AWS AmazonCloudWatch documentation change
Summary
Updated documentation to rename 'Application Signals Lambda layer' references to 'AWS Lambda Layer for OpenTelemetry' and added detailed instructions for deploying Lambda functions using Amazon ECR containers with OpenTelemetry integration
Security assessment
The changes primarily focus on rebranding terminology and adding container deployment guidance. While OpenTelemetry instrumentation supports observability, there is no evidence of addressing specific security vulnerabilities or adding explicit security features. The modifications are operational improvements rather than security fixes.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-LambdaMain.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-LambdaMain.md index e322f2d19..434fdc0f5 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-LambdaMain.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-LambdaMain.md @@ -5 +5 @@ -Getting startedUse the CloudWatch Application Signals consoleUse the Lambda consoleEnable Application Signals on Lambda using AWS CDK(Optional) Monitor your application healthManually enable Application Signals.Manually disable Application SignalsConfiguring Application SignalsApplication Signals Lambda layer ARNs +Getting startedUse the CloudWatch Application Signals consoleUse the Lambda consoleEnable Application Signals on Lambda using AWS CDK(Optional) Monitor your application healthManually enable Application Signals.Manually disable Application SignalsConfiguring Application SignalsAWS Lambda Layer for OpenTelemetry ARNsDeploy Lambda functions using Amazon ECR container @@ -9 +9 @@ Getting startedUse the CloudWatch Application Signals consoleUse the Lambda cons -You can enable Application Signals for your Lambda functions. Application Signals automatically instruments your Lambda functions using enhanced AWS Distro for OpenTelemetry (ADOT) libraries, provided through a Lambda layer. This Lambda layer packages and deploy the libraries that are required for auto-instrumentation for Application Signals. +You can enable Application Signals for your Lambda functions. Application Signals automatically instruments your Lambda functions using enhanced AWS Distro for OpenTelemetry (ADOT) libraries, provided through a Lambda layer. This AWS Lambda Layer for OpenTelemetry packages and deploys the libraries that are required for auto-instrumentation for Application Signals. @@ -12,0 +13,25 @@ In addition to supporting Application Signals, this Lambda layer is also a compo +###### Topics + + * Getting started + + * Use the CloudWatch Application Signals console + + * Use the Lambda console + + * Enable Application Signals on Lambda using AWS CDK + + * (Optional) Monitor your application health + + * Manually enable Application Signals. + + * Manually disable Application Signals + + * Configuring Application Signals + + * AWS Lambda Layer for OpenTelemetry ARNs + + * Deploy Lambda functions using Amazon ECR container + + + + @@ -23 +48 @@ After you enable Application Signals for a Lambda function, it takes a few minut - * Manually add the Application Signals layer to your Lambda function runtime. + * Manually add the AWS Lambda Layer for OpenTelemetry to your Lambda function runtime. @@ -28 +53 @@ After you enable Application Signals for a Lambda function, it takes a few minut -Each of these methods adds an AWS Distro for OpenTelemetry layer to your function. +Each of these methods adds the AWS Lambda Layer for OpenTelemetry to your function. @@ -104 +129 @@ For more information about this role, see [Service-linked role permissions for C - 3. Replace `$APPLICATION_SIGNALS_LAMBDA_LAYER_ARN` with the actual [Application Signals Lambda layer ARN](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-Lambda.html#Enable-Lambda-Layers) in the corresponding region. + 3. Replace `$AWS_LAMBDA_LAYER_FOR_OTEL_ARN` with the actual [AWS Lambda Layer for OpenTelemetry ARN](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-Lambda.html#Enable-Lambda-Layers) in the corresponding region. @@ -107,2 +132,2 @@ For more information about this role, see [Service-linked role permissions for C - this, 'ApplicationSignalsLayer', - '$APPLICATION_SIGNALS_LAMBDA_LAYER_ARN' + this, 'AwsLambdaLayerForOtel', + '$AWS_LAMBDA_LAYER_FOR_OTEL_ARN' @@ -123 +148 @@ Use these steps to manually enable Application Signals for a Lambda function. - 1. Add the AWS Lambda Layer for OpenTelemetry to your Lambda runtime. To find the layer ARN, see Application Signals Lambda layer ARNs. + 1. Add the AWS Lambda Layer for OpenTelemetry to your Lambda runtime. To find the layer ARN, see AWS Lambda Layer for OpenTelemetry ARNs. @@ -160 +185 @@ For more information , see [OpenTelemetry Environment Variable Specification](ht -**Enabling all library instrumentations** +**Enabling all library instrumentation’s** @@ -162 +187 @@ For more information , see [OpenTelemetry Environment Variable Specification](ht -To reduce Lambda cold starts, by default, only AWS SDK and HTTP instrumentations are enabled for Python, Node, and Java. You can set environment variables to enable instrumentation for other libraries used in your Lambda function. +To reduce Lambda cold starts, by default, only AWS SDK and HTTP instrumentation’s are enabled for Python, Node, and Java. You can set environment variables to enable instrumentation for other libraries used in your Lambda function. @@ -173 +198 @@ To reduce Lambda cold starts, by default, only AWS SDK and HTTP instrumentations -## Application Signals Lambda layer ARNs +## AWS Lambda Layer for OpenTelemetry ARNs @@ -175 +200 @@ To reduce Lambda cold starts, by default, only AWS SDK and HTTP instrumentations -The following tables lists the ARNs to use for the Application Signals Lambda layer for each Region where it's supported. +The following tables list the ARNs to use the AWS Lambda Layer for OpenTelemetry for each Region where it's supported. @@ -222 +247 @@ Asia Pacific (Hong Kong) | `arn:aws:lambda:ap-east-1:888577020596:layer:AWSOpen -Asia Pacific (Hyderabad) | `"arn:aws:lambda:ap-south-2:796973505492:layer:AWSOpenTelemetryDistroJs:6` +Asia Pacific (Hyderabad) | `arn:aws:lambda:ap-south-2:796973505492:layer:AWSOpenTelemetryDistroJs:6` @@ -312,0 +338,715 @@ South America (São Paulo) | `arn:aws:lambda:sa-east-1:615299751070:layer:AWSOp +## Deploy Lambda functions using Amazon ECR container + +Lambda functions deployed as container images do not support Lambda Layers in the traditional way. When using container images, you cannot attach a layer as you would with other Lambda deployment methods. Instead, you must manually incorporate the layer’s contents into your container image during the build process. + +Java + + +You can learn how to integrate the AWS Lambda Layer for OpenTelemetry into your containerized Java Lambda function, download the `layer.zip` artifact, and integrate it into your Java Lambda function container to enable Application Signals monitoring. + +**Prerequisites** + + * AWS CLI configured with your credentials + + * Docker installed + + * These instructions assume you are on x86_64 platform + + + + + 1. **Set Up Project Structure** + +Create a directory for your Lambda function + + mkdir java-appsignals-container-lambda && \ + cd java-appsignals-container-lambda + +Create a Maven project structure + + mkdir -p src/main/java/com/example/java/lambda + mkdir -p src/main/resources + + 2. **Create Dockerfile** + +Download and integrate the OpenTelemetry Layer with Application Signals support directly into your Lambda container image. To do this, the `Dockerfile` file is created. + + FROM public.ecr.aws/lambda/java:21 + + # Install utilities + RUN dnf install -y unzip wget maven + + # Download the OpenTelemetry Layer with AppSignals Support + RUN wget https://github.com/aws-observability/aws-otel-java-instrumentation/releases/latest/download/layer.zip -O /tmp/layer.zip + + # Extract and include Lambda layer contents + RUN mkdir -p /opt && \ + unzip /tmp/layer.zip -d /opt/ && \ + chmod -R 755 /opt/ && \ + rm /tmp/layer.zip + + # Copy and build function code + COPY pom.xml ${LAMBDA_TASK_ROOT} + COPY src ${LAMBDA_TASK_ROOT}/src + RUN mvn clean package -DskipTests + + # Copy the JAR file to the Lambda runtime directory (from inside the container) + RUN mkdir -p ${LAMBDA_TASK_ROOT}/lib/ + RUN cp ${LAMBDA_TASK_ROOT}/target/function.jar ${LAMBDA_TASK_ROOT}/lib/ + + # Set the handler + CMD ["com.example.java.lambda.App::handleRequest"] + +###### Note + +The `layer.zip` file contains the OpenTelemetry instrumentation necessary for AWS Application Signals support to monitor your Lambda function. + +The layer extraction steps ensures: + + * The layer.zip contents are properly extracted to the `/opt/ directory` + + * The `otel-instrument` script receives proper execution permissions + + * The temporary layer.zip file is removed to keep the image size smaller + + 3. **Lambda function code** – Create a Java file for your Lambda handler at `src/main/java/com/example/lambda/App.java:` + +Your project should look something like: + + . + ├── Dockerfile + ├── pom.xml + └── src + └── main + ├── java + │ └── com + │ └── example + │ └── java + │ └── lambda + │ └── App.java + └── resources + + 4. **Build and deploy the container image** + +**Set up environment variables** + + AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) + AWS_REGION=$(aws configure get region) + + # For fish shell users: + # set AWS_ACCOUNT_ID (aws sts get-caller-identity --query Account --output text) + # set AWS_REGION (aws configure get region) + +**Authenticate with ECR** + +First with public ECR (for base image): + + aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws + +Then with your private ECR: + + aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com + +**Build, tag and push your image** + + # Build the Docker image + docker build -t lambda-appsignals-demo . + + # Tag the image + docker tag lambda-appsignals-demo:latest $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/lambda-appsignals-demo:latest + + # Push the image + docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/lambda-appsignals-demo:latest + + 5. **Create and configure the Lambda function** + +Create a new function using the Lambda console. + +Select **Container image** as the deployment option. + +Choose **Browse images** to select your Amazon ECR image. +