Skip to content

Commit 998a0d1

Browse files
mcaulifnnpalmgithub-actions[bot]
authored
feat(lambda): add support for X-Ray tracing (#3142)
* feat(lambda): Add support for X-Ray tracing * Workflow fix * Update update-docs.yml Reverting docs fixes * docs: auto update terraform docs * Adding to multi-runner * Adding to pool lambda * docs: auto update terraform docs * - enable tracing for all submodules in the multi-runner - add missing policy for the pool --------- Co-authored-by: Niek Palm <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Niek Palm <[email protected]>
1 parent da49078 commit 998a0d1

25 files changed

+188
-2
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -533,6 +533,7 @@ We welcome any improvement to the standard module to make the default as secure
533533
| <a name="input_lambda_s3_bucket"></a> [lambda\_s3\_bucket](#input\_lambda\_s3\_bucket) | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. | `string` | `null` | no |
534534
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
535535
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
536+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
536537
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
537538
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |
538539
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no |

‎main.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ module "webhook" {
154154
lambda_architecture = var.lambda_architecture
155155
lambda_zip = var.webhook_lambda_zip
156156
lambda_timeout = var.webhook_lambda_timeout
157+
lambda_tracing_mode = var.lambda_tracing_mode
157158
logging_retention_in_days = var.logging_retention_in_days
158159
logging_kms_key_id = var.logging_kms_key_id
159160

@@ -235,6 +236,7 @@ module "runners" {
235236
lambda_timeout_scale_down = var.runners_scale_down_lambda_timeout
236237
lambda_subnet_ids = var.lambda_subnet_ids
237238
lambda_security_group_ids = var.lambda_security_group_ids
239+
lambda_tracing_mode = var.lambda_tracing_mode
238240
logging_retention_in_days = var.logging_retention_in_days
239241
logging_kms_key_id = var.logging_kms_key_id
240242
enable_cloudwatch_agent = var.enable_cloudwatch_agent
@@ -297,6 +299,7 @@ module "runner_binaries" {
297299
lambda_architecture = var.lambda_architecture
298300
lambda_zip = var.runner_binaries_syncer_lambda_zip
299301
lambda_timeout = var.runner_binaries_syncer_lambda_timeout
302+
lambda_tracing_mode = var.lambda_tracing_mode
300303
logging_retention_in_days = var.logging_retention_in_days
301304
logging_kms_key_id = var.logging_kms_key_id
302305

‎modules/multi-runner/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ module "multi-runner" {
134134
| <a name="input_lambda_s3_bucket"></a> [lambda\_s3\_bucket](#input\_lambda\_s3\_bucket) | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. | `string` | `null` | no |
135135
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
136136
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
137+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
137138
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
138139
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |
139140
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no |

‎modules/multi-runner/runner-binaries.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ module "runner_binaries" {
1616
lambda_architecture = var.lambda_architecture
1717
lambda_zip = var.runner_binaries_syncer_lambda_zip
1818
lambda_timeout = var.runner_binaries_syncer_lambda_timeout
19+
lambda_tracing_mode = var.lambda_tracing_mode
1920
logging_retention_in_days = var.logging_retention_in_days
2021
logging_kms_key_id = var.logging_kms_key_id
2122
enable_event_rule_binaries_syncer = var.enable_event_rule_binaries_syncer

‎modules/multi-runner/runners.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ module "runners" {
6363
lambda_timeout_scale_down = var.runners_scale_down_lambda_timeout
6464
lambda_subnet_ids = var.lambda_subnet_ids
6565
lambda_security_group_ids = var.lambda_security_group_ids
66+
lambda_tracing_mode = var.lambda_tracing_mode
6667
logging_retention_in_days = var.logging_retention_in_days
6768
logging_kms_key_id = var.logging_kms_key_id
6869
enable_cloudwatch_agent = each.value.runner_config.enable_cloudwatch_agent

‎modules/multi-runner/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -527,3 +527,9 @@ variable "ssm_paths" {
527527
})
528528
default = {}
529529
}
530+
531+
variable "lambda_tracing_mode" {
532+
description = "Enable X-Ray tracing for the lambda functions."
533+
type = string
534+
default = null
535+
}

‎modules/multi-runner/webhook.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ module "webhook" {
1919
lambda_architecture = var.lambda_architecture
2020
lambda_zip = var.webhook_lambda_zip
2121
lambda_timeout = var.webhook_lambda_timeout
22+
lambda_tracing_mode = var.lambda_tracing_mode
2223
logging_retention_in_days = var.logging_retention_in_days
2324
logging_kms_key_id = var.logging_kms_key_id
2425

‎modules/runner-binaries-syncer/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ No modules.
6565
| [aws_iam_role_policy.lambda_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
6666
| [aws_iam_role_policy.lambda_syncer_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
6767
| [aws_iam_role_policy.syncer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
68+
| [aws_iam_role_policy.syncer_lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
6869
| [aws_iam_role_policy_attachment.syncer_vpc_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
6970
| [aws_lambda_function.syncer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
7071
| [aws_lambda_permission.on_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
@@ -81,6 +82,7 @@ No modules.
8182
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
8283
| [aws_iam_policy_document.action_dist_sse_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
8384
| [aws_iam_policy_document.lambda_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
85+
| [aws_iam_policy_document.lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
8486

8587
## Inputs
8688

@@ -98,6 +100,7 @@ No modules.
98100
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
99101
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
100102
| <a name="input_lambda_timeout"></a> [lambda\_timeout](#input\_lambda\_timeout) | Time out of the lambda in seconds. | `number` | `300` | no |
103+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
101104
| <a name="input_lambda_zip"></a> [lambda\_zip](#input\_lambda\_zip) | File location of the lambda zip file. | `string` | `null` | no |
102105
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
103106
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |

‎modules/runner-binaries-syncer/iam.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
data "aws_iam_policy_document" "lambda_xray" {
2+
count = var.lambda_tracing_mode != null ? 1 : 0
3+
statement {
4+
actions = [
5+
"xray:BatchGetTraces",
6+
"xray:GetTraceSummaries",
7+
"xray:PutTelemetryRecords",
8+
"xray:PutTraceSegments"
9+
]
10+
effect = "Allow"
11+
resources = [
12+
"*"
13+
]
14+
sid = "AllowXRay"
15+
}
16+
}

‎modules/runner-binaries-syncer/runner-binaries-syncer.tf

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,13 @@ resource "aws_lambda_function" "syncer" {
4444
}
4545

4646
tags = var.tags
47+
48+
dynamic "tracing_config" {
49+
for_each = var.lambda_tracing_mode != null ? [true] : []
50+
content {
51+
mode = var.lambda_tracing_mode
52+
}
53+
}
4754
}
4855

4956
resource "aws_iam_role_policy" "lambda_kms" {
@@ -182,4 +189,8 @@ resource "aws_lambda_permission" "on_deploy" {
182189
source_arn = aws_s3_bucket.action_dist.arn
183190
}
184191

185-
192+
resource "aws_iam_role_policy" "syncer_lambda_xray" {
193+
count = var.lambda_tracing_mode != null ? 1 : 0
194+
policy = data.aws_iam_policy_document.lambda_xray[0].json
195+
role = aws_iam_role.syncer_lambda.name
196+
}

0 commit comments

Comments
 (0)