feat(serviceevents): resolve aws.local.environment in the SDK to align with CloudWatch agent

ServiceEvents and Dynamic Instrumentation need aws.local.environment, which today
only the CloudWatch agent sets. This adds an SDK-side resolver that computes the
same value the agent's awsapplicationsignals resolver would, from the OTel Resource,
with no dependency on the agent process:

- EnvironmentResolver: mirror the agent's precedence — explicit
  deployment.environment[.name] -> eks/k8s:<cluster>/<namespace> -> ecs:<cluster> ->
  ec2:<asg>/ec2:default -> generic:default (never empty, matching the agent's
  generic resolver off-platform).
- Ec2AutoScalingGroupFetcher: read the ASG name from IMDS instance tags (the stock
  OTel EC2 detector omits it), invoked lazily only on the EC2 branch and memoized
  process-wide.
- DI: resolve aws.local.environment for the instrumentation-config lookup key from the
  autoconfigured resource.

Unit tests included for the resolver, ASG fetcher, and DI config.

Author: jj22ee

CHANGELOG.md

@@ -13,6 +13,9 @@ If your change does not need a CHANGELOG entry, add the "skip changelog" label t
 
 ## Unreleased
 
+- feat(serviceevents): resolve `aws.local.environment` in the SDK (eks/k8s/ecs/ec2/generic) to align
+  ServiceEvents & Dynamic Instrumentation with the CloudWatch agent, with a custom EC2 ASG fetcher
+  ([#1417](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1417))
 - fix(serviceevents): gate incident trace correlation on the SAMPLED flag
 - fix: remove EOL AWS SDK v1 dependency for ARN parsing
   ([#1401](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1401))

awsagentprovider/src/main/java/software/amazon/opentelemetry/javaagent/providers/dynamicInstrumentation/DynamicInstrumentationManager.java

@@ -43,6 +43,7 @@
 import software.amazon.opentelemetry.javaagent.providers.dynamicInstrumentation.output.DISerializerImpl;
 import software.amazon.opentelemetry.javaagent.providers.dynamicInstrumentation.output.DISnapshotCollector;
 import software.amazon.opentelemetry.javaagent.providers.dynamicInstrumentation.output.DISnapshotOtlpEmitter;
+import software.amazon.opentelemetry.javaagent.providers.environment.EnvironmentResolver;
 import software.amazon.opentelemetry.javaagent.providers.exporter.otlp.aws.logs.OtlpAwsLogRecordExporterBuilder;
 
 /**
@@ -481,13 +482,13 @@ public DynamicInstrumentationClient getClient() {
   private DISnapshotOtlpEmitter createOtlpEmitter(DynamicInstrumentationConfig diConfig) {
     String logsEndpoint = diConfig.getLogsEndpoint();
 
-    // Resource supplier: defers reading ResourceHolder until first emit
+    // Resource supplier: defers reading ResourceHolder until first emit. aws.local.environment is
+    // stamped via the SDK-only resolver (same precedence as the CloudWatch agent) so DI snapshot
+    // telemetry correlates with Application Signals.
     Resource fallbackResource =
-        Resource.create(
-            Attributes.of(
-                AttributeKey.stringKey("service.name"), diConfig.getServiceName(),
-                AttributeKey.stringKey("deployment.environment"),
-                    diConfig.getDeploymentEnvironment()));
+        EnvironmentResolver.withLocalEnvironment(
+            Resource.create(
+                Attributes.of(AttributeKey.stringKey("service.name"), diConfig.getServiceName())));
 
     java.util.function.Supplier<Resource> resourceSupplier =
         () -> {
@@ -496,7 +497,7 @@ private DISnapshotOtlpEmitter createOtlpEmitter(DynamicInstrumentationConfig diC
             java.lang.reflect.Method getResource = holderClass.getMethod("getResource");
             Resource holderResource = (Resource) getResource.invoke(null);
             if (holderResource != null && !holderResource.equals(Resource.getDefault())) {
-              return holderResource;
+              return EnvironmentResolver.withLocalEnvironment(holderResource);
             }
           } catch (Throwable ignored) {
             // ResourceHolder not available or not yet populated — use fallback

awsagentprovider/src/main/java/software/amazon/opentelemetry/javaagent/providers/dynamicInstrumentation/config/DynamicInstrumentationConfig.java

@@ -15,11 +15,11 @@
 
 package software.amazon.opentelemetry.javaagent.providers.dynamicInstrumentation.config;
 
-import io.opentelemetry.api.common.AttributeKey;
 import io.opentelemetry.sdk.resources.Resource;
 import io.opentelemetry.semconv.ServiceAttributes;
 import java.lang.instrument.Instrumentation;
 import java.util.logging.Logger;
+import software.amazon.opentelemetry.javaagent.providers.environment.EnvironmentResolver;
 
 /**
  * Configuration for the Dynamic Instrumentation feature. Holds all settings needed for
@@ -114,8 +114,19 @@ public String getServiceName() {
   }
 
   /**
-   * Extract deployment environment from resource with lazy-loading and caching. Only caches
-   * successful environment resolution to handle timing issues with Resource population.
+   * Compute {@code aws.local.environment} from the resource with lazy-loading and caching.
+   *
+   * <p>SDK-only environment resolution: rather than reading only an explicit {@code
+   * deployment.environment[.name]}, this computes the full {@code aws.local.environment} from the
+   * detected resource attributes using the same precedence as the CloudWatch agent (explicit &rarr;
+   * {@code eks/k8s:<cluster>/<namespace>} &rarr; {@code ecs:<cluster>} &rarr; {@code ec2:<asg>}
+   * &rarr; {@code ec2:default} &rarr; {@code generic:default}). This makes DI self-sufficient — the
+   * value used as the request's Environment lookup key matches Application Signals without relying
+   * on the agent proxy to inject it.
+   *
+   * <p>Only caches once the resource carries platform context, to handle timing issues with
+   * Resource population; until then returns {@code "UnknownEnvironment"} without caching, allowing
+   * automatic retry on the next call.
    */
   public String getDeploymentEnvironment() {
     // Return cached value if we successfully found it before
@@ -129,17 +140,21 @@ public String getDeploymentEnvironment() {
       return "UnknownEnvironment"; // Don't cache - Resource might appear later
     }
 
-    String env = resource.getAttribute(AttributeKey.stringKey("deployment.environment.name"));
-    if (env != null && !env.isEmpty()) {
-      // SUCCESS! Cache it so we never query again
+    String env = EnvironmentResolver.resolveLocalEnvironment(resource);
+
+    // Cache only once the resource has the platform context to resolve a concrete value.
+    // The fallback values ("ec2:default", "generic:default") are also what a still-populating
+    // resource momentarily yields (no cloud.platform / host / k8s attributes yet), so don't cache
+    // those cases — the Resource may still be filling in. A specific value is always safe to cache.
+    boolean isFallback = "ec2:default".equals(env) || "generic:default".equals(env);
+    if (!env.isEmpty() && (!isFallback || EnvironmentResolver.hasPlatformContext(resource))) {
       cachedDeploymentEnvironment = env;
       logger.fine("AWS DI: Deployment environment resolved and cached: " + env);
       return env;
     }
 
-    // Attribute not available yet - don't cache, try again next time
-    logger.fine(
-        "AWS DI: deployment.environment.name attribute not yet available, will retry on next call");
+    // Resource not populated yet - don't cache, try again next time
+    logger.fine("AWS DI: environment not yet resolvable from resource, will retry on next call");
     return "UnknownEnvironment";
   }
 

awsagentprovider/src/main/java/software/amazon/opentelemetry/javaagent/providers/environment/Ec2AutoScalingGroupFetcher.java

@@ -0,0 +1,120 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+package software.amazon.opentelemetry.javaagent.providers.environment;
+
+import java.time.Duration;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import okhttp3.RequestBody;
+import okhttp3.Response;
+
+/**
+ * Fetches the EC2 Auto Scaling group name from IMDS instance tags.
+ *
+ * <p>The stock OTel {@code Ec2Resource} only reads the instance-identity document — it does NOT
+ * fetch instance tags, so the Auto Scaling group is absent from the SDK Resource. The CloudWatch
+ * agent reads the ASG from IMDS instance tags ({@code
+ * /latest/meta-data/tags/instance/aws:autoscaling:groupName}) to resolve {@code ec2:<asg>}. This
+ * fetcher closes that gap so the SDK can compute the same {@code aws.local.environment} the agent
+ * would on EC2, without depending on the agent.
+ *
+ * <p>Instance metadata tags must be enabled on the instance ({@code InstanceMetadataTags=enabled});
+ * when they aren't (or IMDS is unreachable / not EC2), the fetcher returns an empty string and the
+ * {@link EnvironmentResolver} falls back to {@code ec2:default} — matching the agent.
+ *
+ * <p>The fetch is invoked lazily by the resolver only on the EC2 branch, so EKS/ECS/explicit-env
+ * workloads never pay the IMDS round-trip.
+ */
+public final class Ec2AutoScalingGroupFetcher {
+
+  private static final Logger logger = Logger.getLogger(Ec2AutoScalingGroupFetcher.class.getName());
+
+  private static final String DEFAULT_IMDS_ENDPOINT = "169.254.169.254";
+  private static final String TOKEN_PATH = "/latest/api/token";
+  private static final String ASG_TAG_PATH =
+      "/latest/meta-data/tags/instance/aws:autoscaling:groupName";
+  private static final Duration TIMEOUT = Duration.ofSeconds(1);
+  private static final RequestBody EMPTY_BODY = RequestBody.create(new byte[0]);
+
+  private final String endpoint;
+
+  public Ec2AutoScalingGroupFetcher() {
+    // Endpoint is overridable for tests via the same system property the OTel EC2 resource uses;
+    // defaults to the EC2 link-local IMDS address.
+    this(System.getProperty("otel.aws.imds.endpointOverride", DEFAULT_IMDS_ENDPOINT));
+  }
+
+  // Visible for testing.
+  Ec2AutoScalingGroupFetcher(String endpoint) {
+    this.endpoint = endpoint;
+  }
+
+  /**
+   * Returns the Auto Scaling group name from IMDS instance tags, or an empty string when not on
+   * EC2, IMDS is unreachable, or instance metadata tags are not enabled. Never throws.
+   */
+  public String fetch() {
+    try {
+      OkHttpClient client =
+          new OkHttpClient.Builder()
+              .callTimeout(TIMEOUT)
+              .connectTimeout(TIMEOUT)
+              .readTimeout(TIMEOUT)
+              .build();
+
+      String urlBase = "http://" + endpoint;
+      String token = fetchToken(client, urlBase + TOKEN_PATH);
+      String asg = fetchTag(client, urlBase + ASG_TAG_PATH, token);
+      return asg == null ? "" : asg.trim();
+    } catch (RuntimeException e) {
+      // Not on EC2, IMDS unreachable, or instance tags not enabled — all expected, non-fatal.
+      logger.log(Level.FINE, "EC2 Auto Scaling group not available via IMDS", e);
+      return "";
+    }
+  }
+
+  private static String fetchToken(OkHttpClient client, String tokenUrl) {
+    Request request =
+        new Request.Builder()
+            .url(tokenUrl)
+            .method("PUT", EMPTY_BODY)
+            .addHeader("X-aws-ec2-metadata-token-ttl-seconds", "60")
+            .build();
+    return execute(client, request);
+  }
+
+  private static String fetchTag(OkHttpClient client, String tagUrl, String token) {
+    Request.Builder builder = new Request.Builder().url(tagUrl).get();
+    if (!token.isEmpty()) {
+      builder.addHeader("X-aws-ec2-metadata-token", token);
+    }
+    return execute(client, builder.build());
+  }
+
+  private static String execute(OkHttpClient client, Request request) {
+    try (Response response = client.newCall(request).execute()) {
+      if (response.code() != 200 || response.body() == null) {
+        return "";
+      }
+      return response.body().string();
+    } catch (Exception e) {
+      logger.log(Level.FINE, "IMDS request failed: " + request.url(), e);
+      return "";
+    }
+  }
+}