feat: enable secure random ID generation for AWS Lambda MicroVM environments (#11622)

feat: enable secure random ID generation for AWS Lambda MicroVM environments

When AWS_LAMBDA_MICROVM_IMAGE_ARN is set, force SecureRandom for trace/span
ID generation — the same treatment already applied for snap-start environments,
where snapshot-resumed instances would otherwise produce predictable IDs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>

Author: litianningdatadog

internal-api/src/main/java/datadog/trace/api/Config.java

@@ -1516,7 +1516,9 @@ private Config(final ConfigProvider configProvider, final InstrumenterConfig ins
         configProvider.getBoolean(WRITER_BAGGAGE_INJECT, isDatadogTraceWriter);
     injectLinksAsTagsEnabled = configProvider.getBoolean(WRITER_LINKS_INJECT, isDatadogTraceWriter);
     String lambdaInitType = getEnv("AWS_LAMBDA_INITIALIZATION_TYPE");
-    if (lambdaInitType != null && lambdaInitType.equals("snap-start")) {
+    String lambdaMicrovmImageArn = ConfigHelper.env("AWS_LAMBDA_MICROVM_IMAGE_ARN");
+    if ((lambdaInitType != null && lambdaInitType.equals("snap-start"))
+        || (lambdaMicrovmImageArn != null && !lambdaMicrovmImageArn.isEmpty())) {
       secureRandom = true;
     } else {
       secureRandom = configProvider.getBoolean(SECURE_RANDOM, DEFAULT_SECURE_RANDOM);

internal-api/src/test/java/datadog/trace/api/ConfigSecureRandomTest.java

@@ -0,0 +1,46 @@
+package datadog.trace.api;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+
+import datadog.trace.junit.utils.config.WithConfig;
+import datadog.trace.junit.utils.config.WithConfigExtension;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+
+@ExtendWith(WithConfigExtension.class)
+class ConfigSecureRandomTest {
+
+  @Test
+  void defaultStrategyIsRandom() {
+    assertNotEquals("SRandom", Config.get().getIdGenerationStrategy().getClass().getSimpleName());
+  }
+
+  @Test
+  void snapStartEnablesSecureRandom() {
+    WithConfigExtension.injectEnvConfig("AWS_LAMBDA_INITIALIZATION_TYPE", "snap-start", false);
+
+    assertEquals("SRandom", Config.get().getIdGenerationStrategy().getClass().getSimpleName());
+  }
+
+  @Test
+  void microvmImageArnEnablesSecureRandom() {
+    WithConfigExtension.injectEnvConfig(
+        "AWS_LAMBDA_MICROVM_IMAGE_ARN", "arn:aws:lambda:us-east-1::runtime:microvm", false);
+
+    assertEquals("SRandom", Config.get().getIdGenerationStrategy().getClass().getSimpleName());
+  }
+
+  @Test
+  void emptyMicrovmImageArnDoesNotEnableSecureRandom() {
+    WithConfigExtension.injectEnvConfig("AWS_LAMBDA_MICROVM_IMAGE_ARN", "", false);
+
+    assertNotEquals("SRandom", Config.get().getIdGenerationStrategy().getClass().getSimpleName());
+  }
+
+  @Test
+  @WithConfig(key = "trace.secure-random", value = "true")
+  void configPropertyEnablesSecureRandom() {
+    assertEquals("SRandom", Config.get().getIdGenerationStrategy().getClass().getSimpleName());
+  }
+}