Setting the file. One moment.
Subchapter 37.25
references/cloudwatch/appsignals-guides/lambda-dotnet.mdMarkdown5 KBView on GitHub
Your task is to modify Infrastructure as Code (IaC) files to enable AWS Application Signals for .NET Lambda functions. You will:
If you cannot determine a value (such as AWS Region): Ask the user for clarification before proceeding. Do not guess or make up values.
The ADOT Lambda layer ARN is region-specific, and its layer version changes over time. Do not hardcode a version from this guide — look up the current value from the source of truth, which lists all supported regions and the latest layer version:
ARN format — fill in <REGION> and <LAYER_VERSION> (the latest version for that region from the source above):
arn:aws:lambda:<REGION>:<ACCOUNT_ID>:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>A few sample regions (illustrative — confirm the current <LAYER_VERSION> and account ID from the source of truth, and use it for any supported region, not just these):
us-east-1: arn:aws:lambda:us-east-1:615299751070:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
us-west-2: arn:aws:lambda:us-west-2:615299751070:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
ca-central-1: arn:aws:lambda:ca-central-1:615299751070:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
ap-east-1: arn:aws:lambda:ap-east-1:888577020596:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
ap-southeast-1: arn:aws:lambda:ap-southeast-1:615299751070:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
eu-west-1: arn:aws:lambda:eu-west-1:615299751070:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
eu-south-1: arn:aws:lambda:eu-south-1:257394471194:layer:AWSOpenTelemetryDistroDotNet:<LAYER_VERSION>
...Note: some partitions use a different ARN prefix and account ID (
arn:aws-cn:for China,arn:aws-us-gov:for GovCloud). The source of truth has the exact ARN for every supported region.
Add CloudWatchLambdaApplicationSignalsExecutionRolePolicy to the Lambda function’s execution role.
Which policy, and when it applies.
CloudWatchLambdaApplicationSignalsExecutionRolePolicyis the purpose-built managed policy for this configuration — Application Signals enabled on Lambda — and it is genuinely scoped rather than broad: itslogs:actions are limited toarn:aws:logs:*:*:log-group:/aws/application-signals/data:*, and both of its statements are conditioned onaws:ResourceAccountmatchingaws:PrincipalAccount. It is the right grant here.Do not carry it over to the ADOT-SDK-only path where Application Signals is disabled: the
setting-up-cloudwatch-observabilityskill’sreferences/cloudwatch-omni/instrumentation/instrumentation.mdstates it is out of scope there. That path grants the execution rolexray:PutTraceSegmentsandxray:PutTelemetryRecords— usually via theAWSXRayDaemonWriteAccessmanaged policy (or the inline grant CDK adds whentracingis enabled); the two-action inline form is the optional least-privilege alternative, not the default. Note the two policies are not interchangeable in either direction: this one does not grantxray:PutTelemetryRecords, so it is not a superset of the ADOT-only grant. Say which of the two setups this change is for, since the correct IAM differs.
CDK: tracing: lambda.Tracing.ACTIVE
Terraform: tracing_config { mode = "Active" }
Use the layer name AWSOpenTelemetryDistroDotNet with automatic region detection. See Region-Specific Layer ARNs section above for complete mapping.
Add AWS_LAMBDA_EXEC_WRAPPER = "/opt/otel-instrument".
Tell the user:
“I’ve completed the Application Signals enablement for your .NET Lambda function.
Configuration Changes:
Next Steps:
git diffVerification:
Troubleshooting Refer to the CloudWatch APM troubleshooting guide (opens in a new tab).
Let me know if you’d like me to make any adjustments before you deploy!”