Merge pull request DataDog#259 from DataDog/stephenf/fix-tags-lookup-casing

Store lowercase ARN keys in tags cache

Author: swfunc

aws/logs_monitoring/enhanced_lambda_metrics.py

@@ -118,6 +118,11 @@ def get(self, resource_arn):
  Will refetch the tags if they are out of date, or a lambda arn is encountered
  which isn't in the tag list
 
+ Note: the ARNs in the cache have been lowercased, so resource_arn must be lowercased
+
+ Args:
+ resource_arn (str): the arn we're getting tags from the cache for
+
  Returns:
  lambda_tags (str[]): the list of "key:value" Datadog tag strings
  """
@@ -263,10 +268,12 @@ def parse_get_resources_response_for_tags_by_arn(get_resources_page):
  aws_resouce_tag_mappings = get_resources_page["ResourceTagMappingList"]
  for aws_resource_tag_mapping in aws_resouce_tag_mappings:
  function_arn = aws_resource_tag_mapping["ResourceARN"]
+ lowercase_function_arn = function_arn.lower()
+
  raw_aws_tags = aws_resource_tag_mapping["Tags"]
  tags = map(get_dd_tag_string_from_aws_dict, raw_aws_tags)
 
- tags_by_arn[function_arn] += tags
+ tags_by_arn[lowercase_function_arn] += tags
 
  return tags_by_arn
 
@@ -363,6 +370,7 @@ def generate_enhanced_lambda_metrics(log, tags_cache):
  Returns:
  DatadogMetricPoint[], where each metric has all of its tags
  """
+ # Note: this arn attribute is always lowercased when it's created
  log_function_arn = log.get("lambda", {}).get("arn")
  log_message = log.get("message")
  timestamp = log.get("timestamp")
@@ -472,17 +480,20 @@ def calculate_estimated_cost(billed_duration_ms, memory_allocated):
  return BASE_LAMBDA_INVOCATION_PRICE + gb_seconds * LAMBDA_PRICE_PER_GB_SECOND
 
 
-def get_enriched_lambda_log_tags(log):
+def get_enriched_lambda_log_tags(log_event):
  """ Retrieves extra tags from lambda, either read from the function arn, or by fetching lambda tags from the function itself.
 
  Args:
  log (dict<str, str | dict | int>): a log parsed from the event in the split method
  """
- log_function_arn = log.get("lambda", {}).get("arn")
+ # Note that this arn attribute has been lowercased already
+ log_function_arn = log_event.get("lambda", {}).get("arn")
+
  if not log_function_arn:
  return []
  tags_from_arn = parse_lambda_tags_from_arn(log_function_arn)
  lambda_custom_tags = account_lambda_tags_cache.get(log_function_arn)
+
  # Combine and dedup tags
  tags = list(set(tags_from_arn + lambda_custom_tags))
  return tags

aws/logs_monitoring/lambda_function.py

@@ -677,7 +677,17 @@ def add_metadata_to_lambda_log(event):
 
  # Add any enhanced tags from metadata
  if IS_ENHANCED_METRICS_FILE_PRESENT:
- tags += get_enriched_lambda_log_tags(event)
+ custom_lambda_tags = get_enriched_lambda_log_tags(event)
+
+ # Check if one of the Lambda's custom tags is env
+ # If an env tag exists, remove the env:none placeholder
+ custom_env_tag = next(
+ (tag for tag in custom_lambda_tags if tag.startswith("env:")), None
+ )
+ if custom_env_tag is not None:
+ event[DD_CUSTOM_TAGS] = event[DD_CUSTOM_TAGS].replace("env:none", "")
+
+ tags += custom_lambda_tags
 
  # Dedup tags, so we don't end up with functionname twice
  tags = list(set(tags))
@@ -964,15 +974,15 @@ def awslogs_handler(event, context, metadata):
  if metadata[DD_SOURCE] == "lambda":
  log_group_parts = logs["logGroup"].split("/lambda/")
  if len(log_group_parts) > 1:
- function_name = log_group_parts[1].lower()
+ lowercase_function_name = log_group_parts[1].lower()
  # Split the arn of the forwarder to extract the prefix
  arn_parts = context.invoked_function_arn.split("function:")
  if len(arn_parts) > 0:
  arn_prefix = arn_parts[0]
- # Rebuild the arn by replacing the function name
- arn = arn_prefix + "function:" + function_name
- # Add the arn as a log attribute
- arn_attributes = {"lambda": {"arn": arn}}
+ # Rebuild the arn with the lowercased function name
+ lowercase_arn = arn_prefix + "function:" + lowercase_function_name
+ # Add the lowercased arn as a log attribute
+ arn_attributes = {"lambda": {"arn": lowercase_arn}}
  aws_attributes = merge_dicts(aws_attributes, arn_attributes)
 
  env_tag_exists = (