AWS X-Ray

AWS X-Ray helps developers analyze and debug distributed applications, such as those built using a microservices architecture. X-Ray provides an end-to-end view of requests as they travel through your application, and shows a map of your application’s underlying components. You can use X-Ray to analyze both applications in development and in production.

In AWS:

Create a new AWS role for the Relyance AI integration, then give that role appropriate permissions and a trust relationship by following these steps:

1. Under Roles, click Create Role.

2. Enter these details:

   • Account ID: 580082088342 (the Relyance AI AWS account ID that will be used to do the connection to your account).
   • External ID: a string, for example <yourcompany>-relyance.

3. Click the Next: Permissions button.

4. Grant read access to X-Ray. Relyance makes three calls, all reads:

   Permission	Used for
   xray:GetTraceSummaries	finding traces in the scan window
   xray:BatchGetTraces	fetching those traces
   xray:GetServiceGraph	reading the service map they describe

   A custom policy with just those three is the least-privilege option, and it is what the Terraform module at the end of this page generates. AWSXRayReadOnlyAccess is the managed equivalent. Avoid AWSXrayFullAccess: it also grants trace writes, which Relyance never makes, and a security review will rightly ask why.

5. Click the Next: Tags button.

6. Leave the tags screen empty; click the Next button.

7. Fill in the Role Name and Description.

8. Click the Create role button.

9. Open the newly created Role.

10. Click the Trust Relationship tab.

11. Click on the Edit Trust Relationship button.

12. Change the line with “Principal”: { “AWS”: "arn:aws:iam::580082088342:root" } to “Principal”: {"AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" }

In Relyance AI:

1. Login to your Relyance AI account.

2. Navigate to the Settings (bottom-left corner).

3. Select Integrations.

4. Search and locate the AWS X-Ray integration card and click on it.

5. Click on the Add Connection button on the top right.

6. Provide a meaningful name for the integration and click on the Add button.

7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see Integration Features.

8. In the Connection section, provide the appropriate values and click on Continue,

   • Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages.
   • Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection.
   • Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas.

9. In the Authentication section, choose IAM Assume-Role, then open the Account Details JSON editor and click Continue. It is a JSON array, so one connection can cover several AWS accounts — add an object per account:

   [
     {
       "account-id": "",
       "role-name": "",
       "external-id": "",
       "region": "",
       "product": ""
     }
   ]

10. Review the configuration summary from the Completion section and click on Finish.

11. Confirm the integration Status reflects Connected.

Verify the connection is really working

1. A failure at Authenticate is the trust policy or the external ID. The trust relationship must name arn:aws:iam::580082088342:user/tenant-prod-access and its condition must match the external ID on the connection exactly.
2. Connected but no services discovered. X-Ray data is regional and retained for 30 days. If the account has no traces in the scan window — or the region on the connection is not the region the traces are in — the result is empty with no error, because GetTraceSummaries legitimately returns nothing.
3. A service map with gaps. GetServiceGraph describes what X-Ray itself observed. Services that do not emit trace segments never appear, so gaps here reflect instrumentation coverage rather than a permission problem.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "aws_xray" {
  vendor = "aws_xray"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    params = {
      accounts = jsonencode([
        {
          account-id = ""
          external-id = ""
          product = ""
          region = ""
          role-name = ""
        }
      ])
    }
  }

  scans = { "property-inspection" = { enabled = true } }
}