Aws-xray-sdk-node: S3 pre-signed url not traced

[ivanmartos]

X-ray does not capture traces when generating pre-signed url for S3 object
When uploading object to s3, trace is correctly created and visible in AWS console.
Here are some parts of extracted code.

const AWSXRay = require('aws-xray-sdk')
const AWS = AWSXRay.captureAWS(require('aws-sdk'))
const initS3 = () =>
  new AWS.S3({
    signatureVersion: 'v4',
    apiVersion: '2006-03-01',
  })

const genereateS3URL = async (s3key) => {
  const s3 = initS3()

  const url = s3.getSignedUrl('getObject', {
    Key: s3key,
    Bucket: 'some_bucket_name',
    Expires: SIGNED_URL_EXPIRATION_IN_SECONDS,
    ResponseContentDisposition: `attachment; filename ="FOOBAR"`,
  })
  return url
}

versions used are

    "aws-sdk": "^2.411.0",
    "aws-xray-sdk": "^2.5.0",

[mits87]

Actually I had the same problem and I didn't find any solution to solve the problem.

[willarmiros]

Hello,
This is a result of a quirk in the aws-sdk library. The AWSXRay.captureAWS method (implemented here) automatically instruments all methods of AWS clients. This is where you can find such methods. However, the getSignedUrl s3 method is a unique case because it is implemented as a service rather than a client method.

To be honest, I'm not entirely sure why this decision was made, but I'm sure there's a good reason behind it. You can open an issue on the AWS SDK to find out.

[hauboldj]

getSignedUrl doesn't make any HTTP/API calls. It just uses the credentials to create a signed request. In no case would I expect any trace from getSignedUrl.

Note: getSignedUrl could trigger the credential provider chain which could make http calls to the instance metadata service but I don't believe these calls are instrumented. Since the getSignedUrl is called synchronously in the example we can assume no instance metadata calls from being made.

[willarmiros]

I will close this issue since it is the responsibility of the AWS SDK to change their implementation to fix this issue. As @hauboldj said however, the getSignedURL API does not make any network calls unlike other API calls, so it's possible the existing implementation will not change. I encourage you to open an issue with the AWS SDK team, and mention this issue for context.