Enable Lambda X-Ray on all functions via AWS CLI

enable-xray.sh

#!/bin/bash
fns=($(aws lambda list-functions --query "Functions[].FunctionName" --output text))
GrantWrite () {
aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess --role-name $(ROLE=$(aws lambda get-function --function-name $1 --query "Configuration.Role" --output text);echo ${ROLE##*/})
}
XRay () {
  aws lambda update-function-configuration --function-name $1 --tracing-config Mode=Active >/dev/null && echo $1 OK || (GrantWrite $1; aws lambda update-function-configuration --function-name $1 --tracing-config Mode=Active > /dev/null && echo $1 OK || echo $1 FAILED)
}
for f in ${fns[@]}; do XRay $f; done

Seems like it's missing some kind of "wait state" between the grant and the lambda update, as the permissions don't get propagated to the lambdas right away, but if you just wait (or run the script twice) it succeeds, otherwise you get errors like:

An error occurred (InvalidParameterValueException) when calling the UpdateFunctionConfiguration operation: The provided execution role does not have permissions to call PutTraceSegments on XRAY

@gvasquez-waypoint I agree, IAM can have a slight lag on associate policy