Skip to main content

🛡️ AWS Lambda Function X-Ray Tracing is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Lambda functions that do not have active tracing with AWS X-Ray enabled. When enabled, Lambda sends trace data to X-Ray for all incoming requests, allowing you to visualize the complete lifecycle of a request as it flows through your function and other integrated AWS services.

Rationale​

Enabling X-Ray tracing provides a detailed view of your serverless application’s execution, including latency within the Lambda function and calls to downstream services. This visibility helps identify the root cause of errors, timeouts, or performance bottlenecks by showing where failures occur in the request chain. Tracing also reveals service interactions and unintended dependencies, enabling more effective debugging and performance optimization.

Audit​

This policy flags an AWS Lambda Function as INCOMPLIANT if the Tracing Config Response Mode field is set to PassThrough.

Remediation​

Open File

Remediation​

Enable Active X-Ray Tracing​

Active tracing allows Lambda to send trace data to X-Ray for all incoming requests, providing full visibility into request execution and interactions with downstream services.

From Command Line​

  1. Ensure the Lambda function has permission to upload trace data to X-Ray. Attach the AWSXRayDaemonWriteAccess managed IAM policy to the function's execution role:

    aws iam attach-role-policy \
        --role-name {{function-execution-role}} \
        --policy-arn "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"

  2. Enable active tracing on the Lambda function:

    aws lambda update-function-configuration \
        --function-name {{function-name}} \
        --tracing-config Mode=Active

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 Cloudaware Framework → 💼 System Configuration69no data
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)227no data
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)127no data
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)227no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities50no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources65no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events178no data
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events27no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events100no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events50no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events179no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations45no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties59no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities60no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded46no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked49no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring627no data