feat: Extract account/access key id and region for cross-account support (#1081)

**Description of changes:**
Changes in ADOT package to support cross-account observability in Java
V1 & V2 SDK.
1. We extract account id and region from remote resource arn. 
2. We pass account access key id and region from span to metric when
resource arn is not available.
3. Add instrumentation patch for AWS SDK

Related changes in upstream package:
yiyuan-he/opentelemetry-java-instrumentation#2

**Testing Plan:**
1. Unit tests for extracting account id and region from remote resource
arn.
2. Unit tests for extracting access key and region from credential.
3. Unit test for the scenario when resource arn and credential
information are both available.
5. Contract tests

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

Author: blairhyy-amazon

.github/patches/opentelemetry-java-instrumentation.patch

@@ -181,6 +181,11 @@ void testDynamoDbPutItem() {
     doTestDynamoDbPutItem();
   }
 
+  @Test
+  void testDynamoDbDescribeTable() {
+    doTestDynamoDbDescribeTable();
+  }
+
   @Test
   void testDynamoDbError() throws Exception {
     doTestDynamoDbError();
@@ -221,6 +226,11 @@ void testKinesisPutRecord() throws Exception {
     doTestKinesisPutRecord();
   }
 
+  @Test
+  void testKinesisDescribeStream() {
+    doTestKinesisDescribeStream();
+  }
+
   @Test
   void testKinsesisError() throws Exception {
     doTestKinesisError();
@@ -340,4 +350,9 @@ void testSnsError() throws Exception {
   void testSnsFault() throws Exception {
     doTestStepFunctionsFault();
   }
+
+  @Test
+  void testCrossAccount() throws Exception {
+    doTestCrossAccount(null);
+  }
 }

appsignals-tests/contract-tests/src/test/java/software/amazon/opentelemetry/appsignals/test/awssdk/base/AwsSdkBaseTest.java

@@ -179,6 +179,11 @@ void testDynamoDbPutItem() {
     doTestDynamoDbPutItem();
   }
 
+  @Test
+  void testDynamoDbDescribeTable() {
+    doTestDynamoDbDescribeTable();
+  }
+
   @Test
   void testDynamoDbError() throws Exception {
     doTestDynamoDbError();
@@ -224,6 +229,11 @@ void testKinesisPutRecord() throws Exception {
     doTestKinesisPutRecord();
   }
 
+  @Test
+  void testKinesisDescribeStream() {
+    doTestKinesisDescribeStream();
+  }
+
   @Test
   void testKinesisError() throws Exception {
     doTestKinesisError();
@@ -343,4 +353,9 @@ void testSnsError() throws Exception {
   void testSnsFault() throws Exception {
     doTestStepFunctionsFault();
   }
+
+  @Test
+  void testCrossAccount() throws Exception {
+    doTestCrossAccount("eu-central-1");
+  }
 }

appsignals-tests/contract-tests/src/test/java/software/amazon/opentelemetry/appsignals/test/awssdk/v1/AwsSdkV1Test.java

@@ -35,7 +35,10 @@ public class AppSignalsConstants {
       "aws.remote.resource.cfn.primary.identifier";
   public static final String AWS_SPAN_KIND = "aws.span.kind";
   public static final String AWS_REMOTE_DB_USER = "aws.remote.db.user";
-
+  public static final String AWS_REMOTE_RESOURCE_ACCESS_KEY =
+      "aws.remote.resource.account.access_key";
+  public static final String AWS_REMOTE_RESOURCE_ACCOUNT_ID = "aws.remote.resource.account.id";
+  public static final String AWS_REMOTE_RESOURCE_REGION = "aws.remote.resource.region";
   // JVM Metrics
   public static final String JVM_GC_DURATION = "jvm.gc.collections.elapsed";
   public static final String JVM_GC_COUNT = "jvm.gc.collections.count";

appsignals-tests/contract-tests/src/test/java/software/amazon/opentelemetry/appsignals/test/awssdk/v2/AwsSdkV2Test.java

@@ -56,6 +56,7 @@ public class SemanticConventionsConstants {
   public static final String AWS_TABLE_NAME = "aws.table.name";
   public static final String AWS_QUEUE_URL = "aws.queue.url";
   public static final String AWS_QUEUE_NAME = "aws.queue.name";
+  public static final String AWS_STREAM_ARN = "aws.stream.arn";
   public static final String AWS_STREAM_NAME = "aws.stream.name";
   public static final String AWS_KNOWLEDGE_BASE_ID = "aws.bedrock.knowledge_base.id";
   public static final String AWS_DATA_SOURCE_ID = "aws.bedrock.data_source.id";

appsignals-tests/contract-tests/src/test/java/software/amazon/opentelemetry/appsignals/test/utils/AppSignalsConstants.java

@@ -21,8 +21,11 @@
 import static spark.Spark.port;
 import static spark.Spark.post;
 
+import com.amazonaws.auth.AWSCredentials;
+import com.amazonaws.auth.AWSCredentialsProvider;
 import com.amazonaws.auth.AWSStaticCredentialsProvider;
 import com.amazonaws.auth.BasicAWSCredentials;
+import com.amazonaws.auth.BasicSessionCredentials;
 import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration;
 import com.amazonaws.regions.Regions;
 import com.amazonaws.services.bedrock.AmazonBedrockClient;
@@ -49,6 +52,7 @@
 import com.amazonaws.services.identitymanagement.model.PutRolePolicyRequest;
 import com.amazonaws.services.kinesis.AmazonKinesisClient;
 import com.amazonaws.services.kinesis.model.CreateStreamRequest;
+import com.amazonaws.services.kinesis.model.DescribeStreamRequest;
 import com.amazonaws.services.kinesis.model.PutRecordRequest;
 import com.amazonaws.services.s3.AmazonS3Client;
 import com.amazonaws.services.s3.model.CreateBucketRequest;
@@ -152,6 +156,7 @@ public static void main(String[] args) throws IOException, InterruptedException
     setupStepFunctions();
     setupSns();
     setupBedrock();
+    setupCrossAccount();
 
     // Add this log line so that we only start testing after all routes are configured.
     awaitInitialization();
@@ -320,6 +325,33 @@ private static void setupDynamoDb() {
           dynamoDbClient.putItem(putItemRequest);
           return "";
         });
+
+    get(
+        "/ddb/describetable/:tablename",
+        (req, res) -> {
+          var tableName = req.params(":tablename");
+
+          var createTableRequest =
+              new CreateTableRequest()
+                  .withTableName(tableName)
+                  .withAttributeDefinitions(
+                      new AttributeDefinition()
+                          .withAttributeName("partitionKey")
+                          .withAttributeType("S"))
+                  .withKeySchema(
+                      new KeySchemaElement()
+                          .withAttributeName("partitionKey")
+                          .withKeyType(KeyType.HASH))
+                  .withProvisionedThroughput(
+                      new ProvisionedThroughput()
+                          .withReadCapacityUnits(1L)
+                          .withWriteCapacityUnits(1L));
+          dynamoDbClient.createTable(createTableRequest);
+
+          dynamoDbClient.describeTable(tableName);
+          return "";
+        });
+
     get(
         "/ddb/error",
         (req, res) -> {
@@ -405,6 +437,30 @@ private static void setupKinesis() {
           return "";
         });
 
+    get(
+        "/kinesis/describestream/:streamname",
+        (req, res) -> {
+          var streamName = req.params(":streamname");
+
+          var kinesisClient =
+              AmazonKinesisClient.builder()
+                  .withEndpointConfiguration(endpointConfiguration)
+                  .withCredentials(CREDENTIALS_PROVIDER)
+                  .build();
+
+          var createStreamRequest = new CreateStreamRequest();
+          createStreamRequest.setStreamName(streamName);
+
+          kinesisClient.createStream(createStreamRequest);
+
+          // Describe stream using ARN
+          var streamArn = "arn:aws:kinesis:us-west-2:000000000000:stream/" + streamName;
+          DescribeStreamRequest describeStreamRequest =
+              new DescribeStreamRequest().withStreamARN(streamArn);
+          kinesisClient.describeStream(describeStreamRequest);
+          return "";
+        });
+
     get(
         "/kinesis/error",
         (req, res) -> {
@@ -1191,4 +1247,30 @@ private static void setupBedrock() {
           return "";
         });
   }
+
+  private static void setupCrossAccount() {
+    // Create credentials provider with temporary credentials
+    AWSCredentials sessionCredentials =
+        new BasicSessionCredentials(
+            "account_b_access_key_id", "account_b_secret_access_key", "account_b_token");
+    AWSCredentialsProvider sessionCredentialsProvider =
+        new AWSStaticCredentialsProvider(sessionCredentials);
+
+    // Create S3 client with temporary credentials
+    var crossAccountS3Client =
+        AmazonS3Client.builder()
+            .withCredentials(sessionCredentialsProvider)
+            .withEndpointConfiguration(
+                new EndpointConfiguration(s3Endpoint, Regions.EU_CENTRAL_1.getName()))
+            .build();
+
+    get(
+        "/crossaccount/createbucket/accountb",
+        (req, res) -> {
+          CreateBucketRequest createBucketRequest =
+              new CreateBucketRequest("cross-account-bucket", Region.EU_Frankfurt);
+          crossAccountS3Client.createBucket(createBucketRequest);
+          return "";
+        });
+  }
 }

appsignals-tests/contract-tests/src/test/java/software/amazon/opentelemetry/appsignals/test/utils/SemanticConventionsConstants.java

@@ -35,6 +35,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
+import software.amazon.awssdk.auth.credentials.AwsSessionCredentials;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
 import software.amazon.awssdk.core.SdkBytes;
 import software.amazon.awssdk.core.client.config.ClientOverrideConfiguration;
@@ -68,6 +69,7 @@
 import software.amazon.awssdk.services.kinesis.model.DescribeStreamRequest;
 import software.amazon.awssdk.services.kinesis.model.PutRecordRequest;
 import software.amazon.awssdk.services.s3.S3Client;
+import software.amazon.awssdk.services.s3.model.CreateBucketConfiguration;
 import software.amazon.awssdk.services.s3.model.CreateBucketRequest;
 import software.amazon.awssdk.services.s3.model.GetObjectRequest;
 import software.amazon.awssdk.services.s3.model.PutObjectRequest;
@@ -148,6 +150,7 @@ public static void main(String[] args) throws IOException, InterruptedException
     setupSfn();
     setupBedrock();
     setupSns();
+    setupCrossAccount();
     // Add this log line so that we only start testing after all routes are configured.
     awaitInitialization();
     logger.info("All routes initialized");
@@ -328,6 +331,36 @@ private static void setupDynamoDb() {
           dynamoDbClient.putItem(putItemRequest);
           return "";
         });
+
+    get(
+        "/ddb/describetable/:tablename",
+        (req, res) -> {
+          var tableName = req.params(":tablename");
+
+          var createTableRequest =
+              CreateTableRequest.builder()
+                  .tableName(tableName)
+                  .attributeDefinitions(
+                      AttributeDefinition.builder()
+                          .attributeName("partitionKey")
+                          .attributeType("S")
+                          .build())
+                  .keySchema(
+                      KeySchemaElement.builder()
+                          .attributeName("partitionKey")
+                          .keyType(KeyType.HASH)
+                          .build())
+                  .provisionedThroughput(
+                      ProvisionedThroughput.builder()
+                          .readCapacityUnits(1L)
+                          .writeCapacityUnits(1L)
+                          .build())
+                  .build();
+          dynamoDbClient.createTable(createTableRequest);
+          dynamoDbClient.describeTable(r -> r.tableName(tableName));
+          return "";
+        });
+
     get(
         "/ddb/error",
         (req, res) -> {
@@ -413,6 +446,26 @@ private static void setupKinesis() {
           return "";
         });
 
+    get(
+        "/kinesis/describestream/:streamname",
+        (req, res) -> {
+          var streamName = req.params(":streamname");
+
+          var kinesisClient =
+              KinesisClient.builder()
+                  .endpointOverride(endpoint)
+                  .credentialsProvider(CREDENTIALS_PROVIDER)
+                  .build();
+
+          kinesisClient.createStream(CreateStreamRequest.builder().streamName(streamName).build());
+
+          // Describe stream using ARN
+          var streamArn = "arn:aws:kinesis:us-west-2:000000000000:stream/" + streamName;
+          var describeStreamRequest = DescribeStreamRequest.builder().streamARN(streamArn).build();
+          kinesisClient.describeStream(describeStreamRequest);
+          return "";
+        });
+
     get(
         "/kinesis/error",
         (req, res) -> {
@@ -1209,4 +1262,36 @@ private static void setupBedrock() {
           return "";
         });
   }
+
+  private static void setupCrossAccount() {
+    // Create credentials provider with temporary credentials
+    AwsSessionCredentials sessionCredentials =
+        AwsSessionCredentials.create(
+            "account_b_access_key_id", "account_b_secret_access_key", "account_b_token");
+    StaticCredentialsProvider sessionCredentialsProvider =
+        StaticCredentialsProvider.create(sessionCredentials);
+
+    // Create S3 client with temporary credentials
+    var crossAccountS3Client =
+        S3Client.builder()
+            .credentialsProvider(sessionCredentialsProvider)
+            .endpointOverride(s3Endpoint)
+            .region(Region.EU_CENTRAL_1)
+            .build();
+
+    get(
+        "/crossaccount/createbucket/accountb",
+        (req, res) -> {
+          CreateBucketRequest createBucketRequest =
+              CreateBucketRequest.builder()
+                  .bucket("cross-account-bucket")
+                  .createBucketConfiguration(
+                      CreateBucketConfiguration.builder()
+                          .locationConstraint(Region.EU_CENTRAL_1.id())
+                          .build())
+                  .build();
+          crossAccountS3Client.createBucket(createBucketRequest);
+          return "";
+        });
+  }
 }

appsignals-tests/images/aws-sdk/aws-sdk-v1/src/main/java/com/amazon/sampleapp/App.java

@@ -22,6 +22,11 @@ final class AwsAttributeKeys {
 
   private AwsAttributeKeys() {}
 
+  static final AttributeKey<String> AWS_AUTH_ACCESS_KEY =
+      AttributeKey.stringKey("aws.auth.account.access_key");
+
+  static final AttributeKey<String> AWS_AUTH_REGION = AttributeKey.stringKey("aws.auth.region");
+
   static final AttributeKey<String> AWS_SPAN_KIND = AttributeKey.stringKey("aws.span.kind");
 
   static final AttributeKey<String> AWS_LOCAL_SERVICE = AttributeKey.stringKey("aws.local.service");
@@ -51,6 +56,15 @@ private AwsAttributeKeys() {}
   static final AttributeKey<String> AWS_REMOTE_OPERATION =
       AttributeKey.stringKey("aws.remote.operation");
 
+  static final AttributeKey<String> AWS_REMOTE_RESOURCE_ACCESS_KEY =
+      AttributeKey.stringKey("aws.remote.resource.account.access_key");
+
+  static final AttributeKey<String> AWS_REMOTE_RESOURCE_ACCOUNT_ID =
+      AttributeKey.stringKey("aws.remote.resource.account.id");
+
+  static final AttributeKey<String> AWS_REMOTE_RESOURCE_REGION =
+      AttributeKey.stringKey("aws.remote.resource.region");
+
   static final AttributeKey<String> AWS_REMOTE_RESOURCE_IDENTIFIER =
       AttributeKey.stringKey("aws.remote.resource.identifier");
 
@@ -83,7 +97,7 @@ private AwsAttributeKeys() {}
   static final AttributeKey<String> AWS_LAMBDA_NAME =
       AttributeKey.stringKey("aws.lambda.function.name");
 
-  static final AttributeKey<String> AWS_LAMBDA_ARN =
+  static final AttributeKey<String> AWS_LAMBDA_FUNCTION_ARN =
       AttributeKey.stringKey("aws.lambda.function.arn");
 
   static final AttributeKey<String> AWS_LAMBDA_RESOURCE_ID =
@@ -100,7 +114,9 @@ private AwsAttributeKeys() {}
   static final AttributeKey<String> AWS_QUEUE_URL = AttributeKey.stringKey("aws.queue.url");
   static final AttributeKey<String> AWS_QUEUE_NAME = AttributeKey.stringKey("aws.queue.name");
   static final AttributeKey<String> AWS_STREAM_NAME = AttributeKey.stringKey("aws.stream.name");
+  static final AttributeKey<String> AWS_STREAM_ARN = AttributeKey.stringKey("aws.stream.arn");
   static final AttributeKey<String> AWS_TABLE_NAME = AttributeKey.stringKey("aws.table.name");
+  static final AttributeKey<String> AWS_TABLE_ARN = AttributeKey.stringKey("aws.table.arn");
   static final AttributeKey<String> AWS_AGENT_ID = AttributeKey.stringKey("aws.bedrock.agent.id");
   static final AttributeKey<String> AWS_KNOWLEDGE_BASE_ID =
       AttributeKey.stringKey("aws.bedrock.knowledge_base.id");