AppSec Lambda: Analyze HTTP response

[claponcet]

What Does This Do

Adds AppSec response analysis for AWS Lambda: LambdaAppSecHandler.processResponseData
parses the Lambda response object and fires the WAF gateway events (responseStarted,
responseHeader, responseHeaderDone, responseBody) with the extracted status code,
headers, and body.

Trigger-type detection (API Gateway v1/v2, ALB, Lambda URL, WebSocket) is added to
processRequestStart and stored in a ThreadLocal. processResponseData uses it to
decide whether to parse the response as an API-GW envelope or fall back to treating the
whole payload as a plain response body, matching how non-envelope HTTP triggers behave.

CoreTracer.notifyAppSecEnd is extended to receive the raw result object so it can be
forwarded to processResponseData from the Lambda handler instrumentation.

Additional extraction improvements:

• Response header keys are lowercased (Locale.ROOT) to normalise casing across API GW / ALB variants
• isBase64Encoded accepts "true" (string) in addition to Boolean.TRUE

LambdaHandlerInstrumentationTest and LambdaAppSecHandlerTest migrated from Spock/Groovy
to JUnit 5 Java, with new test cases for response analysis and trigger-type gating.

processRequestEnd now propagates ASM_KEEP for traces where the WAF set isManuallyKept() via a trace-tagging rule but produced no WAF events. In Lambda the WAF runs before the span exists, so GatewayBridge's existing guard (which gates the tag on non-empty events) never fires for this case; the fix applies the tags directly in processRequestEnd. A minimal AppSecContext interface is introduced in internal-api to expose isManuallyKept() across module boundaries.

Motivation

Allows the WAF to inspect Lambda HTTP responses for threats.

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Add your completed PR to the merge queue by commenting /merge.

Jira ticket: APPSEC-60532

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.01 s	13.96 s	[-0.4%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.93 s	13.05 s	[-1.8%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent	16.89 s	16.73 s	[-0.1%; +1.9%] (no difference)
startup:petclinic:iast:Agent	16.87 s	16.88 s	[-0.9%; +0.8%] (no difference)
startup:petclinic:profiling:Agent	16.59 s	16.76 s	[-2.2%; +0.2%] (no difference)
startup:petclinic:sca:Agent	16.89 s	16.88 s	[-0.9%; +1.0%] (no difference)
startup:petclinic:tracing:Agent	16.03 s	16.06 s	[-1.0%; +0.6%] (no difference)

Commit: 4476be49 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[claponcet]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d2a12a4fb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 868f9a139e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[jandro996]

While reviewing the changes in this file, I noticed a few pre-existing lines (not touched by this PR) that also use fully-qualified names for classes already imported (List, Collections, Collectors): lines 669, 670, 675, 824, 853, 901, 902, 908. Not blocking this PR, just flagging in case you want to clean them up while you're in this file.

[jandro996]

LGTM!

[datadog-prod-us1-6]

🎯 Code Coverage (details)
• Patch Coverage: 86.18%
• Overall Coverage: 56.56% (-0.38%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4476be4 | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-07-10 08:42:34 UTC ℹ️ Start processing command /merge

---

2026-07-10 08:42:39 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2h (p90).

---

2026-07-10 09:42:04 UTC ℹ️ MergeQueue: This merge request was merged