManager::Secret",
390+
# remote_resource_identifier="arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
391+
# request_response_specific_attributes={
392+
# _AWS_SECRETSMANAGER_SECRET_ARN: "arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
393+
# },
394+
# span_name="Secrets Manager.CreateSecret",
395+
# )
359396

360397
def test_sns_create_topic(self):
361398
self.do_test_requests(
@@ -386,6 +423,37 @@ def test_sns_publish(self):
386423
},
387424
span_name="SNS.Publish",
388425
)
426+
427+
def test_sns_error(self):
428+
self.do_test_requests(
429+
"sns/error",
430+
"GET",
431+
400,
432+
1,
433+
0,
434+
remote_service="AWS::SNS",
435+
remote_operation="Publish",
436+
remote_resource_type="AWS::SNS::Topic",
437+
remote_resource_identifier="arn:aws:sns:us-east-1:000000000000:test-topic-error",
438+
request_response_specific_attributes={
439+
_AWS_SNS_TOPIC_ARN: "arn:aws:sns:us-east-1:000000000000:test-topic-error",
440+
},
441+
span_name="SNS.Publish",
442+
)
443+
444+
# TODO: https://github.com/aws-observability/aws-otel-dotnet-instrumentation/issues/83
445+
# def test_sns_fault(self):
446+
# self.do_test_requests(
447+
# "sns/fault",
448+
# "GET",
449+
# 500,
450+
# 0,
451+
# 1,
452+
# remote_service="AWS::SNS",
453+
# remote_operation="CreateTopic",
454+
# request_response_specific_attributes={},
455+
# span_name="SNS.CreateTopic"
456+
# )
389457

390458
def test_bedrock_get_guardrail(self):
391459
self.do_test_requests(

0 commit comments

Comments
 (0)