Terraform configuration to enable X-Ray for a Lambda function

lambda-function-xray-enablement.tf

resource "aws_lambda_function" "service" {
  # Your usual aws_lambda_function configuration settings here

  tracing_config {
    mode = "Active"
  }
}

Note that you might have to add this policy block into the IAM role that this lambda runs with:

        {
            "Effect": "Allow",
            "Action": [
                "xray:PutTraceSegments",
                "xray:PutTelemetryRecords",
                "xray:GetSamplingRules",
                "xray:GetSamplingTargets",
                "xray:GetSamplingStatisticSummaries"
            ],
            "Resource": [
                "*"
            ]
        }

This is coming from this documentation page

Also an IAM option for the above

data "aws_iam_policy" "aws_xray_write_only_access" {
  arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
}

This was super useful, thanks everyone!
Just to add to the party:

data "aws_iam_policy" "aws_xray_write_only_access" {
  arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
}
resource "aws_iam_role_policy_attachment" "aws_xray_write_only_access" {
  role       = "${aws_iam_role.lambda.name}"
  policy_arn = "${data.aws_iam_policy.aws_xray_write_only_access.arn}"
}

or even shorter way

resource "aws_iam_role_policy_attachment" "aws_xray_write_only_access" {
  role       = aws_iam_role.lambda.name
  policy_arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
}

Hi, not sure if anyone's run into this situation where if you remove that tracing_config block, tracing is still turned on?

This is the newer version of the managed policy:

data "aws_iam_policy" "lambda_xray" {
  name = "AWSXRayDaemonWriteAccess"
}

with the suggegsted code:

resource "aws_lambda_function" "service" {
  tracing_config {
    mode = "Active"
  }
}

I got only the last Log containing the X-Ray-data but not all Logs, my wish is that all logs of the lambda contains the xray-trace-id did someone have a solution?

Hi, not sure if anyone's run into this situation where if you remove that tracing_config block, tracing is still turned on?

yes me also. I had to change it to "PassThrough" to turn it of. I'm not sure if this is the right workaround.