Lambda Functions Should Have Tracing Enabled

Using Console

To remediate the misconfiguration “Lambda Functions Should Have Tracing Enabled” for AWS using the AWS console, follow the below steps:

Open the AWS Lambda console.
Select the Lambda function for which you want to enable tracing.
Click on the “Configuration” tab.
Scroll down to the “Debugging and error handling” section.
Under “Debugging and error handling”, click on the “Edit” button.
In the “Edit function” page, scroll down to the “Tracing” section.
Under “Tracing”, select the “Active” option.
In the “Tracing mode” drop-down, select the “AWS X-Ray” option.
Click on the “Save” button at the top of the page to save the changes.

Once the above steps are completed, tracing will be enabled for the selected Lambda function in AWS.

Using CLI

To remediate the misconfiguration of Lambda Functions not having tracing enabled in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine or EC2 instance.
Run the following command to enable tracing on all Lambda functions in the AWS account:

aws lambda update-function-configuration --tracing-config Mode=Active

If you want to enable tracing only on specific Lambda functions, run the following command:

aws lambda update-function-configuration --function-name <function-name> --tracing-config Mode=Active

Replace <function-name> with the name of the Lambda function that you want to enable tracing on.

Verify that tracing is enabled on the Lambda function by running the following command:

aws lambda get-function-configuration --function-name <function-name>

This command will return the configuration details of the Lambda function, including the tracing mode. If the tracing mode is set to “Active”, then tracing is enabled on the function.By following these steps, you can remediate the misconfiguration of Lambda Functions not having tracing enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of Lambda Functions not having tracing enabled in AWS, you can follow the below steps using Python:

Import the necessary AWS SDK libraries for Python:

import boto3

Create an AWS Lambda client object:

lambda_client = boto3.client('lambda')

List all the available Lambda functions:

functions = lambda_client.list_functions()

For each function, check if tracing is enabled or not:

for function in functions['Functions']:
    function_name = function['FunctionName']
    tracing_config = lambda_client.get_function(FunctionName=function_name)['TracingConfig']
    if tracing_config['Mode'] != 'Active':
        # Enable tracing for the function
        lambda_client.update_function_configuration(FunctionName=function_name, TracingConfig={'Mode': 'Active'})

Save the Python script and execute it to enable tracing for all the available Lambda functions.

With the above steps, you can easily remediate the misconfiguration of Lambda Functions not having tracing enabled in AWS.

Using Terraform

resource "aws_lambda_function" "THIS_FUNCTION" {
  function_name = "YOUR_FUNCTION_NAME" # replace with your Lambda function name
  role          = aws_iam_role.lambda_exec.arn
  handler       = "YOUR_HANDLER"       # e.g., "index.handler"
  runtime       = "YOUR_RUNTIME"       # e.g., "nodejs18.x"

  tracing_config {
    mode = "Active"
  }

  # ...other required arguments (filename/image_uri, etc.)
}

# Ensure the Lambda execution role can send traces to X-Ray
resource "aws_iam_role" "lambda_exec" {
  name = "YOUR_LAMBDA_EXEC_ROLE_NAME" # replace with your role name

  assume_role_policy = data.aws_iam_policy_document.lambda_trust.json
}

data "aws_iam_policy_document" "lambda_trust" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy_attachment" "lambda_xray" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
}

Changing tracing_config from PassThrough or unset to Active is an in-place update and does not replace the Lambda function, but it may incur additional AWS X-Ray costs.To verify, terraform plan should show an in-place update (~) on aws_lambda_function.THIS_FUNCTION changing tracing_config.mode to "Active" and (if newly added) creation (+) of the IAM role/policy attachment resources.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Lambda Functions Should Have Tracing Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: