AWS lambda documentation change
Summary
Added documentation about default PassThrough tracing behavior, clarified Active vs PassThrough modes, and updated section headers with proper casing/formatting
Security assessment
Changes focus on operational tracing configuration details rather than addressing security vulnerabilities. The new content explains tracing modes and default behaviors without mentioning security controls, vulnerabilities, or access policies.
Diff
diff --git a/lambda/latest/dg/services-xray.md b/lambda/latest/dg/services-xray.md index 4d66a6c73..b0f4e1264 100644 --- a//lambda/latest/dg/services-xray.md +++ b//lambda/latest/dg/services-xray.md @@ -5 +5 @@ -Understanding X-Ray tracesExecution role permissionsEnabling active tracing with the Lambda APIEnabling active tracing with AWS CloudFormation +Understanding X-Ray tracesDefault tracing behavior in LambdaExecution role permissionsEnabling Active tracing with the Lambda APIEnabling Active tracing with AWS CloudFormation @@ -11 +11 @@ You can use AWS X-Ray to visualize the components of your application, identify -If you've enabled X-Ray tracing in a service that invokes your function, Lambda sends traces to X-Ray automatically. The upstream service, such as Amazon API Gateway, or an application hosted on Amazon EC2 that is instrumented with the X-Ray SDK, samples incoming requests and adds a tracing header that tells Lambda to send traces or not. Traces from upstream message producers, such as Amazon SQS, are automatically linked to traces from downstream Lambda functions, creating an end-to-end view of the entire application. For more information, see [Tracing event-driven applications](https://docs.aws.amazon.com/xray/latest/devguide/xray-tracelinking.html) in the _AWS X-Ray Developer Guide_. +Lambda supports two tracing modes for X-Ray: `Active` and `PassThrough`. With `Active` tracing, Lambda automatically creates trace segments for function invocations and sends them to X-Ray. `PassThrough` mode, on the other hand, simply propagates the tracing context to downstream services. If you've enabled `Active` tracing for your function, Lambda automatically sends traces to X-Ray for sampled requests. Typically, an upstream service, such as Amazon API Gateway or an application hosted on Amazon EC2 that is instrumented with the X-Ray SDK, decides whether incoming requests should be traced, then adds that sampling decision as a tracing header. Lambda uses that header to decide to send traces or not. Traces from upstream message producers, such as Amazon SQS, are automatically linked to traces from downstream Lambda functions, creating an end-to-end view of the entire application. For more information, see [Tracing event-driven applications](https://docs.aws.amazon.com/xray/latest/devguide/xray-tracelinking.html) in the _AWS X-Ray Developer Guide_. @@ -137,0 +138,10 @@ For a full list of services that support active instrumentation, see [Supported +## Default tracing behavior in Lambda + +If you do not have `Active` tracing turned on, Lambda defaults to `PassThrough` tracing mode. + +In `PassThrough` mode, Lambda forwards the X-Ray tracing header to downstream services, but does not send traces automatically. This is true even if the tracing header contains a decision to sample the request. If the upstream service does not provide an X-Ray tracing header, Lambda generates a header and makes the decision not to sample. However, you can send your own traces by calling tracing libraries from your function code. + +###### Note + +Previously, Lambda would send traces automatically when upstream services, such as Amazon API Gateway, added a tracing header. By not sending traces automatically, Lambda gives you the control to trace the functions that are important to you. If your solution depends on this passive tracing behavior, switch to `Active` tracing. + @@ -151 +161 @@ These permissions are included in the [AWSXRayDaemonWriteAccess](https://console -## Enabling active tracing with the Lambda API +## Enabling `Active` tracing with the Lambda API @@ -172 +182 @@ Tracing mode is part of the version-specific configuration when you publish a ve -## Enabling active tracing with AWS CloudFormation +## Enabling `Active` tracing with AWS CloudFormation