feat(config): add DD_SERVERLESS_APM_ONLY traces-only mode

[zarirhamza]

Summary

Adds a single master switch — DD_SERVERLESS_APM_ONLY — that puts the extension in APM-only ("traces only") mode. When enabled, every billable metrics and logs egress path is suppressed so the customer incurs no infrastructure-monitoring or log-ingestion charges, while traces and APM trace stats are unaffected.

This closes the gap that made a true "traces only" configuration impossible before: there was no toggle to disable custom DogStatsD metrics, so even with logs and enhanced metrics turned off, custom metrics could still egress. A single, defensive flag now guarantees the behavior.

• Default is false — existing behavior is completely preserved.
• Readable from both environment (DD_SERVERLESS_APM_ONLY) and YAML.

Behavior

Signal	APM-only mode
Traces / APM trace stats	sent (unchanged)
Enhanced metrics	suppressed
Process (proc) enhanced metrics	suppressed
Custom DogStatsD metrics	suppressed
OTLP metrics	suppressed
Logs (incl. OTLP logs)	suppressed

Implementation (on the Config model)

• LambdaConfig / LambdaConfigSource gain a serverless_apm_only field, merged from both env (DD_SERVERLESS_APM_ONLY) and YAML via merge_fields!. Defaults to false.
• get_config() applies a post-merge override (apply_serverless_apm_only) that forces serverless_logs_enabled, enhanced_metrics, lambda_proc_enhanced_metrics (on .ext) and the core otlp_config_metrics_enabled / otlp_config_logs_enabled toggles off — overriding any individually set values so the guarantee holds regardless of other configuration.

Enforcement (defense in depth)

1. Config (config/mod.rs::apply_serverless_apm_only) — forces the logs/metrics/OTLP toggles off after the shared env/yaml merge.
2. Metrics wiring (main.rs::start_metrics_flushers) — returns no flushers, so anything drained from the DogStatsD aggregator (custom / enhanced / process) is discarded rather than sent.
3. Logs flusher (logs/flusher.rs::flush) — short-circuits to an empty request set, guaranteeing no log egress even if something is queued or redriven.

Testing

• cargo fmt --all -- --check — passes.
• cargo clippy --workspace --all-targets --features default — passes (no new warnings).
• cargo test — passes, including two new tests:
  • serverless_apm_only_defaults_off — flag defaults off; other toggles unchanged.
  • serverless_apm_only_forces_metrics_and_logs_off — flag overrides explicitly-enabled metrics/logs/OTLP toggles.

Live validation on AWS Lambda

Built the layer (arm64) and deployed two fully-distinct Node.js 22 functions (Datadog Node layer + this extension), one with the flag off and one on, then invoked each and queried the Datadog API:

Signal	flag OFF (serverless-apm-full)	flag ON (serverless-apm-standalone)
Spans / traces	present	present
Logs	present	0
Custom metric	present	absent (never ingested)

The extension's Lambda Telemetry API subscription also drops from [Platform, Extension, Function] to [Platform] when the flag is on, confirming logs are cut off at the source.

Risk / rollback

Low. Behavior is gated entirely behind a new flag that defaults to false; when unset the code paths are unchanged. Rollback is leaving DD_SERVERLESS_APM_ONLY unset.

Notes for reviewers

• The FIPS-feature clippy variant could not be run locally (macOS is missing the aws-lc FIPS crypto dylib); it exercises the same feature-agnostic config/logs code and runs on the Ubuntu CI runners.

[datadog-prod-us1-3]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 3 Pipeline jobs failed

DataDog/datadog-lambda-extension | integration-suite: [lmi]     

DataDog/datadog-lambda-extension | integration-suite: [on-demand]     

DataDog/datadog-lambda-extension | integration-suite: [snapstart]     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 827c848 | Docs | Datadog PR Page | Give us feedback!}