feat: initialize SCA reachability in the Lambda wrapper

Dockerfile

@@ -37,7 +37,6 @@ RUN rm -rf ./python/lib/$runtime/site-packages/jsonschema/tests
 # Remove unsupported appsec modules
 RUN rm -rf \
     ./python/lib/$runtime/site-packages/ddtrace/appsec/_iast \
-    ./python/lib/$runtime/site-packages/ddtrace/appsec/sca \
     ./python/lib/$runtime/site-packages/ddtrace/appsec/_shared
 
 # CI Visibility paths/integrations

datadog_lambda/wrapper.py

@@ -67,6 +67,18 @@
 
     start()
 
+if config.sca_enabled:
+    try:
+        from ddtrace.internal.sca.product import start as start_sca
+        from ddtrace.internal.sca.product import post_preload as instrument_sca
+
+        # The layer patches integrations before loading the wrapper. It does not
+        # use ddtrace.auto, so run both SCA startup phases before importing user code.
+        start_sca()
+        instrument_sca()
+    except Exception:
+        logger.debug("Failed to initialize SCA reachability", exc_info=True)
+
 profiler = None
 if config.profiling_enabled:
     try:

tests/test_wrapper.py

@@ -23,6 +23,23 @@
 MAX_UINT_64BITS = (1 << 64) - 1
 
 
+@patch("datadog_lambda.config.Config.sca_enabled", True)
+def test_sca_enabled(monkeypatch):
+    product = MagicMock()
+    monkeypatch.setitem(sys.modules, "ddtrace.internal.sca.product", product)
+
+    importlib.reload(wrapper)
+
+    assert product.mock_calls == [call.start(), call.post_preload()]
+
+
+@patch("datadog_lambda.config.Config.sca_enabled", True)
+def test_sca_import_errors_caught(monkeypatch):
+    monkeypatch.setitem(sys.modules, "ddtrace.internal.sca.product", None)
+
+    importlib.reload(wrapper)
+
+
 class TestDatadogLambdaWrapper(unittest.TestCase):
     def setUp(self):
         # Force @datadog_lambda_wrapper to always create a real