Project: KICS (Provisioning / Security & Compliance)
File: 9488c451-074e-4cd3-aee3-7db6104f542c.md

title: Lambda Functions Without X-Ray Tracing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9488c451-074e-4cd3-aee3-7db6104f542c Query name: Lambda Functions Without X-Ray Tracing Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: AWS Lambda functions should have TracingConfig enabled. For this, property 'tracingConfig.mode' should have the value 'Active'<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="37" AWSTemplateFormatVersion: '2010-09-09' Description: Lambda function with cfn-response. Resources: primer: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Code: ZipFile: | var aws = require('aws-sdk') var response = require('cfn-response') exports.handler = function(event, context) { console.log("REQUEST RECEIVED:\n" + JSON.stringify(event)) // For Delete requests, immediately send a SUCCESS response. if (event.RequestType == "Delete") { response.send(event, context, "SUCCESS") return } var responseStatus = "FAILED" var responseData = {} var functionName = event.ResourceProperties.FunctionName var lambda = new aws.Lambda() lambda.invoke({ FunctionName: functionName }, function(err, invokeResult) { if (err) { responseData = {Error: "Invoke call failed"} console.log(responseData.Error + ":\n", err) } else responseStatus = "SUCCESS" response.send(event, context, responseStatus, responseData) }) } Description: Invoke a function during stack creation. TracingConfig: Mode: PassThrough ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="4" Resources: Function: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: nodejs12.x Timeout: 5 VpcConfig: SecurityGroupIds: sg-085912345678492fb SubnetIds: subnet-071f712345678e7c8 subnet-07fd123456788a036 ``` ```json title="Positive test num. 3 - json file" hl_lines="16" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Lambda function with cfn-response.", "Resources": { "primer": { "Type": "AWS::Lambda::Function", "Properties": { "Runtime": "nodejs12.x", "Role": "arn:aws:iam::123456789012:role/lambda-role", "Handler": "index.handler", "Code": { "ZipFile": "var aws = require('aws-sdk')\nvar response = require('cfn-response')\nexports.handler = function(event, context) {\n console.log(\"REQUEST RECEIVED:\\n\" + JSON.stringify(event))\n // For Delete requests, immediately send a SUCCESS response.\n if (event.RequestType == \"Delete\") {\n response.send(event, context, \"SUCCESS\")\n return\n }\n var responseStatus = \"FAILED\"\n var responseData = {}\n var functionName = event.ResourceProperties.FunctionName\n var lambda = new aws.Lambda()\n lambda.invoke({ FunctionName: functionName }, function(err, invokeResult) {\n if (err) {\n responseData = {Error: \"Invoke call failed\"}\n console.log(responseData.Error + \":\\n\", err)\n }\n else responseStatus = \"SUCCESS\"\n

context, responseStatus, responseData)\n })\n}\n" }, "Description": "Invoke a function during stack creation.", "TracingConfig": { "Mode": "PassThrough" } } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="4" { "Resources": { "Function": { "Properties": { "Timeout": 5, "VpcConfig": { "SecurityGroupIds": [ "sg-085912345678492fb" ], "SubnetIds": [ "subnet-071f712345678e7c8", "subnet-07fd123456788a036" ] }, "Handler": "index.handler", "Role": "arn:aws:iam::123456789012:role/lambda-role", "Code": { "S3Bucket": "my-bucket", "S3Key": "function.zip" }, "Runtime": "nodejs12.x" }, "Type": "AWS::Lambda::Function" } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Description: Lambda function with cfn-response. Resources: primer: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Code: ZipFile: | var aws = require('aws-sdk') var response = require('cfn-response') exports.handler = function(event, context) { console.log("REQUEST RECEIVED:\n" + JSON.stringify(event)) // For Delete requests, immediately send a SUCCESS response. if (event.RequestType == "Delete") { response.send(event, context, "SUCCESS") return } var responseStatus = "FAILED" var responseData = {} var functionName = event.ResourceProperties.FunctionName var lambda = new aws.Lambda() lambda.invoke({ FunctionName: functionName }, function(err, invokeResult) { if (err) { responseData = {Error: "Invoke call failed"} console.log(responseData.Error + ":\n", err) } else responseStatus = "SUCCESS" response.send(event, context, responseStatus, responseData) }) } Description: Invoke a function during stack creation. TracingConfig: Mode: Active ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Lambda function with cfn-response.", "Resources": { "primer": { "Type": "AWS::Lambda::Function", "Properties": { "TracingConfig": { "Mode": "Active" }, "Runtime": "nodejs12.x", "Role": "arn:aws:iam::123456789012:role/lambda-role", "Handler": "index.handler", "Code": { "ZipFile": "var aws = require('aws-sdk')\nvar response = require('cfn-response')\nexports.handler = function(event, context) {\n console.log(\"REQUEST RECEIVED:\\n\" + JSON.stringify(event))\n // For Delete requests, immediately send a SUCCESS response.\n if (event.RequestType == \"Delete\") {\n response.send(event, context, \"SUCCESS\")\n return\n }\n var responseStatus = \"FAILED\"\n var responseData = {}\n var functionName = event.ResourceProperties.FunctionName\n var lambda = new aws.Lambda()\n lambda.invoke({ FunctionName: functionName }, function(err, invokeResult) {\n if (err) {\n responseData = {Error: \"Invoke call failed\"}\n console.log(responseData.Error + \":\\n\", err)\n }\n else responseStatus = \"SUCCESS\"\n response.send(event, context, responseStatus, responseData)\n })\n}\n" }, "Description": "Invoke a function during stack creation." } } } } ```