Skip to content

Commit 7de527e

Browse files
ezhang6811ezhang6811
committed
fix SecretsManager attribute extraction and add negative test cases for SecretsManager and SNS
1 parent 63fcd96 commit 7de527e

File tree

6 files changed

+92
-2
lines changed

6 files changed

+92
-2
lines changed

‎src/OpenTelemetry.Instrumentation.AWS/Implementation/AWSServiceHelper.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ internal class AWSServiceHelper
1414
{ AWSServiceType.S3Service, new List<string> { "BucketName" } },
1515
{ AWSServiceType.KinesisService, new List<string> { "StreamName" } },
1616
{ AWSServiceType.LambdaService, new List<string> { "UUID" } },
17+
{ AWSServiceType.SecretsManagerService, new List<string> { "SecretId" } },
1718
{ AWSServiceType.SNSService, new List<string> { "TopicArn" } },
1819
{ AWSServiceType.StepFunctionsService, new List<string> { "ActivityArn", "StateMachineArn" } },
1920
{ AWSServiceType.BedrockRuntimeService, new List<string> { "ModelId" } },
@@ -37,6 +38,7 @@ internal class AWSServiceHelper
3738
{ "StreamName", AWSSemanticConventions.AttributeAWSKinesisStreamName },
3839
{ "TopicArn", AWSSemanticConventions.AttributeAWSSNSTopicArn },
3940
{ "ARN", AWSSemanticConventions.AttributeAWSSecretsManagerSecretArn },
41+
{ "SecretId", AWSSemanticConventions.AttributeAWSSecretsManagerSecretArn },
4042
{ "ActivityArn", AWSSemanticConventions.AttributeAWSStepFunctionsActivityArn },
4143
{ "StateMachineArn", AWSSemanticConventions.AttributeAWSStepFunctionsStateMachineArn },
4244
{ "UUID", AWSSemanticConventions.AttributeAWSLambdaResourceMappingId },

‎src/OpenTelemetry.Instrumentation.AWS/Implementation/AWSTracingPipelineHandler.cs‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,20 @@ private static void AddRequestSpecificInformation(Activity activity, IRequestCon
173173
}
174174
}
175175

176+
// for secrets manager, only extract SecretId from request if it is a secret ARN.
177+
if (AWSServiceType.IsSecretsManagerService(service) && parameter == "SecretId")
178+
{
179+
var secretId = property.GetValue(request);
180+
if (secretId != null)
181+
{
182+
var secretIdString = secretId.ToString();
183+
if (secretIdString != null && !secretIdString.StartsWith("arn:aws:secretsmanager:"))
184+
{
185+
continue;
186+
}
187+
}
188+
}
189+
176190
if (AWSServiceHelper.ParameterAttributeMap.TryGetValue(parameter, out var attribute))
177191
{
178192
activity.SetTag(attribute, property.GetValue(request));

‎test/contract-tests/images/applications/TestSimpleApp.AWSSDK.Core/Program.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,9 @@
139139
.WithName("get-secret-value")
140140
.WithOpenApi();
141141

142+
app.MapGet("secretsmanager/fault", (SecretsManagerTests secretsManager) => secretsManager.Fault()).WithName("secretsmanager-fault").WithOpenApi();
143+
app.MapGet("secretsmanager/error", (SecretsManagerTests secretsManager) => secretsManager.Error()).WithName("secretsmanager-error").WithOpenApi();
144+
142145
app.MapGet("sns/createtopic/some-topic", (SNSTests sns) => sns.CreateTopic())
143146
.WithName("create-topic")
144147
.WithOpenApi();
@@ -147,6 +150,9 @@
147150
.WithName("publish")
148151
.WithOpenApi();
149152

153+
app.MapGet("sns/fault", (SNSTests sns) => sns.Fault()).WithName("sns-fault").WithOpenApi();
154+
app.MapGet("sns/error", (SNSTests sns) => sns.Error()).WithName("sns-error").WithOpenApi();
155+
150156
app.MapGet("bedrock/getguardrail/get-guardrail", (BedrockTests bedrock) => bedrock.GetGuardrail())
151157
.WithName("get-guardrail")
152158
.WithOpenApi();

‎test/contract-tests/images/applications/TestSimpleApp.AWSSDK.Core/SNSTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ protected override Task CreateFault(CancellationToken cancellationToken)
2626

2727
protected override Task CreateError(CancellationToken cancellationToken)
2828
{
29-
return errorSns.DeleteTopicAsync(new DeleteTopicRequest { TopicArn = "arn:aws:sns:us-east-1:000000000000:test-topic-error" });
29+
return errorSns.PublishAsync(new PublishRequest { TopicArn = "arn:aws:sns:us-east-1:000000000000:test-topic-error" });
3030
}
3131
}

‎test/contract-tests/images/applications/TestSimpleApp.AWSSDK.Core/SecretsManagerTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,6 @@ protected override Task CreateFault(CancellationToken cancellationToken)
2828

2929
protected override Task CreateError(CancellationToken cancellationToken)
3030
{
31-
return errorSecretsManager.DeleteSecretAsync(new DeleteSecretRequest { SecretId = "arn:aws:us-east-1:000000000000:test-secret-error" });
31+
return errorSecretsManager.DescribeSecretAsync(new DescribeSecretRequest { SecretId = "arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error" });
3232
}
3333
}

‎test/contract-tests/tests/test/amazon/awssdk/awssdk_test.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,43 @@ def test_secretsmanager_get_secret_value(self):
343343
},
344344
span_name="Secrets Manager.GetSecretValue",
345345
)
346+
347+
def test_secretsmanager_error(self):
348+
self.do_test_requests(
349+
"secretsmanager/error",
350+
"GET",
351+
400,
352+
1,
353+
0,
354+
rpc_service="Secrets Manager",
355+
remote_service="AWS::SecretsManager",
356+
remote_operation="DescribeSecret",
357+
remote_resource_type="AWS::SecretsManager::Secret",
358+
remote_resource_identifier="arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
359+
request_response_specific_attributes={
360+
_AWS_SECRETSMANAGER_SECRET_ARN: "arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
361+
},
362+
span_name="Secrets Manager.DescribeSecret",
363+
)
364+
365+
# TODO: https://github.com/aws-observability/aws-otel-dotnet-instrumentation/issues/83
366+
# def test_secretsmanager_fault(self):
367+
# self.do_test_requests(
368+
# "secretsmanager/fault",
369+
# "GET",
370+
# 500,
371+
# 0,
372+
# 1,
373+
# rpc_service="Secrets Manager",
374+
# remote_service="AWS::SecretsManager",
375+
# remote_operation="CreateSecret",
376+
# remote_resource_type="AWS::SecretsManager::Secret",
377+
# remote_resource_identifier="arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
378+
# request_response_specific_attributes={
379+
# _AWS_SECRETSMANAGER_SECRET_ARN: "arn:aws:secretsmanager:us-east-1:000000000000:secret:test-secret-error",
380+
# },
381+
# span_name="Secrets Manager.CreateSecret",
382+
# )
346383

347384
def test_sns_create_topic(self):
348385
self.do_test_requests(
@@ -373,6 +410,37 @@ def test_sns_publish(self):
373410
},
374411
span_name="SNS.Publish",
375412
)
413+
414+
def test_sns_error(self):
415+
self.do_test_requests(
416+
"sns/error",
417+
"GET",
418+
400,
419+
1,
420+
0,
421+
remote_service="AWS::SNS",
422+
remote_operation="Publish",
423+
remote_resource_type="AWS::SNS::Topic",
424+
remote_resource_identifier="arn:aws:sns:us-east-1:000000000000:test-topic-error",
425+
request_response_specific_attributes={
426+
_AWS_SNS_TOPIC_ARN: "arn:aws:sns:us-east-1:000000000000:test-topic-error",
427+
},
428+
span_name="SNS.Publish",
429+
)
430+
431+
# TODO: https://github.com/aws-observability/aws-otel-dotnet-instrumentation/issues/83
432+
# def test_sns_fault(self):
433+
# self.do_test_requests(
434+
# "sns/fault",
435+
# "GET",
436+
# 500,
437+
# 0,
438+
# 1,
439+
# remote_service="AWS::SNS",
440+
# remote_operation="CreateTopic",
441+
# request_response_specific_attributes={},
442+
# span_name="SNS.CreateTopic"
443+
# )
376444

377445
def test_bedrock_get_guardrail(self):
378446
self.do_test_requests(

0 commit comments

Comments
 (0)