Merge branch 'main' of https://github.com/aws-observability/aws-otel-python-instrumentation

Author: liustve

.github/workflows/daily-scan.yml

@@ -93,7 +93,7 @@ jobs:
         id: high_scan
         uses: ./.github/actions/image_scan
         with:
-          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.12.1"
+          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.14.0"
           severity: 'CRITICAL,HIGH'
           logout: 'false'
 
@@ -102,7 +102,7 @@ jobs:
         id: low_scan
         uses: ./.github/actions/image_scan
         with:
-          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.12.1"
+          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.14.0"
           severity: 'MEDIUM,LOW,UNKNOWN'
           logout: 'false'
 

CHANGELOG.md

@@ -11,6 +11,15 @@ For any change that affects end users of this package, please add an entry under
 If your change does not need a CHANGELOG entry, add the "skip changelog" label to your PR.
 
 ## Unreleased
+- Disable django instrumentation if DJANGO_SETTINGS_MODULE is not set
+  ([#549](https://github.com/aws-observability/aws-otel-python-instrumentation/pull/549))
+- [PATCH] Add safety check for bedrock ConverseStream responses
+  ([#547](https://github.com/aws-observability/aws-otel-python-instrumentation/pull/547))
+- Add Service and Environment dimensions to EMF metrics when Application Signals EMF export is enabled
+  ([#548](https://github.com/aws-observability/aws-otel-python-instrumentation/pull/548))
+- Fix CVE-2025-66471. No associated PR since `urllib3` dependency will auto-bump to `2.6.x` upon release.
+
+## v0.14.0 - 2025-11-19
 - Add Resource and CFN Attributes for Bedrock AgentCore spans
   ([#495](https://github.com/aws-observability/aws-otel-python-instrumentation/pull/495))
 - Add botocore instrumentation extension for Bedrock AgentCore services with span attributes

aws-opentelemetry-distro/src/amazon/opentelemetry/distro/aws_opentelemetry_distro.py

@@ -16,7 +16,7 @@
 import sys
 from logging import ERROR, Logger, getLogger
 
-from amazon.opentelemetry.distro._utils import get_aws_region, is_agent_observability_enabled
+from amazon.opentelemetry.distro._utils import get_aws_region, is_agent_observability_enabled, is_installed
 from amazon.opentelemetry.distro.aws_opentelemetry_configurator import (
     APPLICATION_SIGNALS_ENABLED_CONFIG,
     OTEL_EXPORTER_OTLP_LOGS_ENDPOINT,
@@ -86,6 +86,21 @@ def _configure(self, **kwargs):
         if cwd_path not in sys.path:
             sys.path.insert(0, cwd_path)
 
+        # Check if Django is installed and determine if Django instrumentation should be enabled
+        if is_installed("django"):
+            # Django instrumentation is allowed when DJANGO_SETTINGS_MODULE is set
+            if not os.getenv("DJANGO_SETTINGS_MODULE"):
+                # DJANGO_SETTINGS_MODULE is not set, disable Django instrumentation
+                disabled_instrumentations = os.getenv("OTEL_PYTHON_DISABLED_INSTRUMENTATIONS", "")
+                os.environ["OTEL_PYTHON_DISABLED_INSTRUMENTATIONS"] = disabled_instrumentations + ",django"
+                _logger.warning(
+                    "Django is installed but DJANGO_SETTINGS_MODULE is not set. Disabling django instrumentation."
+                )
+            else:
+                _logger.debug(
+                    "Django instrumentation enabled: DJANGO_SETTINGS_MODULE=%s", os.getenv("DJANGO_SETTINGS_MODULE")
+                )
+
         os.environ.setdefault(OTEL_EXPORTER_OTLP_PROTOCOL, "http/protobuf")
 
         if os.environ.get(OTEL_PROPAGATORS, None) is None:

aws-opentelemetry-distro/src/amazon/opentelemetry/distro/exporter/aws/metrics/base_emf_exporter.py

@@ -6,11 +6,13 @@
 import json
 import logging
 import math
+import os
 import time
 from abc import ABC, abstractmethod
 from collections import defaultdict
 from typing import Any, Dict, List, Optional, Tuple
 
+from amazon.opentelemetry.distro._aws_resource_attribute_configurator import get_service_attribute
 from opentelemetry.sdk.metrics import Counter
 from opentelemetry.sdk.metrics import Histogram as HistogramInstr
 from opentelemetry.sdk.metrics import ObservableCounter, ObservableGauge, ObservableUpDownCounter, UpDownCounter
@@ -28,10 +30,19 @@
 )
 from opentelemetry.sdk.metrics.view import ExponentialBucketHistogramAggregation
 from opentelemetry.sdk.resources import Resource
+from opentelemetry.semconv.resource import ResourceAttributes
 from opentelemetry.util.types import Attributes
 
 logger = logging.getLogger(__name__)
 
+# Dimension name constants
+SERVICE_DIMENSION_NAME: str = "Service"
+ENVIRONMENT_DIMENSION_NAME: str = "Environment"
+
+# Constants
+LAMBDA_DEFAULT: str = "lambda:default"
+UNKNOWN_SERVICE: str = "UnknownService"
+
 
 class MetricRecord:
     """The metric data unified representation of all OTel metrics for OTel to CW EMF conversion."""
@@ -184,6 +195,53 @@ def _get_dimension_names(self, attributes: Attributes) -> List[str]:
         # For now, use all attributes as dimensions
         return list(attributes.keys())
 
+    def _has_dimension_case_insensitive(self, dimension_names: List[str], dimension_to_check: str) -> bool:
+        """Check if dimension already exists (case-insensitive match)."""
+        dimension_lower = dimension_to_check.lower()
+        return any(dim.lower() == dimension_lower for dim in dimension_names)
+
+    @staticmethod
+    def _is_application_signals_emf_export_enabled() -> bool:
+        """Check if Application Signals EMF export is enabled.
+
+        Returns True only if BOTH:
+        - OTEL_AWS_APPLICATION_SIGNALS_ENABLED is true
+        - OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED is true
+        """
+        app_signals_enabled = os.environ.get("OTEL_AWS_APPLICATION_SIGNALS_ENABLED", "false").lower() == "true"
+        emf_export_enabled = (
+            os.environ.get("OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED", "false").lower() == "true"
+        )
+        return app_signals_enabled and emf_export_enabled
+
+    def _add_application_signals_dimensions(
+        self, dimension_names: List[str], emf_log: Dict, resource: Resource
+    ) -> None:
+        """Add Service and Environment dimensions if not already present (case-insensitive)."""
+        if not self._is_application_signals_emf_export_enabled():
+            return
+
+        # Add Service dimension if not already set by user
+        if not self._has_dimension_case_insensitive(dimension_names, SERVICE_DIMENSION_NAME):
+            if resource:
+                service_name, _ = get_service_attribute(resource)
+            else:
+                service_name = UNKNOWN_SERVICE
+            dimension_names.insert(0, SERVICE_DIMENSION_NAME)
+            emf_log[SERVICE_DIMENSION_NAME] = str(service_name)
+
+        # Add Environment dimension if not already set by user
+        if not self._has_dimension_case_insensitive(dimension_names, ENVIRONMENT_DIMENSION_NAME):
+            environment_value = None
+            if resource and resource.attributes:
+                environment_value = resource.attributes.get(ResourceAttributes.DEPLOYMENT_ENVIRONMENT)
+            if not environment_value:
+                environment_value = LAMBDA_DEFAULT
+            # Insert after Service if it exists, otherwise at the beginning
+            insert_pos = 1 if SERVICE_DIMENSION_NAME in dimension_names else 0
+            dimension_names.insert(insert_pos, ENVIRONMENT_DIMENSION_NAME)
+            emf_log[ENVIRONMENT_DIMENSION_NAME] = str(environment_value)
+
     def _get_attributes_key(self, attributes: Attributes) -> str:
         """
         Create a hashable key from attributes for grouping metrics.
@@ -493,6 +551,9 @@ def _create_emf_log(
         for name, value in all_attributes.items():
             emf_log[name] = str(value)
 
+        # Add Service and Environment dimensions if Application Signals EMF export is enabled
+        self._add_application_signals_dimensions(dimension_names, emf_log, resource)
+
         # Add CloudWatch Metrics if we have metrics, include dimensions only if they exist
         if metric_definitions:
             cloudwatch_metric = {"Namespace": self.namespace, "Metrics": metric_definitions}

aws-opentelemetry-distro/src/amazon/opentelemetry/distro/patches/_botocore_patches.py

@@ -334,9 +334,10 @@ def patched_extract_tool_calls(
             tool_calls.append(tool_call)
         return tool_calls
 
-    # TODO: The following code is to patch a bedrock bug that was fixed in
+    # TODO: The following code is to patch bedrock bugs that were fixed in
     # opentelemetry-instrumentation-botocore==0.60b0 in:
     # https://github.com/open-telemetry/opentelemetry-python-contrib/pull/3875
+    # https://github.com/open-telemetry/opentelemetry-python-contrib/pull/3990
     # Remove this code once we've bumped opentelemetry-instrumentation-botocore dependency to 0.60b0
     def patched_process_anthropic_claude_chunk(self, chunk):
         # pylint: disable=too-many-return-statements,too-many-branches
@@ -412,12 +413,30 @@ def patched_process_anthropic_claude_chunk(self, chunk):
             self._stream_done_callback(self._response)
             return
 
+    def patched_from_converse(cls, response: dict[str, Any], capture_content: bool) -> bedrock_utils._Choice:
+        # be defensive about malformed responses, refer to #3958 for more context
+        output = response.get("output", {})
+        orig_message = output.get("message", {})
+        if role := orig_message.get("role"):
+            message = {"role": role}
+        else:
+            # amazon.titan does not serialize the role
+            message = {}
+
+        if tool_calls := bedrock_utils.extract_tool_calls(orig_message, capture_content):
+            message["tool_calls"] = tool_calls
+        elif capture_content and (content := orig_message.get("content")):
+            message["content"] = content
+
+        return cls(message, response["stopReason"], index=0)
+
     bedrock_utils.ConverseStreamWrapper.__init__ = patched_init
     bedrock_utils.ConverseStreamWrapper._process_event = patched_process_event
     bedrock_utils.InvokeModelWithResponseStreamWrapper._process_anthropic_claude_chunk = (
         patched_process_anthropic_claude_chunk
     )
     bedrock_utils.extract_tool_calls = patched_extract_tool_calls
+    bedrock_utils._Choice.from_converse = classmethod(patched_from_converse)
 
     # END The OpenTelemetry Authors code
 

aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py

@@ -1,4 +1,4 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-__version__ = "0.12.1.dev0"
+__version__ = "0.14.0.dev0"

aws-opentelemetry-distro/tests/amazon/opentelemetry/distro/exporter/aws/metrics/test_base_emf_exporter.py

@@ -1,8 +1,9 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+import os
 import unittest
-from unittest.mock import Mock
+from unittest.mock import Mock, patch
 
 from amazon.opentelemetry.distro.exporter.aws.metrics.base_emf_exporter import BaseEmfExporter, MetricRecord
 from opentelemetry.sdk.metrics.export import MetricExportResult
@@ -286,6 +287,173 @@ def test_export_failure_handling(self):
         result = self.exporter.export(metrics_data)
         self.assertEqual(result, MetricExportResult.FAILURE)
 
+    def test_has_dimension_case_insensitive(self):
+        """Test case-insensitive dimension checking."""
+        dimension_names = ["Service", "Environment", "operation"]
+
+        # Exact match
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "Service"))
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "Environment"))
+
+        # Case variations
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "service"))
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "SERVICE"))
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "environment"))
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "ENVIRONMENT"))
+        self.assertTrue(self.exporter._has_dimension_case_insensitive(dimension_names, "OPERATION"))
+
+        # Non-existent dimension
+        self.assertFalse(self.exporter._has_dimension_case_insensitive(dimension_names, "NotExists"))
+
+        # Empty list
+        self.assertFalse(self.exporter._has_dimension_case_insensitive([], "Service"))
+
+    def test_add_application_signals_dimensions_disabled(self):
+        """Test that dimensions are not added when feature is disabled."""
+        # Default exporter has feature disabled
+        dimension_names = ["operation"]
+        emf_log = {}
+        resource = Resource.create({"service.name": "my-service", "deployment.environment": "production"})
+
+        self.exporter._add_application_signals_dimensions(dimension_names, emf_log, resource)
+
+        # Dimensions should not be added
+        self.assertEqual(dimension_names, ["operation"])
+        self.assertNotIn("Service", emf_log)
+        self.assertNotIn("Environment", emf_log)
+
+    @patch.dict(
+        os.environ,
+        {"OTEL_AWS_APPLICATION_SIGNALS_ENABLED": "true", "OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED": "true"},
+    )
+    def test_add_application_signals_dimensions_enabled(self):
+        """Test that dimensions are added when feature is enabled."""
+        exporter = ConcreteEmfExporter(namespace="TestNamespace")
+        dimension_names = ["operation"]
+        emf_log = {}
+        resource = Resource.create({"service.name": "my-service", "deployment.environment": "production"})
+
+        exporter._add_application_signals_dimensions(dimension_names, emf_log, resource)
+
+        # Service and Environment should be added at the beginning
+        self.assertEqual(dimension_names, ["Service", "Environment", "operation"])
+        self.assertEqual(emf_log["Service"], "my-service")
+        self.assertEqual(emf_log["Environment"], "production")
+
+    @patch.dict(
+        os.environ,
+        {"OTEL_AWS_APPLICATION_SIGNALS_ENABLED": "true", "OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED": "true"},
+    )
+    def test_add_application_signals_dimensions_fallback_values(self):
+        """Test fallback values when resource attributes are not available."""
+        exporter = ConcreteEmfExporter(namespace="TestNamespace")
+        dimension_names = ["operation"]
+        emf_log = {}
+        # Resource without deployment.environment
+        resource = Resource.create({"service.name": "my-service"})
+
+        exporter._add_application_signals_dimensions(dimension_names, emf_log, resource)
+
+        # Service should use service.name, Environment should fallback to lambda:default
+        self.assertIn("Service", dimension_names)
+        self.assertIn("Environment", dimension_names)
+        self.assertEqual(emf_log["Service"], "my-service")
+        self.assertEqual(emf_log["Environment"], "lambda:default")
+
+    @patch.dict(
+        os.environ,
+        {"OTEL_AWS_APPLICATION_SIGNALS_ENABLED": "true", "OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED": "true"},
+    )
+    def test_add_application_signals_dimensions_no_resource(self):
+        """Test fallback when resource is None."""
+        exporter = ConcreteEmfExporter(namespace="TestNamespace")
+        dimension_names = ["operation"]
+        emf_log = {}
+
+        exporter._add_application_signals_dimensions(dimension_names, emf_log, None)
+
+        # Should use fallback values
+        self.assertIn("Service", dimension_names)
+        self.assertIn("Environment", dimension_names)
+        self.assertEqual(emf_log["Service"], "UnknownService")
+        self.assertEqual(emf_log["Environment"], "lambda:default")
+
+    @patch.dict(
+        os.environ,
+        {"OTEL_AWS_APPLICATION_SIGNALS_ENABLED": "true", "OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED": "true"},
+    )
+    def test_add_application_signals_dimensions_service_already_set(self):
+        """Test that Service dimension is not overwritten if already set (case-insensitive)."""
+        exporter = ConcreteEmfExporter(namespace="TestNamespace")
+
+        # User has set "service" (lowercase)
+        dimension_names = ["service", "operation"]
+        emf_log = {"service": "user-service"}
+        resource = Resource.create({"service.name": "my-service", "deployment.environment": "production"})
+
+        exporter._add_application_signals_dimensions(dimension_names, emf_log, resource)
+
+        # Service should NOT be added (case-insensitive match), but Environment should be
+        self.assertIn("Environment", dimension_names)
+        self.assertNotIn("Service", dimension_names)  # "Service" not added because "service" exists
+        self.assertEqual(emf_log.get("service"), "user-service")  # User value preserved
+        self.assertEqual(emf_log.get("Environment"), "production")
+
+    @patch.dict(
+        os.environ,
+        {"OTEL_AWS_APPLICATION_SIGNALS_ENABLED": "true", "OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED": "true"},
+    )
+    def test_add_application_signals_dimensions_environment_already_set(self):
+        """Test that Environment dimension is not overwritten if already set (case-insensitive)."""
+        exporter = ConcreteEmfExporter(namespace="TestNamespace")
+
+        # User has set "ENVIRONMENT" (uppercase)
+        dimension_names = ["ENVIRONMENT", "operation"]
+        emf_log = {"ENVIRONMENT": "user-environment"}
+        resource = Resource.create({"service.name": "my-service", "deployment.environment": "production"})
+
+        exporter._add_application_signals_dimensions(dimension_names, emf_log, resource)
+
+        # Environment should NOT be added (case-insensitive match), but Service should be
+        self.assertIn("Service", dimension_names)
+        self.assertNotIn("Environment", dimension_names)  # "Environment" not added because "ENVIRONMENT" exists
+        self.assertEqual(emf_log.get("Service"), "my-service")
+        self.assertEqual(emf_log.get("ENVIRONMENT"), "user-environment")  # User value preserved
+
+    @patch.dict(
+        os.environ,
+        {"OTEL_AWS_APPLICATION_SIGNALS_ENABLED": "true", "OTEL_AWS_APPLICATION_SIGNALS_EMF_EXPORT_ENABLED": "true"},
+    )
+    def test_create_emf_log_with_application_signals_enabled(self):
+        """Test EMF log creation with Application Signals EMF export enabled."""
+        exporter = ConcreteEmfExporter(namespace="TestNamespace")
+
+        record = exporter._create_metric_record("test_metric", "Count", "Test")
+        record.value = 50.0
+        record.timestamp = 1234567890
+        record.attributes = {"operation": "test"}
+
+        records = [record]
+        resource = Resource.create(
+            {
+                "service.name": "test-service",
+                "deployment.environment": "production",
+            }
+        )
+
+        result = exporter._create_emf_log(records, resource, 1234567890)
+
+        # Check that Service and Environment dimensions were added
+        self.assertEqual(result["Service"], "test-service")
+        self.assertEqual(result["Environment"], "production")
+
+        # Check CloudWatch metrics dimensions include Service and Environment
+        cw_metrics = result["_aws"]["CloudWatchMetrics"][0]
+        dimensions = cw_metrics["Dimensions"][0]
+        self.assertIn("Service", dimensions)
+        self.assertIn("Environment", dimensions)
+        self.assertIn("operation", dimensions)
+
 
 if __name__ == "__main__":
     unittest.main()