X-Ray
AWS X-Ray records traces: the path of one request through the services it touches, with timing for each hop. In the platform, the ETL trigger Lambda emits traces, and the AWS Baseline shares every account's traces with the security account.
What it does
An instrumented service sends X-Ray segments for each request it handles: how long it took, which downstream calls it made (S3, Glue, HTTP), and whether they failed. X-Ray stitches segments into a trace and draws a service map. Lambda supports it with one setting, active tracing, which samples invocations and records the calls the SDK makes.
How BuiltForProd uses it
There are two places where X-Ray appears in the code.
The ETL trigger. The lambda module in acme-aws-blueprint-etl-infra sets tracing_mode = "Active" on acme-usw2-dev-etl-trigger. Every sampled invocation records the S3 event handling and the StartJobRun call to Glue, so a slow or failing hand-off shows up as a trace segment rather than a log line to hunt for. The registry module attaches the permissions the function needs to write trace segments and telemetry.
Cross-account sharing. The observability module in the AWS Baseline creates a CloudWatch Observability Access Manager (OAM) sink in the security account and a link from the management, audit, network and workload accounts. The link's resource types are AWS::CloudWatch::Metric, AWS::Logs::LogGroup and AWS::XRay::Trace, and the sink policy accepts links only from accounts in the organization. Traces from the ETL Lambda in a platform account are therefore visible in the security account's X-Ray console without anyone signing in to the platform account.
The web application does not instrument X-Ray. Its observability is structured JSON logs with request ids shipped by Fluent Bit, which is a different explainer.
Terms you will see
| Term | Meaning |
|---|---|
| Trace | The full record of one request across services. |
| Segment | The part of a trace recorded by one service, such as the Lambda invocation. |
| Active tracing | The Lambda setting that turns X-Ray on for a function. |
| Sampling | X-Ray records a share of requests, not every one. |
| Service map | The diagram X-Ray builds from traces, showing calls between services. |
Where to read more
- AWS Baseline overview
- CloudWatch OAM for the sink and links
- Lambda for the traced function
- Fluent Bit for application logs