|
| 1 | +// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | +import { OTLPTraceExporter as OTLPProtoTraceExporter } from '@opentelemetry/exporter-trace-otlp-proto'; |
| 4 | +import { diag } from '@opentelemetry/api'; |
| 5 | +import { OTLPExporterNodeConfigBase } from '@opentelemetry/otlp-exporter-base'; |
| 6 | +import { ProtobufTraceSerializer } from '@opentelemetry/otlp-transformer'; |
| 7 | +import { ReadableSpan } from '@opentelemetry/sdk-trace-base'; |
| 8 | +import { ExportResult } from '@opentelemetry/core'; |
| 9 | +import { getNodeVersion } from './utils'; |
| 10 | + |
| 11 | +/** |
| 12 | + * This exporter extends the functionality of the OTLPProtoTraceExporter to allow spans to be exported |
| 13 | + * to the XRay OTLP endpoint https://xray.[AWSRegion].amazonaws.com/v1/traces. Utilizes the aws-sdk |
| 14 | + * library to sign and directly inject SigV4 Authentication to the exported request's headers. <a |
| 15 | + * href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html">...</a> |
| 16 | + * |
| 17 | + * This only works with version >=16 Node.js environments. |
| 18 | + */ |
| 19 | +export class OTLPAwsSpanExporter extends OTLPProtoTraceExporter { |
| 20 | + private static readonly SERVICE_NAME: string = 'xray'; |
| 21 | + private endpoint: string; |
| 22 | + private region: string; |
| 23 | + |
| 24 | + // Holds the dependencies needed to sign the SigV4 headers |
| 25 | + private defaultProvider: any; |
| 26 | + private sha256: any; |
| 27 | + private signatureV4: any; |
| 28 | + private httpRequest: any; |
| 29 | + |
| 30 | + // If the required dependencies are installed then we enable SigV4 signing. Otherwise skip it |
| 31 | + private hasRequiredDependencies: boolean = false; |
| 32 | + |
| 33 | + constructor(endpoint: string, config?: OTLPExporterNodeConfigBase) { |
| 34 | + super(OTLPAwsSpanExporter.changeUrlConfig(endpoint, config)); |
| 35 | + this.initDependencies(); |
| 36 | + this.region = endpoint.split('.')[1]; |
| 37 | + this.endpoint = endpoint; |
| 38 | + } |
| 39 | + |
| 40 | + /** |
| 41 | + * Overrides the upstream implementation of export. All behaviors are the same except if the |
| 42 | + * endpoint is an XRay OTLP endpoint, we will sign the request with SigV4 in headers before |
| 43 | + * sending it to the endpoint. Otherwise, we will skip signing. |
| 44 | + */ |
| 45 | + public override async export(items: ReadableSpan[], resultCallback: (result: ExportResult) => void): Promise<void> { |
| 46 | + // Only do SigV4 Signing if the required dependencies are installed. Otherwise default to the regular http/protobuf exporter. |
| 47 | + if (this.hasRequiredDependencies) { |
| 48 | + const url = new URL(this.endpoint); |
| 49 | + const serializedSpans: Uint8Array | undefined = ProtobufTraceSerializer.serializeRequest(items); |
| 50 | + |
| 51 | + if (serializedSpans === undefined) { |
| 52 | + return; |
| 53 | + } |
| 54 | + |
| 55 | + /* |
| 56 | + This is bad practice but there is no other way to access and inject SigV4 headers |
| 57 | + into the request headers before the traces get exported. |
| 58 | + */ |
| 59 | + const oldHeaders = (this as any)._transport?._transport?._parameters?.headers; |
| 60 | + |
| 61 | + if (oldHeaders) { |
| 62 | + const request = new this.httpRequest({ |
| 63 | + method: 'POST', |
| 64 | + protocol: 'https', |
| 65 | + hostname: url.hostname, |
| 66 | + path: url.pathname, |
| 67 | + body: serializedSpans, |
| 68 | + headers: { |
| 69 | + ...this.removeSigV4Headers(oldHeaders), |
| 70 | + host: url.hostname, |
| 71 | + }, |
| 72 | + }); |
| 73 | + |
| 74 | + try { |
| 75 | + const signer = new this.signatureV4({ |
| 76 | + credentials: this.defaultProvider(), |
| 77 | + region: this.region, |
| 78 | + service: OTLPAwsSpanExporter.SERVICE_NAME, |
| 79 | + sha256: this.sha256, |
| 80 | + }); |
| 81 | + |
| 82 | + const signedRequest = await signer.sign(request); |
| 83 | + |
| 84 | + (this as any)._transport._transport._parameters.headers = signedRequest.headers; |
| 85 | + } catch (exception) { |
| 86 | + diag.debug( |
| 87 | + `Failed to sign/authenticate the given exported Span request to OTLP XRay endpoint with error: ${exception}` |
| 88 | + ); |
| 89 | + } |
| 90 | + } |
| 91 | + } |
| 92 | + |
| 93 | + await super.export(items, resultCallback); |
| 94 | + } |
| 95 | + |
| 96 | + // Removes Sigv4 headers from old headers to avoid accidentally copying them to the new headers |
| 97 | + private removeSigV4Headers(headers: Record<string, string>) { |
| 98 | + const newHeaders: Record<string, string> = {}; |
| 99 | + const sigV4Headers = ['x-amz-date', 'authorization', 'x-amz-content-sha256', 'x-amz-security-token']; |
| 100 | + |
| 101 | + for (const key in headers) { |
| 102 | + if (!sigV4Headers.includes(key.toLowerCase())) { |
| 103 | + newHeaders[key] = headers[key]; |
| 104 | + } |
| 105 | + } |
| 106 | + return newHeaders; |
| 107 | + } |
| 108 | + |
| 109 | + private initDependencies(): any { |
| 110 | + if (getNodeVersion() < 16) { |
| 111 | + diag.error('SigV4 signing requires atleast Node major version 16'); |
| 112 | + return; |
| 113 | + } |
| 114 | + |
| 115 | + try { |
| 116 | + const awsSdkModule = require('@aws-sdk/credential-provider-node'); |
| 117 | + const awsCryptoModule = require('@aws-crypto/sha256-js'); |
| 118 | + const signatureModule = require('@smithy/signature-v4'); |
| 119 | + const httpModule = require('@smithy/protocol-http'); |
| 120 | + |
| 121 | + (this.defaultProvider = awsSdkModule.defaultProvider), |
| 122 | + (this.sha256 = awsCryptoModule.Sha256), |
| 123 | + (this.signatureV4 = signatureModule.SignatureV4), |
| 124 | + (this.httpRequest = httpModule.HttpRequest); |
| 125 | + this.hasRequiredDependencies = true; |
| 126 | + } catch (error) { |
| 127 | + diag.error(`Failed to load required AWS dependency for SigV4 Signing: ${error}`); |
| 128 | + } |
| 129 | + } |
| 130 | + |
| 131 | + private static changeUrlConfig(endpoint: string, config?: OTLPExporterNodeConfigBase) { |
| 132 | + const newConfig = |
| 133 | + config === undefined |
| 134 | + ? { url: endpoint } |
| 135 | + : { |
| 136 | + ...config, |
| 137 | + url: endpoint, |
| 138 | + }; |
| 139 | + |
| 140 | + return newConfig; |
| 141 | + } |
| 142 | +} |
0 commit comments