# AWS X-Ray

![AWS X-Ray — How does it work?. Herein my article, I will try to… | by A. Yigit Ogun | May, 2022 | AWS Tip](https://assets.relyanceuat.xyz/images/docs/34741484354445/ext-2404b47ed8.png)
AWS X-Ray helps developers analyze and debug distributed applications, such as those built using a microservices architecture. X-Ray provides an end-to-end view of requests as they travel through your application, and shows a map of your application’s underlying components. You can use X-Ray to analyze both applications in development and in production.

#### In AWS:

![3.jpg](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741490900109.jpg)
![4.jpg](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741484351757.jpg)
![5.jpg](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741490900493.jpg)
![6.jpg](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741484352013.jpg)
![7.jpg](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741490901005.jpg)
Create a new AWS role for the Relyance AI integration, then give that role appropriate permissions and a trust relationship by following these steps:

1. Under **Roles**, click **Create Role**.
2. Enter these details:
    - *Account ID*: **580082088342** (the Relyance AI AWS account ID that will be used to do the connection to your account).
    - *External ID*: a string, for example **`<yourcompany>`-relyance**.
3. Click the **Next: Permissions** button.
4. Grant read access to X-Ray. Relyance makes three calls, all reads:

    | Permission | Used for |
    | --- | --- |
    | `xray:GetTraceSummaries` | finding traces in the scan window |
    | `xray:BatchGetTraces` | fetching those traces |
    | `xray:GetServiceGraph` | reading the service map they describe |

    A custom policy with just those three is the least-privilege option, and it is
    what the Terraform module at the end of this page generates.
    **AWSXRayReadOnlyAccess** is the managed equivalent. Avoid
    **AWSXrayFullAccess**: it also grants trace *writes*, which Relyance never
    makes, and a security review will rightly ask why.
5. Click the **Next: Tags** button.
6. Leave the tags screen empty; click the **Next** button.
7. Fill in the Role Name and Description.
8. Click the **Create role** button.
9. Open the newly created Role.
10. Click the **Trust Relationship** tab.
11. Click on the **Edit Trust Relationship** button.
12. Change the line with “Principal”: { “AWS”: "arn:aws:iam::580082088342:root" } to “Principal”: {"AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" }

#### In Relyance AI:

1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **AWS X-Ray** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/).
8. In the **Connection** section, provide the appropriate values and click on **Continue**,
    - **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual** **Maps**, **Assets**, and **Data Flow Analysis** pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/).
9. In the **Authentication** section, choose **IAM Assume-Role**, then open the **Account Details** JSON editor and click **Continue**. It is a JSON *array*, so one connection can cover several AWS accounts — add an object per account:

    ```json
    [
      {
        "account-id": "",
        "role-name": "",
        "external-id": "",
        "region": "",
        "product": ""
      }
    ]
    ```
10. Review the configuration summary from the **Completion** section and click on **Finish.**
11. Confirm the integration Status reflects **Connected.**

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741484352269.png)

![Screenshot 2025-11-06 123901.png](https://assets.relyanceuat.xyz/images/docs/34741484354445/40915709789837.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741484352397.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741484354445/34741484352909.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741484354445/40915732912653.png)

### Verify the connection is really working

1. **A failure at Authenticate** is the trust policy or the external ID. The
   trust relationship must name `arn:aws:iam::580082088342:user/tenant-prod-access`
   and its condition must match the external ID on the connection exactly.
2. **Connected but no services discovered.** X-Ray data is regional and retained
   for 30 days. If the account has no traces in the scan window — or the region on
   the connection is not the region the traces are in — the result is empty with no
   error, because `GetTraceSummaries` legitimately returns nothing.
3. **A service map with gaps.** `GetServiceGraph` describes what X-Ray itself
   observed. Services that do not emit trace segments never appear, so gaps here
   reflect instrumentation coverage rather than a permission problem.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "aws_xray" {
  vendor = "aws_xray"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    params = {
      accounts = jsonencode([
        {
          account-id = ""
          external-id = ""
          product = ""
          region = ""
          role-name = ""
        }
      ])
    }
  }

  scans = { "property-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->