diff --git a/Dockerfile b/Dockerfile index 8b8f9a09..57b703f6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -37,7 +37,6 @@ RUN rm -rf ./python/lib/$runtime/site-packages/jsonschema/tests # Remove unsupported appsec modules RUN rm -rf \ ./python/lib/$runtime/site-packages/ddtrace/appsec/_iast \ - ./python/lib/$runtime/site-packages/ddtrace/appsec/sca \ ./python/lib/$runtime/site-packages/ddtrace/appsec/_shared # CI Visibility paths/integrations diff --git a/datadog_lambda/wrapper.py b/datadog_lambda/wrapper.py index 73057983..83e054c2 100644 --- a/datadog_lambda/wrapper.py +++ b/datadog_lambda/wrapper.py @@ -67,6 +67,18 @@ start() +if config.sca_enabled: + try: + from ddtrace.internal.sca.product import start as start_sca + from ddtrace.internal.sca.product import post_preload as instrument_sca + + # The layer patches integrations before loading the wrapper. It does not + # use ddtrace.auto, so run both SCA startup phases before importing user code. + start_sca() + instrument_sca() + except Exception: + logger.debug("Failed to initialize SCA reachability", exc_info=True) + profiler = None if config.profiling_enabled: try: diff --git a/tests/test_wrapper.py b/tests/test_wrapper.py index 26a53b0c..0bcede0c 100644 --- a/tests/test_wrapper.py +++ b/tests/test_wrapper.py @@ -23,6 +23,23 @@ MAX_UINT_64BITS = (1 << 64) - 1 +@patch("datadog_lambda.config.Config.sca_enabled", True) +def test_sca_enabled(monkeypatch): + product = MagicMock() + monkeypatch.setitem(sys.modules, "ddtrace.internal.sca.product", product) + + importlib.reload(wrapper) + + assert product.mock_calls == [call.start(), call.post_preload()] + + +@patch("datadog_lambda.config.Config.sca_enabled", True) +def test_sca_import_errors_caught(monkeypatch): + monkeypatch.setitem(sys.modules, "ddtrace.internal.sca.product", None) + + importlib.reload(wrapper) + + class TestDatadogLambdaWrapper(unittest.TestCase): def setUp(self): # Force @datadog_lambda_wrapper to always create a real