Which AWS service provides tracing and monitoring capabilities for your lambda function?

AWS X-Ray can provide tracing and monitoring capabilities for your Lambda functions. With active tracing mode enabled, you can save time and effort debugging and operating your functions as the X-Ray service support allows you to rapidly diagnose errors, identify bottlenecks, slowdowns and timeouts, by breaking down the latency for your Lambda functions.


01 Sign in to the AWS Management Console.

02 Navigate to Amazon Lambda console at https://console.aws.amazon.com/lambda/.

03 In the navigation panel, under AWS Lambda, choose Functions.

04 Click on the name (link) of the function that you want to examine.

05 Select the Configuration tab and choose Monitoring and operations tools from the left menu.

06 In the Monitoring and operations tools section, check the Active tracing status. If the feature status is set to Not enabled, the tracing feature is disabled, therefore the AWS X-Ray support for the selected Amazon Lambda function is not enabled.

07 Repeat steps no. 4 – 6 for each Lambda function available within the current AWS region.

08 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

01 Run list-functions command (OSX/Linux/UNIX) to list the name of each Amazon Lambda function available in the selected AWS cloud region:

aws lambda list-functions
	--region us-east-1
  --output table
	--query 'Functions[*].FunctionName'

02 The command output should return an array with the requested function names:

---------------------
|   ListFunctions   |
+-------------------+
|   cc-sqs-poller   |
|   cc-s3-logging   |
|   s3-get-object   |
+-------------------+

03 Run get-function-configuration command (OSX/Linux/UNIX) using the name of the Amazon Lambda function that you want to examine as the identifier parameter and custom query filters to describe the tracing feature status (mode) available for the selected function:

aws lambda get-function-configuration
  --region us-east-1
  --function-name cc-sqs-poller
  --query 'TracingConfig.Mode'

04 The command output should return the requested information (i.e. the tracing feature mode which can be either PassThrough or Active):

If the status (mode) returned by the get-function-configuration command output is "PassThrough", as shown in the example above, the tracing feature is disabled, therefore the AWS X-Ray support for the selected Amazon Lambda function is not enabled.

05 Repeat step no. 3 and 4 for each Lambda function available in the selected AWS region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other regions.

01 Sign in to the AWS Management Console.

02 Navigate to Amazon Lambda console at https://console.aws.amazon.com/lambda/.

03 In the left navigation panel, under AWS Lambda, choose Functions.

04 Click on the name of the function that you want to reconfigure.

05 Select the Configuration tab and choose Monitoring and operations tools from the left menu.

06 In the Monitoring and operations tools section, choose Edit to change the monitoring configuration for the selected function.

07 In the AWS X-Ray section, toggle the Active tracing button to enable the tracing feature (i.e. activate AWS X-Ray support) for the selected Amazon Lambda function. When you enable the feature using the AWS Management Console, Amazon Lambda adds the required permissions (i.e. "xray:PutTraceSegments" and "xray:PutTelemetryRecords") to your function's execution role. Choose Save to apply the changes. Once the selected function is triggered, traces will begin to be generated and captured, allowing you to identify and address errors and exceptions, performance bottlenecks, and throttling.

08 Repeat steps no. 4 – 7 to enable active tracing for each Amazon Lambda function available within the current AWS region.

09 Change the AWS cloud region from the navigation bar and repeat the Remediation process for the other regions.

01 Run get-function command (OSX/Linux/UNIX) to obtain the Amazon Resource Name (ARN) of the execution role associated with the Lambda function that you want to reconfigure:

aws lambda get-function
  --region us-east-1
  --function-name cc-sqs-poller
  --query 'Configuration.Role'

02 The command output should return the requested role ARN:

"arn:aws:iam::123456789012:role/service-role/cc-sqs-poller-role-abcdabcd"

03 Run attach-role-policy command (OSX/Linux/UNIX) to attach the "AWSXrayWriteOnlyAccess" managed IAM policy to the function's execution role, returned at the previous step. The "AWSXrayWriteOnlyAccess" policy gives AWS X-Ray service the permissions to upload trace data (the command does not produce an output):

aws iam attach-role-policy
  --role-name cc-sqs-poller-role-abcdabcd
  --policy-arn "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"

04 Run update-function-configuration command (OSX/Linux/UNIX) using the name of the Amazon Lambda function that you want to reconfigure as the identifier parameter, to enable the tracing feature (i.e. activate AWS X-Ray support) for the selected function:

aws lambda update-function-configuration
  --region us-east-1
  --function-name cc-sqs-poller
  --tracing-config '{"Mode":"Active"}'

05 The command output should return the metadata available for the reconfigured function:

{
  "TracingConfig": {
    "Mode": "Active"
  },
  "FunctionName": "cc-sqs-poller",
  "CodeSize": 615,
  "MemorySize": 1024,
  "FunctionArn": "arn:aws:lambda:us-east-1:123456789012:function:cc-sqs-poller",
  "Version": "$LATEST",
  "Role": "arn:aws:iam::123456789012:role/service-role/LambdaS3Role",
  "Timeout": 45,
  "LastModified": "2021-08-30T10:00:00.000+0000",
  "Handler": "lambda_function.lambda_handler",
  "Runtime": "python3.7",
  "Description": ""
}

06 Repeat steps no. 1 – 5 to enable active tracing for each Amazon Lambda function available in the selected AWS region.

07 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 6 to perform the Remediation process for other regions.

  • AWS Documentation
  • AWS Lambda FAQs
  • What Is AWS X-Ray?
  • Troubleshooting Lambda-Based Applications
  • AWS Command Line Interface (CLI) Documentation
  • lambda
  • list-functions
  • get-function
  • update-function-configuration
  • iam
  • attach-role-policy
  • AWS Blog(s)
  • AWS X-Ray Update – General Availability, Including Lambda Integration
  • AWS Lambda Support for AWS X-Ray

Publication date Jun 12, 2017

  • Lambda Runtime Environment Version (Sustainability, security, reliability)
  • Enable Active Tracing (Sustainability, operational-excellence)

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Which AWS service provides tracing and monitoring capabilities for your lambda function?

No thanks, back to article

You are auditing:

Enable Active Tracing

Risk level: Medium

What AWS service is used to trace your application Lambda?

You can use AWS X-Ray to trace your AWS Lambda functions. Lambda runs the X-Ray daemon and records a segment with details about the function invocation and execution. For further instrumentation, you can bundle the X-Ray SDK with your function to record outgoing calls and add annotations and metadata.

Which of the following adds tracing capabilities to Lambda?

AWS X-Ray can provide tracing and monitoring capabilities for your Lambda functions.

Can CloudWatch monitor Lambda?

Lambda automatically monitors Lambda functions on your behalf and reports metrics through Amazon CloudWatch. To help you monitor your code when it runs, Lambda automatically tracks the number of requests, the invocation duration per request, and the number of requests that result in an error.
Between Amazon CloudWatch Logs, CloudWatch Logs Insights, and AWS X-Ray, you can monitor the performance of Lambda-based applications and also drill into specific errors.