feat(server-utils): Migrate @opentelemetry/instrumentation-aws-sdk to orchestrion

.oxlintrc.base.json

@@ -147,6 +147,17 @@
         "no-param-reassign": "off"
       }
     },
+    {
+      "files": ["**/integrations/tracing-channel/aws-sdk/**/*.ts"],
+      "rules": {
+        "typescript/no-unsafe-member-access": "off",
+        "typescript/no-explicit-any": "off",
+        "typescript/no-this-alias": "off",
+        "max-lines": "off",
+        "complexity": "off",
+        "no-param-reassign": "off"
+      }
+    },
     {
       "files": ["**/integrations/tracing/redis/vendored/**/*.ts"],
       "rules": {

dev-packages/e2e-tests/test-applications/node-exports-test-app/scripts/consistentExports.ts

@@ -29,6 +29,9 @@ const NODE_EXPORTS_IGNORE = [
   // factories for that same Node-runtime-only opt-in, so it isn't surfaced
   // through the framework / serverless SDKs either.
   'diagnosticsChannelInjectionIntegrations',
+  // Helper for SDKs that build their own default-integration set (e.g. aws-serverless)
+  // to apply the diagnostics-channel integration swap; not surfaced elsewhere.
+  'applyDiagnosticsChannelInjectionIntegrations',
   // Internal helper only needed within integrations (e.g. bunRuntimeMetricsIntegration)
   '_INTERNAL_normalizeCollectionInterval',
 ];

dev-packages/node-integration-tests/suites/aws-serverless/aws-integration-streamed/test.ts

@@ -1,7 +1,12 @@
 import type { SerializedStreamedSpanContainer } from '@sentry/core';
 import { afterAll, describe, expect } from 'vitest';
+import { isOrchestrionEnabled } from '../../../utils';
 import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
 
+// See the non-streamed `aws-integration` suite: only the origin differs between the OTel and
+// orchestrion diagnostics-channel runs.
+const ORIGIN = isOrchestrionEnabled() ? 'auto.aws.orchestrion.aws-sdk' : 'auto.otel.aws';
+
 // The aws-sdk instrumentation creates spans by patching the underlying smithy middleware stack. The
 // patch target differs between aws-sdk versions, so we run the exact same assertions against both:
 // - the current aws-sdk (default, resolved from the workspace) which routes through `@smithy/core` >= 3.24.0
@@ -49,7 +54,7 @@ function assertAwsServiceSpans(spanCcontainer: SerializedStreamedSpanContainer):
     name: 'S3.PutObject',
     status: 'ok',
     attributes: expect.objectContaining({
-      'sentry.origin': { value: 'auto.otel.aws', type: 'string' },
+      'sentry.origin': { value: ORIGIN, type: 'string' },
       'sentry.op': { value: 'rpc', type: 'string' },
       'rpc.system': { value: 'aws-api', type: 'string' },
       'rpc.method': { value: 'PutObject', type: 'string' },

dev-packages/node-integration-tests/suites/aws-serverless/aws-integration/test.ts

@@ -1,7 +1,13 @@
 import type { TransactionEvent } from '@sentry/core';
 import { afterAll, describe, expect } from 'vitest';
+import { isOrchestrionEnabled } from '../../../utils';
 import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
 
+// The suite runs twice on CI: once with the OTel `Aws` integration (default) and once with the
+// orchestrion diagnostics-channel integration auto-injected (`INJECT_ORCHESTRION`). Both emit the
+// same spans; only the origin differs.
+const ORIGIN = isOrchestrionEnabled() ? 'auto.aws.orchestrion.aws-sdk' : 'auto.otel.aws';
+
 // The aws-sdk instrumentation creates spans by patching the underlying smithy middleware stack. The
 // patch target differs between aws-sdk versions, so we run the exact same assertions against both:
 // - the current aws-sdk (default, resolved from the workspace) which routes through `@smithy/core` >= 3.24.0
@@ -40,10 +46,10 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('S3.PutObject', {
     description: 'S3.PutObject',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     status: 'ok',
     data: expect.objectContaining({
-      'sentry.origin': 'auto.otel.aws',
+      'sentry.origin': ORIGIN,
       'sentry.op': 'rpc',
       'rpc.system': 'aws-api',
       'rpc.method': 'PutObject',
@@ -58,7 +64,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('S3.GetObject (success)', {
     description: 'S3.GetObject',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     status: 'ok',
     data: expect.objectContaining({ 'rpc.method': 'GetObject', 'rpc.service': 'S3', 'aws.s3.bucket': 'ot-demo-test' }),
   });
@@ -67,7 +73,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('S3.GetObject (error)', {
     description: 'S3.GetObject',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     status: 'internal_error',
     data: expect.objectContaining({ 'rpc.method': 'GetObject', 'rpc.service': 'S3' }),
   });
@@ -76,7 +82,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('DynamoDB.PutItem', {
     description: 'DynamoDB.PutItem',
     op: 'db',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'sentry.op': 'db',
       'rpc.method': 'PutItem',
@@ -92,7 +98,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('DynamoDB.Query', {
     description: 'DynamoDB.Query',
     op: 'db',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'Query',
       'db.operation': 'Query',
@@ -105,7 +111,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('SQS SendMessage', {
     description: 'my-queue send',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'SendMessage',
       'rpc.service': 'SQS',
@@ -121,7 +127,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('SQS ReceiveMessage', {
     description: 'my-queue receive',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'ReceiveMessage',
       'messaging.system': 'aws_sqs',
@@ -135,7 +141,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('SNS Publish', {
     description: 'my-topic send',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'Publish',
       'rpc.service': 'SNS',
@@ -150,7 +156,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('Lambda Invoke', {
     description: 'my-function Invoke',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'Invoke',
       'rpc.service': 'Lambda',
@@ -164,7 +170,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('Kinesis.PutRecord', {
     description: 'Kinesis.PutRecord',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     status: 'ok',
     data: expect.objectContaining({
       'rpc.method': 'PutRecord',
@@ -177,7 +183,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('SecretsManager.GetSecretValue', {
     description: 'SecretsManager.GetSecretValue',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'GetSecretValue',
       'rpc.service': 'SecretsManager',
@@ -189,7 +195,7 @@ function assertAwsServiceSpans(transaction: TransactionEvent): void {
   expectSpan('StepFunctions.StartExecution', {
     description: 'SFN.StartExecution',
     op: 'rpc',
-    origin: 'auto.otel.aws',
+    origin: ORIGIN,
     data: expect.objectContaining({
       'rpc.method': 'StartExecution',
       'rpc.service': 'SFN',

dev-packages/node-integration-tests/suites/aws-serverless/bedrock/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/aws-serverless';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  release: '1.0',
+  tracesSampleRate: 1.0,
+  transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/aws-serverless/bedrock/scenario.mjs

@@ -0,0 +1,84 @@
+import * as Sentry from '@sentry/aws-serverless';
+import { BedrockRuntimeClient, ConverseCommand, InvokeModelCommand } from '@aws-sdk/client-bedrock-runtime';
+// Force the HTTP/1 handler so `nock` can intercept the request instead of hitting real AWS.
+import { NodeHttpHandler } from '@smithy/node-http-handler';
+import nock from 'nock';
+
+nock.disableNetConnect();
+
+const region = 'us-east-1';
+const credentials = { accessKeyId: 'aws-test-key', secretAccessKey: 'aws-test-secret' };
+const host = `https://bedrock-runtime.${region}.amazonaws.com`;
+
+async function converse() {
+  const client = new BedrockRuntimeClient({
+    region,
+    credentials,
+    maxAttempts: 1,
+    requestHandler: new NodeHttpHandler(),
+  });
+
+  nock(host)
+    .post(/\/model\/.*\/converse$/)
+    .reply(
+      200,
+      JSON.stringify({
+        output: { message: { role: 'assistant', content: [{ text: 'Hello from Bedrock' }] } },
+        stopReason: 'end_turn',
+        usage: { inputTokens: 12, outputTokens: 8, totalTokens: 20 },
+      }),
+      { 'content-type': 'application/json' },
+    );
+
+  await client.send(
+    new ConverseCommand({
+      modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+      messages: [{ role: 'user', content: [{ text: 'Hello' }] }],
+      inferenceConfig: { maxTokens: 100, temperature: 0.5, topP: 0.9 },
+    }),
+  );
+}
+
+async function invokeModel() {
+  const client = new BedrockRuntimeClient({
+    region,
+    credentials,
+    maxAttempts: 1,
+    requestHandler: new NodeHttpHandler(),
+  });
+
+  nock(host)
+    .post(/\/model\/.*\/invoke$/)
+    .reply(
+      200,
+      JSON.stringify({
+        content: [{ type: 'text', text: 'Hello from Bedrock' }],
+        stop_reason: 'end_turn',
+        usage: { input_tokens: 15, output_tokens: 9 },
+      }),
+      { 'content-type': 'application/json' },
+    );
+
+  await client.send(
+    new InvokeModelCommand({
+      modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+      contentType: 'application/json',
+      body: JSON.stringify({
+        anthropic_version: 'bedrock-2023-05-31',
+        max_tokens: 100,
+        temperature: 0.5,
+        top_p: 0.9,
+        messages: [{ role: 'user', content: 'Hello' }],
+      }),
+    }),
+  );
+}
+
+async function run() {
+  await Sentry.startSpan({ name: 'Test Transaction' }, async () => {
+    await converse();
+    await invokeModel();
+  });
+}
+
+run();

dev-packages/node-integration-tests/suites/aws-serverless/bedrock/test.ts

@@ -0,0 +1,75 @@
+import type { TransactionEvent } from '@sentry/core';
+import { afterAll, describe, expect } from 'vitest';
+import { isOrchestrionEnabled } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// The suite runs twice on CI: once with the OTel `Aws` integration (default) and once with the
+// orchestrion diagnostics-channel integration auto-injected (`INJECT_ORCHESTRION`). Both emit the
+// same gen_ai spans; only the origin differs.
+const ORIGIN = isOrchestrionEnabled() ? 'auto.aws.orchestrion.aws-sdk' : 'auto.otel.aws';
+
+const MODEL_ID = 'anthropic.claude-3-5-sonnet-20240620-v1:0';
+
+function assertBedrockSpans(transaction: TransactionEvent): void {
+  const spans = transaction.spans ?? [];
+
+  expect(transaction.transaction).toBe('Test Transaction');
+
+  // Converse (non-streaming)
+  expect(spans, 'expected a Bedrock Converse span').toContainEqual(
+    expect.objectContaining({
+      description: `chat ${MODEL_ID}`,
+      origin: ORIGIN,
+      status: 'ok',
+      data: expect.objectContaining({
+        'sentry.origin': ORIGIN,
+        'gen_ai.system': 'aws.bedrock',
+        'gen_ai.operation.name': 'chat',
+        'gen_ai.request.model': MODEL_ID,
+        'gen_ai.request.max_tokens': 100,
+        'gen_ai.request.temperature': 0.5,
+        'gen_ai.request.top_p': 0.9,
+        'gen_ai.usage.input_tokens': 12,
+        'gen_ai.usage.output_tokens': 8,
+        'gen_ai.response.finish_reasons': ['end_turn'],
+      }),
+    }),
+  );
+
+  // InvokeModel (non-streaming, anthropic.claude request/response body)
+  expect(spans, 'expected a Bedrock InvokeModel span').toContainEqual(
+    expect.objectContaining({
+      origin: ORIGIN,
+      status: 'ok',
+      data: expect.objectContaining({
+        'sentry.origin': ORIGIN,
+        'gen_ai.system': 'aws.bedrock',
+        'gen_ai.request.model': MODEL_ID,
+        'gen_ai.request.max_tokens': 100,
+        'gen_ai.request.temperature': 0.5,
+        'gen_ai.request.top_p': 0.9,
+        'gen_ai.usage.input_tokens': 15,
+        'gen_ai.usage.output_tokens': 9,
+        'gen_ai.response.finish_reasons': ['end_turn'],
+      }),
+    }),
+  );
+}
+
+describe('awsIntegration - Bedrock', () => {
+  afterAll(() => {
+    cleanupChildProcesses();
+  });
+
+  createEsmAndCjsTests(
+    __dirname,
+    'scenario.mjs',
+    'instrument.mjs',
+    (createTestRunner, test) => {
+      test('auto-instruments Bedrock Converse and InvokeModel', { timeout: 90_000 }, async () => {
+        await createTestRunner().ignore('event').expect({ transaction: assertBedrockSpans }).start().completed();
+      });
+    },
+    { additionalDependencies: { '@aws-sdk/client-bedrock-runtime': '^3.1046.0' } },
+  );
+});

packages/aws-serverless/src/index.ts

@@ -167,6 +167,8 @@ export {
   metrics,
   spanStreamingIntegration,
   withStreamedSpan,
+  experimentalUseDiagnosticsChannelInjection,
+  diagnosticsChannelInjectionIntegrations,
 } from '@sentry/node';
 
 export {

packages/aws-serverless/src/init.ts

@@ -1,7 +1,11 @@
 import type { Integration, Options } from '@sentry/core';
 import { applySdkMetadata, debug, getSDKSource } from '@sentry/core';
 import type { NodeClient, NodeOptions } from '@sentry/node';
-import { getDefaultIntegrationsWithoutPerformance, initWithoutDefaultIntegrations } from '@sentry/node';
+import {
+  applyDiagnosticsChannelInjectionIntegrations,
+  getDefaultIntegrationsWithoutPerformance,
+  initWithoutDefaultIntegrations,
+} from '@sentry/node';
 import { envToBool } from '@sentry/node-core';
 import { DEBUG_BUILD } from './debug-build';
 import { awsIntegration } from './integration/aws';
@@ -49,8 +53,11 @@ function shouldDisableLayerExtensionForProxy(): boolean {
  */
 // NOTE: in awslambda-auto.ts, we also call the original `getDefaultIntegrations` from `@sentry/node` to load performance integrations.
 // If at some point we need to filter a node integration out for good, we need to make sure to also filter it out there.
-export function getDefaultIntegrations(_options: Options): Integration[] {
-  return [...getDefaultIntegrationsWithoutPerformance(), awsIntegration(), awsLambdaIntegration()];
+export function getDefaultIntegrations(options: Options): Integration[] {
+  const integrations = [...getDefaultIntegrationsWithoutPerformance(), awsIntegration(), awsLambdaIntegration()];
+  // If the app opted into diagnostics-channel injection, swap the OTel `Aws` integration for its
+  // channel-based equivalent (registered in `@sentry/server-utils`). No-op otherwise.
+  return applyDiagnosticsChannelInjectionIntegrations(integrations, options);
 }
 
 export interface AwsServerlessOptions extends NodeOptions {

packages/node/src/index.ts

@@ -46,6 +46,7 @@ export {
   getDefaultIntegrations,
   getDefaultIntegrationsWithoutPerformance,
   initWithoutDefaultIntegrations,
+  applyDiagnosticsChannelInjectionIntegrations,
 } from './sdk';
 export {
   experimentalUseDiagnosticsChannelInjection,