open-telemetry / open-telemetry/opentelemetry-java

Sigv4 Authentication in OtlpHttp{Signal}Exporter

Open
#7,002 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Feature Request
Dominant language
Java
Stars
2.5k
Forks
1k
Avg merge
3d 17h
Merged PRs (30d)
58

Description

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is.
Context: AWS X-ray has released an Otel Native endpoint: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html. However, this endpoint requires that the http requests be signed using sigv4: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html.

Situation: As of right now, trace senders are limited to using the otel collector (with Sigv4 extension) to send traces from their application to Xray otlp endpoint.

Is there a way to build a sigv4 extension for the java language SDKs so that applications can directly send to cloud otlp endpoint from the SDK? This essentially cuts an expensive middle man for faas environments like lambda. I was trying to look into this, but it doesnt look like the Java Otel SDK allows for http clients to be injected.

Describe the solution you'd like
A clear and concise description of what you want to happen.
I just need a mechanism to hook into the HTTP call workflow. Ideally in native HTTP clients these are interceptors (like the OkHTTP application interceptor here: https://square.github.io/okhttp/features/interceptors/#choosing-between-application-and-network-interceptors).

The interceptor would contain context about the HTTP request (body, params, headers, etc) and allow mutation of the HTTP request. I would then use the AWS SDK inside a custom interceptor to sign the HTTP request. I could also add this custom interceptor to the java-contrib repo and allow all otel/aws users to access this.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
I have considered the setHeaders() API and that does not solve the usecase since it does not have access to the HTTP request.

Alternatively, if we are allowed to inject in HTTP clients or specify that we would like to use an OkHTTP client (with our interceptor attached in) then we might be able to perform the signing.

Ideally, a separate OTLP exporter just for exporter to Amazon, would require alot of redundant code to maintain. I would assume other data storage vendors would also want some way to hook into the authentication process as well.

Additional context
Add any other context or screenshots about the feature request here.
Discussion with Jack over slack: https://cloud-native.slack.com/archives/C014L2KCTE3/p1734483601460489

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Java SDK implementation of OtlpHttp{Signal}Exporter and how it creates its HTTP client. Review whether the exporter exposes request-level context or client injection, then compare that with the proposed interceptor and setHeaders() approaches. Done means a supported way to mutate or sign outgoing OTLP HTTP requests without maintaining a separate Amazon-specific exporter.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
api, cloud, observability
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.