Setting the file. One moment.
Subchapter 37.28
references/cloudwatch/appsignals-guides/lambda-python.mdMarkdown7 KBView on GitHub
Your task is to modify Infrastructure as Code (IaC) files to enable AWS Application Signals for Python Lambda functions. You will:
If you cannot determine a value (such as AWS Region): Ask the user for clarification before proceeding. Do not guess or make up values.
The ADOT Lambda layer ARN is region-specific, and its layer version changes over time. Do not hardcode a version from this guide — look up the current value from the source of truth, which lists all supported regions and the latest layer version:
ARN format — fill in <REGION> and <LAYER_VERSION> (the latest version for that region from the source above):
arn:aws:lambda:<REGION>:<ACCOUNT_ID>:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>A few sample regions (illustrative — confirm the current <LAYER_VERSION> and account ID from the source of truth, and use it for any supported region, not just these):
us-east-1: arn:aws:lambda:us-east-1:615299751070:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
us-west-2: arn:aws:lambda:us-west-2:615299751070:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
ca-central-1: arn:aws:lambda:ca-central-1:615299751070:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
ap-east-1: arn:aws:lambda:ap-east-1:888577020596:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
ap-southeast-1: arn:aws:lambda:ap-southeast-1:615299751070:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
eu-west-1: arn:aws:lambda:eu-west-1:615299751070:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
eu-south-1: arn:aws:lambda:eu-south-1:257394471194:layer:AWSOpenTelemetryDistroPython:<LAYER_VERSION>
...Note: some partitions use a different ARN prefix and account ID (
arn:aws-cn:for China,arn:aws-us-gov:for GovCloud). The source of truth has the exact ARN for every supported region.
Add the AWS managed policy CloudWatchLambdaApplicationSignalsExecutionRolePolicy to the Lambda function’s execution role.
Which policy, and when it applies.
CloudWatchLambdaApplicationSignalsExecutionRolePolicyis the purpose-built managed policy for this configuration — Application Signals enabled on Lambda — and it is genuinely scoped rather than broad: itslogs:actions are limited toarn:aws:logs:*:*:log-group:/aws/application-signals/data:*, and both of its statements are conditioned onaws:ResourceAccountmatchingaws:PrincipalAccount. It is the right grant here.Do not carry it over to the ADOT-SDK-only path where Application Signals is disabled: the
setting-up-cloudwatch-observabilityskill’sreferences/cloudwatch-omni/instrumentation/instrumentation.mdstates it is out of scope there. That path grants the execution rolexray:PutTraceSegmentsandxray:PutTelemetryRecords— usually via theAWSXRayDaemonWriteAccessmanaged policy (or the inline grant CDK adds whentracingis enabled); the two-action inline form is the optional least-privilege alternative, not the default. Note the two policies are not interchangeable in either direction: this one does not grantxray:PutTelemetryRecords, so it is not a superset of the ADOT-only grant. Say which of the two setups this change is for, since the correct IAM differs.
CDK:
const role = new iam.Role(this, 'LambdaRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchLambdaApplicationSignalsExecutionRolePolicy'),
],
});Terraform:
resource "aws_iam_role_policy_attachment" "application_signals" {
role = aws_iam_role.lambda_role.name
policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaApplicationSignalsExecutionRolePolicy"
}CloudFormation:
ManagedPolicyArns:
- arn:aws:iam::aws:policy/CloudWatchLambdaApplicationSignalsExecutionRolePolicyCDK:
const myFunction = new lambda.Function(this, 'MyFunction', {
tracing: lambda.Tracing.ACTIVE,
});Terraform:
resource "aws_lambda_function" "my_function" {
tracing_config {
mode = "Active"
}
}CloudFormation:
TracingConfig:
Mode: ActiveUse the layer name AWSOpenTelemetryDistroPython with automatic region detection.
CDK:
const layerArns: { [region: string]: string } = {
// ... (see Region-Specific Layer ARNs section above for complete mapping)
};
const myFunction = new lambda.Function(this, 'MyFunction', {
layers: [
lambda.LayerVersion.fromLayerVersionArn(this, 'AdotLayer', layerArns[this.region]),
],
});Terraform:
locals {
layer_arns = {
// ... (see Region-Specific Layer ARNs section above for complete mapping)
}
}
data "aws_region" "current" {}
resource "aws_lambda_function" "my_function" {
layers = [local.layer_arns[data.aws_region.current.name]]
}Add AWS_LAMBDA_EXEC_WRAPPER environment variable with value /opt/otel-instrument.
CDK:
environment: {
AWS_LAMBDA_EXEC_WRAPPER: '/opt/otel-instrument',
},Terraform:
environment {
variables = {
AWS_LAMBDA_EXEC_WRAPPER = "/opt/otel-instrument"
}
}Tell the user:
“I’ve completed the Application Signals enablement for your Python Lambda function.
Configuration Changes:
Next Steps:
git diffVerification:
Troubleshooting Refer to the CloudWatch APM troubleshooting guide (opens in a new tab).
Let me know if you’d like me to make any adjustments before you deploy!”