feat(contrib): add Azure APIM callout security processor by eliottness · Pull Request #4620 · DataDog/dd-trace-go

eliottness · 2026-03-30T20:46:08Z

What does this PR do?

Adds a new contrib/azure/apim-callout package — an HTTP/JSON callout service for Azure API Management (APIM) and Boomi API Gateway that runs the Datadog WAF and returns access control decisions.

Key components

apim.go — Core handler implementing the 4-call (APIM) and 2-call (Boomi) callout protocols with request/response header and body inspection via Datadog AppSec
apim_messages.go — Message types and serialization for the callout JSON protocol
cmd/apim-callout/ — Production-ready binary with TLS, health checks, graceful shutdown, and DD Agent telemetry
cmd/apim-callout/Dockerfile — Multi-stage Docker image for the callout service
apim_test.go — Unit tests covering both protocols, blocking, propagation headers, phase mismatch handling, body inspection, TTL cache, and policy file validation
cmd/apim-callout/main_test.go — Integration tests for CLI flags, TLS, health endpoint, and graceful shutdown

Motivation

Customers running Azure APIM or Boomi gateways need a way to enforce Datadog AppSec (WAF + ASM) at the gateway level before traffic reaches their backends. This service sits as an HTTP callout target, processes headers/bodies through the WAF, and returns block/allow decisions with optional response modification.

Describe how you validated your changes

All unit tests pass (go test ./contrib/azure/apim-callout/...)
E2E test script (azure-e2e-test.sh) validated against a live Azure APIM instance
Docker image builds and runs correctly
Policy files validated against the handler's expected JSON schema

Additional Notes

Deployment IaC (Bicep/ARM templates) is in a follow-up PR: feat(contrib/apim-callout): Deploy to Azure button + production hardening #4641
The deploy/ directory structure is set up here (policies + boomi templates) so the IaC PR only adds Azure-specific infra files
Docker image release workflow is included (.github/workflows/docker-images-release.yml)

pr-commenter · 2026-03-30T21:10:21Z

Benchmarks

Benchmark execution time: 2026-04-08 10:01:22

Comparing candidate commit 7f4e243 in PR branch eliottness/azure-apim-callout with baseline commit 56e391d in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 216 metrics, 8 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

datadog-prod-us1-3 · 2026-03-31T09:18:35Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.09% (-0.05%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 7f4e243 | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

codecov · 2026-04-02T09:48:17Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.73%. Comparing base (56e391d) to head (7f4e243).

Additional details and impacted files

Files with missing lines	Coverage Δ
instrumentation/packages.go	`7.81% <ø> (-1.57%)`	⬇️

... and 268 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

e-n-0

Nice!

e-n-0 · 2026-04-02T12:34:57Z

+	component := "apim-callout"
+	if m.req.Gateway == "boomi" {
+		component = "boomi-callout"


Once merged, these proxies components have to be used in the backend (ref https://github.com/DataDog/dd-go/pull/206155)

e-n-0 · 2026-04-02T12:36:34Z

+| `DD_APIM_CALLOUT_TLS` | `false` | Enable TLS |
+| `DD_APIM_CALLOUT_TLS_CERT_FILE` | | TLS certificate path (required when TLS is on) |
+| `DD_APIM_CALLOUT_TLS_KEY_FILE` | | TLS private key path (required when TLS is on) |


Out of curiosity, could the external processor be configured with TLS inside boomi/azure?

Yes but you would need a well known cert

eliottness · 2026-04-03T22:17:20Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5fba99446

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Eliott Bouhana <[email protected]>

Policy files live in the deploy/ branch; this test cannot run without them. Remove it from the base branch and regenerate contribs_generated.go.

Remove trailing blank line and use err.Error() instead of passing error directly to format string.

kakkoyun

LGTM.

Adds a new `contrib/azure/apim-callout` package — an HTTP/JSON callout service for Azure API Management (APIM) and Boomi API Gateway that runs the Datadog WAF and returns access control decisions. - **`apim.go`** — Core handler implementing the 4-call (APIM) and 2-call (Boomi) callout protocols with request/response header and body inspection via Datadog AppSec - **`apim_messages.go`** — Message types and serialization for the callout JSON protocol - **`cmd/apim-callout/`** — Production-ready binary with TLS, health checks, graceful shutdown, and DD Agent telemetry - **`cmd/apim-callout/Dockerfile`** — Multi-stage Docker image for the callout service - **`apim_test.go`** — Unit tests covering both protocols, blocking, propagation headers, phase mismatch handling, body inspection, TTL cache, and policy file validation - **`cmd/apim-callout/main_test.go`** — Integration tests for CLI flags, TLS, health endpoint, and graceful shutdown Customers running Azure APIM or Boomi gateways need a way to enforce Datadog AppSec (WAF + ASM) at the gateway level before traffic reaches their backends. This service sits as an HTTP callout target, processes headers/bodies through the WAF, and returns block/allow decisions with optional response modification. - All unit tests pass (`go test ./contrib/azure/apim-callout/...`) - E2E test script (`azure-e2e-test.sh`) validated against a live Azure APIM instance - Docker image builds and runs correctly - Policy files validated against the handler's expected JSON schema - Deployment IaC (Bicep/ARM templates) is in a follow-up PR: #4641 - The `deploy/` directory structure is set up here (policies + boomi templates) so the IaC PR only adds Azure-specific infra files - Docker image release workflow is included (`.github/workflows/docker-images-release.yml`)

…ning (#4641) ### What does this PR do? Adds one-click "Deploy to Azure" infrastructure-as-code for the APIM callout service introduced in #4620. ### Key components - **`deploy/azure/main.bicep`** — Top-level Bicep template orchestrating all modules - **`deploy/azure/modules/`** — Modular Bicep files: VNet + subnets (`networking`), Azure Container Apps (`container-app`), Datadog Agent ACI sidecar (`agent`), private DNS (`dns`), APIM VNet integration (`apim-network`), and optional policy injection (`apim-policy`) - **`deploy/azure/azuredeploy.json`** — Compiled ARM template for the "Deploy to Azure" button - **`deploy/azure/deploy.sh`** — CLI deployment script with validation, what-if preview, and rollback - **`deploy/azure/test-callout.sh`** — Post-deployment smoke test - **`deploy/azure/policies/`** — APIM XML policy templates (inbound, outbound, full) - **`deploy/boomi/`** — Boomi gateway policy templates (Groovy scripts + JSON callout configs) ### Motivation Provide a turnkey deployment experience so customers can go from zero to a running APIM callout setup with a single click in the Azure Portal, or via `az deployment` / `deploy.sh` for CLI users. ### Describe how you validated your changes - `az bicep build` compiles without errors - Full E2E deployment to Azure: VNet, ACA, ACI (DD Agent), private DNS, APIM integration all provisioned and functional - `test-callout.sh` passes against the deployed infrastructure - "Deploy to Azure" button tested in Azure Portal ### Additional Notes - Depends on #4620 (base branch) for the Go service and Dockerfile - The ARM template (`azuredeploy.json`) is compiled from Bicep — marked as `linguist-generated` in `.gitattributes` Co-authored-by: eliott.bouhana <[email protected]>

eliottness force-pushed the eliottness/azure-apim-callout branch from dce3cb6 to 2b7d8d8 Compare April 2, 2026 09:43

eliottness marked this pull request as ready for review April 2, 2026 11:51

eliottness requested review from a team as code owners April 2, 2026 11:51

eliottness changed the title ~~feat(contrib): add Azure APIM / Boomi HTTP callout security processor~~ feat(contrib): add Azure APIM callout security processor Apr 2, 2026

github-actions Bot added the apm:ecosystem contrib/* related feature requests or bugs label Apr 2, 2026

e-n-0 approved these changes Apr 2, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 3, 2026

View reviewed changes

Comment thread contrib/azure/apim-callout/policies/boomi-request-block.groovy Outdated

Comment thread contrib/azure/apim-callout/policies/boomi-response-block.groovy Outdated

Comment thread contrib/azure/apim-callout/apim.go

feat(contrib): azure/apim-callout contrib

3bdb8de

Signed-off-by: Eliott Bouhana <[email protected]>

eliottness force-pushed the eliottness/azure-apim-callout branch from f5fba99 to 3bdb8de Compare April 7, 2026 14:01

eliottness mentioned this pull request Apr 7, 2026

feat(contrib/apim-callout): Deploy to Azure button + production hardening #4641

Merged

eliottness added 2 commits April 7, 2026 16:14

fix(contrib/azure/apim-callout): remove TestPolicyFiles and regenerate

3becac4

Policy files live in the deploy/ branch; this test cannot run without them. Remove it from the base branch and regenerate contribs_generated.go.

fix(contrib/azure/apim-callout): lint fixes

84bdeb7

Remove trailing blank line and use err.Error() instead of passing error directly to format string.

mtoffl01 approved these changes Apr 7, 2026

View reviewed changes

eliottness requested a review from e-n-0 April 7, 2026 14:28

chore: retrigger CI

4229afe

kakkoyun approved these changes Apr 8, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying and removed mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying labels Apr 8, 2026

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: rejected and removed mergequeue-status: in_progress labels Apr 8, 2026

Merge branch 'main' into eliottness/azure-apim-callout

7f4e243

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: waiting and removed mergequeue-status: rejected labels Apr 8, 2026

rarguelloF approved these changes Apr 8, 2026

View reviewed changes

eliottness merged commit 887cc43 into main Apr 8, 2026
230 checks passed

eliottness deleted the eliottness/azure-apim-callout branch April 8, 2026 10:07

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: done and removed mergequeue-status: waiting labels Apr 8, 2026

Uh oh!

Conversation

eliottness commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Key components

Motivation

Describe how you validated your changes

Additional Notes

Uh oh!

pr-commenter Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Explanation

More details about the CI and significant changes

Uh oh!

datadog-prod-us1-3 Bot commented Mar 31, 2026 • edited by datadog-prod-us1-5 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

e-n-0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

e-n-0 Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

e-n-0 Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

eliottness Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

eliottness commented Apr 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kakkoyun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

eliottness commented Mar 30, 2026 •

edited

Loading

pr-commenter Bot commented Mar 30, 2026 •

edited

Loading

datadog-prod-us1-3 Bot commented Mar 31, 2026 •

edited by datadog-prod-us1-5 Bot

Loading

codecov Bot commented Apr 2, 2026 •

edited

Loading