Skip to content
This repository was archived by the owner on Jan 16, 2025. It is now read-only.

Commit 998a0d1

Browse files
mcaulifnnpalmgithub-actions[bot]
authored
feat(lambda): add support for X-Ray tracing (#3142)
* feat(lambda): Add support for X-Ray tracing * Workflow fix * Update update-docs.yml Reverting docs fixes * docs: auto update terraform docs * Adding to multi-runner * Adding to pool lambda * docs: auto update terraform docs * - enable tracing for all submodules in the multi-runner - add missing policy for the pool --------- Co-authored-by: Niek Palm <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Niek Palm <[email protected]>
1 parent da49078 commit 998a0d1

25 files changed

+188
-2
lines changed

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -533,6 +533,7 @@ We welcome any improvement to the standard module to make the default as secure
533533
| <a name="input_lambda_s3_bucket"></a> [lambda\_s3\_bucket](#input\_lambda\_s3\_bucket) | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. | `string` | `null` | no |
534534
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
535535
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
536+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
536537
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
537538
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |
538539
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no |

Diff for: ‎main.tf

+3
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ module "webhook" {
154154
lambda_architecture = var.lambda_architecture
155155
lambda_zip = var.webhook_lambda_zip
156156
lambda_timeout = var.webhook_lambda_timeout
157+
lambda_tracing_mode = var.lambda_tracing_mode
157158
logging_retention_in_days = var.logging_retention_in_days
158159
logging_kms_key_id = var.logging_kms_key_id
159160

@@ -235,6 +236,7 @@ module "runners" {
235236
lambda_timeout_scale_down = var.runners_scale_down_lambda_timeout
236237
lambda_subnet_ids = var.lambda_subnet_ids
237238
lambda_security_group_ids = var.lambda_security_group_ids
239+
lambda_tracing_mode = var.lambda_tracing_mode
238240
logging_retention_in_days = var.logging_retention_in_days
239241
logging_kms_key_id = var.logging_kms_key_id
240242
enable_cloudwatch_agent = var.enable_cloudwatch_agent
@@ -297,6 +299,7 @@ module "runner_binaries" {
297299
lambda_architecture = var.lambda_architecture
298300
lambda_zip = var.runner_binaries_syncer_lambda_zip
299301
lambda_timeout = var.runner_binaries_syncer_lambda_timeout
302+
lambda_tracing_mode = var.lambda_tracing_mode
300303
logging_retention_in_days = var.logging_retention_in_days
301304
logging_kms_key_id = var.logging_kms_key_id
302305

Diff for: ‎modules/multi-runner/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ module "multi-runner" {
134134
| <a name="input_lambda_s3_bucket"></a> [lambda\_s3\_bucket](#input\_lambda\_s3\_bucket) | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. | `string` | `null` | no |
135135
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
136136
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
137+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
137138
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
138139
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |
139140
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no |

Diff for: ‎modules/multi-runner/runner-binaries.tf

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ module "runner_binaries" {
1616
lambda_architecture = var.lambda_architecture
1717
lambda_zip = var.runner_binaries_syncer_lambda_zip
1818
lambda_timeout = var.runner_binaries_syncer_lambda_timeout
19+
lambda_tracing_mode = var.lambda_tracing_mode
1920
logging_retention_in_days = var.logging_retention_in_days
2021
logging_kms_key_id = var.logging_kms_key_id
2122
enable_event_rule_binaries_syncer = var.enable_event_rule_binaries_syncer

Diff for: ‎modules/multi-runner/runners.tf

+1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ module "runners" {
6363
lambda_timeout_scale_down = var.runners_scale_down_lambda_timeout
6464
lambda_subnet_ids = var.lambda_subnet_ids
6565
lambda_security_group_ids = var.lambda_security_group_ids
66+
lambda_tracing_mode = var.lambda_tracing_mode
6667
logging_retention_in_days = var.logging_retention_in_days
6768
logging_kms_key_id = var.logging_kms_key_id
6869
enable_cloudwatch_agent = each.value.runner_config.enable_cloudwatch_agent

Diff for: ‎modules/multi-runner/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -527,3 +527,9 @@ variable "ssm_paths" {
527527
})
528528
default = {}
529529
}
530+
531+
variable "lambda_tracing_mode" {
532+
description = "Enable X-Ray tracing for the lambda functions."
533+
type = string
534+
default = null
535+
}

Diff for: ‎modules/multi-runner/webhook.tf

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ module "webhook" {
1919
lambda_architecture = var.lambda_architecture
2020
lambda_zip = var.webhook_lambda_zip
2121
lambda_timeout = var.webhook_lambda_timeout
22+
lambda_tracing_mode = var.lambda_tracing_mode
2223
logging_retention_in_days = var.logging_retention_in_days
2324
logging_kms_key_id = var.logging_kms_key_id
2425

Diff for: ‎modules/runner-binaries-syncer/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ No modules.
6565
| [aws_iam_role_policy.lambda_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
6666
| [aws_iam_role_policy.lambda_syncer_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
6767
| [aws_iam_role_policy.syncer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
68+
| [aws_iam_role_policy.syncer_lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
6869
| [aws_iam_role_policy_attachment.syncer_vpc_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
6970
| [aws_lambda_function.syncer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
7071
| [aws_lambda_permission.on_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
@@ -81,6 +82,7 @@ No modules.
8182
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
8283
| [aws_iam_policy_document.action_dist_sse_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
8384
| [aws_iam_policy_document.lambda_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
85+
| [aws_iam_policy_document.lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
8486

8587
## Inputs
8688

@@ -98,6 +100,7 @@ No modules.
98100
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
99101
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
100102
| <a name="input_lambda_timeout"></a> [lambda\_timeout](#input\_lambda\_timeout) | Time out of the lambda in seconds. | `number` | `300` | no |
103+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
101104
| <a name="input_lambda_zip"></a> [lambda\_zip](#input\_lambda\_zip) | File location of the lambda zip file. | `string` | `null` | no |
102105
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
103106
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |

Diff for: ‎modules/runner-binaries-syncer/iam.tf

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
data "aws_iam_policy_document" "lambda_xray" {
2+
count = var.lambda_tracing_mode != null ? 1 : 0
3+
statement {
4+
actions = [
5+
"xray:BatchGetTraces",
6+
"xray:GetTraceSummaries",
7+
"xray:PutTelemetryRecords",
8+
"xray:PutTraceSegments"
9+
]
10+
effect = "Allow"
11+
resources = [
12+
"*"
13+
]
14+
sid = "AllowXRay"
15+
}
16+
}

Diff for: ‎modules/runner-binaries-syncer/runner-binaries-syncer.tf

+12-1
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,13 @@ resource "aws_lambda_function" "syncer" {
4444
}
4545

4646
tags = var.tags
47+
48+
dynamic "tracing_config" {
49+
for_each = var.lambda_tracing_mode != null ? [true] : []
50+
content {
51+
mode = var.lambda_tracing_mode
52+
}
53+
}
4754
}
4855

4956
resource "aws_iam_role_policy" "lambda_kms" {
@@ -182,4 +189,8 @@ resource "aws_lambda_permission" "on_deploy" {
182189
source_arn = aws_s3_bucket.action_dist.arn
183190
}
184191

185-
192+
resource "aws_iam_role_policy" "syncer_lambda_xray" {
193+
count = var.lambda_tracing_mode != null ? 1 : 0
194+
policy = data.aws_iam_policy_document.lambda_xray[0].json
195+
role = aws_iam_role.syncer_lambda.name
196+
}

Diff for: ‎modules/runner-binaries-syncer/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -241,3 +241,9 @@ variable "lambda_architecture" {
241241
error_message = "`lambda_architecture` value is not valid, valid values are: `arm64` and `x86_64`."
242242
}
243243
}
244+
245+
variable "lambda_tracing_mode" {
246+
description = "Enable X-Ray tracing for the lambda functions."
247+
type = string
248+
default = null
249+
}

Diff for: ‎modules/runners/README.md

+4
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,10 @@ yarn run dist
9292
| [aws_iam_role_policy.runner_session_manager_aws_managed](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
9393
| [aws_iam_role_policy.scale_down](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
9494
| [aws_iam_role_policy.scale_down_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
95+
| [aws_iam_role_policy.scale_down_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
9596
| [aws_iam_role_policy.scale_up](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
9697
| [aws_iam_role_policy.scale_up_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
98+
| [aws_iam_role_policy.scale_up_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
9799
| [aws_iam_role_policy.service_linked_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
98100
| [aws_iam_role_policy.ssm_parameters](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
99101
| [aws_iam_role_policy_attachment.ami_id_ssm_parameter_read](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -115,6 +117,7 @@ yarn run dist
115117
| [aws_ami.runner](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
116118
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
117119
| [aws_iam_policy_document.lambda_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
120+
| [aws_iam_policy_document.lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
118121

119122
## Inputs
120123

@@ -161,6 +164,7 @@ yarn run dist
161164
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the lambda will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
162165
| <a name="input_lambda_timeout_scale_down"></a> [lambda\_timeout\_scale\_down](#input\_lambda\_timeout\_scale\_down) | Time out for the scale down lambda in seconds. | `number` | `60` | no |
163166
| <a name="input_lambda_timeout_scale_up"></a> [lambda\_timeout\_scale\_up](#input\_lambda\_timeout\_scale\_up) | Time out for the scale up lambda in seconds. | `number` | `60` | no |
167+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
164168
| <a name="input_lambda_zip"></a> [lambda\_zip](#input\_lambda\_zip) | File location of the lambda zip file. | `string` | `null` | no |
165169
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
166170
| <a name="input_log_type"></a> [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no |

Diff for: ‎modules/runners/policies-lambda-common.tf

+17
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,20 @@ resource "aws_iam_policy" "ami_id_ssm_parameter_read" {
3131
}
3232
JSON
3333
}
34+
35+
data "aws_iam_policy_document" "lambda_xray" {
36+
count = var.lambda_tracing_mode != null ? 1 : 0
37+
statement {
38+
actions = [
39+
"xray:BatchGetTraces",
40+
"xray:GetTraceSummaries",
41+
"xray:PutTelemetryRecords",
42+
"xray:PutTraceSegments"
43+
]
44+
effect = "Allow"
45+
resources = [
46+
"*"
47+
]
48+
sid = "AllowXRay"
49+
}
50+
}

Diff for: ‎modules/runners/pool.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ module "pool" {
5252
tags = local.tags
5353
}
5454

55-
aws_partition = var.aws_partition
55+
aws_partition = var.aws_partition
56+
lambda_tracing_mode = var.lambda_tracing_mode
5657

5758
}

Diff for: ‎modules/runners/pool/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ No modules.
4646
|------|-------------|------|---------|:--------:|
4747
| <a name="input_aws_partition"></a> [aws\_partition](#input\_aws\_partition) | (optional) partition for the arn if not 'aws' | `string` | `"aws"` | no |
4848
| <a name="input_config"></a> [config](#input\_config) | n/a | <pre>object({<br> lambda = object({<br> log_level = string<br> logging_retention_in_days = number<br> logging_kms_key_id = string<br> reserved_concurrent_executions = number<br> s3_bucket = string<br> s3_key = string<br> s3_object_version = string<br> security_group_ids = list(string)<br> runtime = string<br> architecture = string<br> timeout = number<br> zip = string<br> subnet_ids = list(string)<br> })<br> tags = map(string)<br> ghes = object({<br> url = string<br> ssl_verify = string<br> })<br> github_app_parameters = object({<br> key_base64 = map(string)<br> id = map(string)<br> })<br> subnet_ids = list(string)<br> runner = object({<br> disable_runner_autoupdate = bool<br> ephemeral = bool<br> boot_time_in_minutes = number<br> extra_labels = string<br> launch_template = object({<br> name = string<br> })<br> group_name = string<br> name_prefix = string<br> pool_owner = string<br> role = object({<br> arn = string<br> })<br> })<br> instance_types = list(string)<br> instance_target_capacity_type = string<br> instance_allocation_strategy = string<br> instance_max_spot_price = string<br> prefix = string<br> pool = list(object({<br> schedule_expression = string<br> size = number<br> }))<br> role_permissions_boundary = string<br> kms_key_arn = string<br> ami_kms_key_arn = string<br> role_path = string<br> ssm_token_path = string<br> ami_id_ssm_parameter_name = string<br> ami_id_ssm_parameter_read_policy_arn = string<br> })</pre> | n/a | yes |
49+
| <a name="input_lambda_tracing_mode"></a> [lambda\_tracing\_mode](#input\_lambda\_tracing\_mode) | Enable X-Ray tracing for the lambda functions. | `string` | `null` | no |
4950

5051
## Outputs
5152

Diff for: ‎modules/runners/pool/main.tf

+31
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,13 @@ resource "aws_lambda_function" "pool" {
5050
subnet_ids = var.config.lambda.subnet_ids
5151
}
5252
}
53+
54+
dynamic "tracing_config" {
55+
for_each = var.lambda_tracing_mode != null ? [true] : []
56+
content {
57+
mode = var.lambda_tracing_mode
58+
}
59+
}
5360
}
5461

5562
resource "aws_cloudwatch_log_group" "pool" {
@@ -147,3 +154,27 @@ resource "aws_iam_role_policy_attachment" "ami_id_ssm_parameter_read" {
147154
role = aws_iam_role.pool.name
148155
policy_arn = var.config.ami_id_ssm_parameter_read_policy_arn
149156
}
157+
158+
# lambda xray policy
159+
data "aws_iam_policy_document" "lambda_xray" {
160+
count = var.lambda_tracing_mode != null ? 1 : 0
161+
statement {
162+
actions = [
163+
"xray:BatchGetTraces",
164+
"xray:GetTraceSummaries",
165+
"xray:PutTelemetryRecords",
166+
"xray:PutTraceSegments"
167+
]
168+
effect = "Allow"
169+
resources = [
170+
"*"
171+
]
172+
sid = "AllowXRay"
173+
}
174+
}
175+
176+
resource "aws_iam_role_policy" "pool_xray" {
177+
count = var.lambda_tracing_mode != null ? 1 : 0
178+
policy = data.aws_iam_policy_document.lambda_xray[0].json
179+
role = aws_iam_role.pool.name
180+
}

Diff for: ‎modules/runners/pool/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,9 @@ variable "aws_partition" {
6464
type = string
6565
default = "aws"
6666
}
67+
68+
variable "lambda_tracing_mode" {
69+
description = "Enable X-Ray tracing for the lambda functions."
70+
type = string
71+
default = null
72+
}

Diff for: ‎modules/runners/scale-down.tf

+13
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,13 @@ resource "aws_lambda_function" "scale_down" {
4343
subnet_ids = var.lambda_subnet_ids
4444
}
4545
}
46+
47+
dynamic "tracing_config" {
48+
for_each = var.lambda_tracing_mode != null ? [true] : []
49+
content {
50+
mode = var.lambda_tracing_mode
51+
}
52+
}
4653
}
4754

4855
resource "aws_cloudwatch_log_group" "scale_down" {
@@ -110,3 +117,9 @@ resource "aws_iam_role_policy_attachment" "scale_down_vpc_execution_role" {
110117
role = aws_iam_role.scale_down.name
111118
policy_arn = "arn:${var.aws_partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
112119
}
120+
121+
resource "aws_iam_role_policy" "scale_down_xray" {
122+
count = var.lambda_tracing_mode != null ? 1 : 0
123+
policy = data.aws_iam_policy_document.lambda_xray[0].json
124+
role = aws_iam_role.scale_down.name
125+
}

Diff for: ‎modules/runners/scale-up.tf

+13
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,13 @@ resource "aws_lambda_function" "scale_up" {
5151
subnet_ids = var.lambda_subnet_ids
5252
}
5353
}
54+
55+
dynamic "tracing_config" {
56+
for_each = var.lambda_tracing_mode != null ? [true] : []
57+
content {
58+
mode = var.lambda_tracing_mode
59+
}
60+
}
5461
}
5562

5663
resource "aws_cloudwatch_log_group" "scale_up" {
@@ -130,3 +137,9 @@ resource "aws_iam_role_policy_attachment" "ami_id_ssm_parameter_read" {
130137
role = aws_iam_role.scale_up.name
131138
policy_arn = aws_iam_policy.ami_id_ssm_parameter_read[0].arn
132139
}
140+
141+
resource "aws_iam_role_policy" "scale_up_xray" {
142+
count = var.lambda_tracing_mode != null ? 1 : 0
143+
policy = data.aws_iam_policy_document.lambda_xray[0].json
144+
role = aws_iam_role.scale_up.name
145+
}

0 commit comments

Comments
 (0)