Find Lambda Functions Without X-Ray Tracing Enabled

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListFunctions",
      "Effect": "Allow",
      "Action": "lambda:ListFunctions",
      "Resource": "*"
    },
    {
      "Sid": "SimulateExecutionRoles",
      "Effect": "Allow",
      "Action": "iam:SimulatePrincipalPolicy",
      "Resource": "arn:aws:iam::123456789012:role/*"
    },
    {
      "Sid": "EnableTracingWithApply",
      "Effect": "Allow",
      "Action": "lambda:UpdateFunctionConfiguration",
      "Resource": "arn:aws:lambda:*:123456789012:function:*"
    }
  ]
}

// find-lambda-functions-without-tracing.ts
// Lists Lambda functions whose X-Ray tracing mode is PassThrough, and functions with Active tracing
// whose execution role can't write traces. Report only unless you pass --apply with --names: then it
// sets TracingConfig Mode=Active on the named functions whose role already allows the X-Ray writes.
// Usage:
//   npx tsx find-lambda-functions-without-tracing.ts [--regions us-east-1,eu-west-1]
//   npx tsx find-lambda-functions-without-tracing.ts --regions us-east-1 --names orders-api,checkout --apply
import { IAMClient, SimulatePrincipalPolicyCommand } from "@aws-sdk/client-iam";
import { LambdaClient, UpdateFunctionConfigurationCommand, paginateListFunctions } from "@aws-sdk/client-lambda";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const list = (v: string | undefined) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
const regions = list(flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1");
const names = new Set(list(flag("--names")));
const apply = args.includes("--apply");
const XRAY_ACTIONS = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"];

interface Row {
  Region: string;
  Function: string;
  Runtime: string;
  Tracing: string;
  RoleCanTrace: string;
  Result: string;
}

const iam = new IAMClient({ region: process.env.AWS_REGION ?? "us-east-1" });
const roleCache = new Map<string, string>();

// Asks the IAM policy simulator whether the execution role allows both X-Ray write actions.
async function roleCanTrace(roleArn: string): Promise<string> {
  const cached = roleCache.get(roleArn);
  if (cached) return cached;
  let answer: string;
  try {
    const res = await iam.send(new SimulatePrincipalPolicyCommand({ PolicySourceArn: roleArn, ActionNames: XRAY_ACTIONS, ResourceArns: ["*"] }));
    const denied = (res.EvaluationResults ?? []).filter((r) => r.EvalDecision !== "allowed").map((r) => r.EvalActionName);
    answer = denied.length === 0 ? "yes" : `no (${denied.join(", ")})`;
  } catch (err) {
    answer = `unknown (${err instanceof Error ? err.name : String(err)})`;
  }
  roleCache.set(roleArn, answer);
  return answer;
}

async function scanRegion(region: string, rows: Row[]): Promise<void> {
  const lambda = new LambdaClient({ region });
  for await (const page of paginateListFunctions({ client: lambda }, {})) {
    for (const fn of page.Functions ?? []) {
      const name = fn.FunctionName ?? "?";
      const mode = fn.TracingConfig?.Mode ?? "PassThrough";
      const role = fn.Role ? await roleCanTrace(fn.Role) : "unknown (no role)";
      if (mode === "Active" && role === "yes") continue; // traced and able to write: nothing to report
      const row: Row = {
        Region: region,
        Function: name,
        Runtime: fn.Runtime ?? fn.PackageType ?? "?",
        Tracing: mode,
        RoleCanTrace: role,
        Result: mode === "Active" ? "Active, but the role can't write traces" : "",
      };
      if (apply && mode !== "Active" && names.has(name)) {
        if (role !== "yes") {
          row.Result = "skipped: add AWSXRayDaemonWriteAccess to the role first";
        } else {
          try {
            await lambda.send(new UpdateFunctionConfigurationCommand({ FunctionName: name, TracingConfig: { Mode: "Active" } }));
            row.Result = "set to Active";
          } catch (err) {
            row.Result = `error: ${err instanceof Error ? err.name : String(err)}`;
          }
        }
      } else if (apply && mode !== "Active") {
        row.Result = "skipped (not in --names)";
      }
      rows.push(row);
    }
  }
}

async function main(): Promise<void> {
  if (apply && names.size === 0) {
    console.error("--apply needs --names with the function names to change.");
    process.exit(1);
  }
  const rows: Row[] = [];
  for (const region of regions) {
    try {
      await scanRegion(region, rows);
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  const passThrough = rows.filter((r) => r.Tracing !== "Active").length;
  console.log(`Functions without active X-Ray tracing: ${passThrough}; Active but role can't write traces: ${rows.length - passThrough}`);
  if (rows.length) console.table(rows);
  if (!apply) console.log("Report only. Pass --names and --apply to turn on active tracing.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-lambda @aws-sdk/client-iam
npm install --save-dev tsx typescript @types/node

# Report only
AWS_PROFILE=readonly npx tsx find-lambda-functions-without-tracing.ts --regions us-east-1,eu-west-1

# Turn on active tracing for two functions
AWS_PROFILE=deploy npx tsx find-lambda-functions-without-tracing.ts --regions us-east-1 --names orders-api,checkout --apply

Functions without active X-Ray tracing: 2; Active but role can't write traces: 1
┌─────────┬─────────────┬──────────────┬──────────────┬───────────────┬────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Function     │ Runtime      │ Tracing       │ RoleCanTrace                                           │ Result                                                    │
├─────────┼─────────────┼──────────────┼──────────────┼───────────────┼────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'orders-api' │ 'nodejs22.x' │ 'PassThrough' │ 'yes'                                                  │ 'set to Active'                                           │
│ 1       │ 'us-east-1' │ 'checkout'   │ 'python3.13' │ 'PassThrough' │ 'no (xray:PutTraceSegments, xray:PutTelemetryRecords)' │ 'skipped: add AWSXRayDaemonWriteAccess to the role first' │
│ 2       │ 'us-east-1' │ 'reports'    │ 'java21'     │ 'Active'      │ 'no (xray:PutTraceSegments, xray:PutTelemetryRecords)' │ "Active, but the role can't write traces"                 │
└─────────┴─────────────┴──────────────┴──────────────┴───────────────┴────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────┘