Tracing That Samples What You Asked For
AWS X-Ray sampling rules, trace groups and trace encryption. Sampling rates are percentages here, as in the console: the API takes a fraction and the provider validates nothing, so a rate of 5 means 500 percent. Groups get Insights on, because a group without it is a saved search. Encryption is an account setting whose provider delete does nothing, so the module can leave it alone.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-17 · how we verify
Use it from the registry
terraform · opentofumodule "xray" {
source = "www.iac-bazaar.com/iac-bazaar/aws-xray/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-xray
AWS X-Ray: sampling rules, trace groups and the key traces are encrypted with.
Works with Terraform and OpenTofu (>= 1.6), aws provider >= 6.0, < 7.0.
Rates are percentages here. The X-Ray API takes a fraction between 0 and 1,
the console asks for a percentage, and the provider validates neither - so
fixed_rate = 5 means five hundred percent and is caught only when the API
refuses it. This module takes sample_percent (0 to 100, as in the console) and
converts. It also refuses two rules with the same priority, because rules are
evaluated in ascending priority and the first match decides, and it refuses a
priority of 10000 or more: that is the built-in default rule, which records the
first request each second plus five percent of the rest, so nothing above it is
ever reached.
Sampling is parent-based. A rule decides only where the trace STARTS. A rule written for a service that is always called by an instrumented caller never fires, because the caller already made the decision. Write the rule for the entry point - the API, the load balancer, the first instrumented service, or the worker that starts its own trace.
A group without Insights is a saved search. The provider's
insights_configuration block is optional, so a group written without it has
Insights off and reports no anomalies. This module turns Insights and its
EventBridge notifications on by default; notifications are best-effort, by
AWS's own description, so treat a missing one as normal rather than as silence.
Encryption is an account setting with a delete that does nothing. X-Ray
holds one encryption setting per account and Region. The provider's delete for
it is a no-op, so destroying this module leaves the account encrypted however it
was last set, and two root modules that both manage it overwrite each other.
manage_encryption = false hands that setting to whoever owns the account
baseline. A customer managed key is accepted; an AWS managed key is refused,
before the API gets a chance to.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-config
Recorder, delivery channel, service role and managed rules. Starting the recorder is a separate resource people leave out, so a stopped recorder looks identical to a running one until an investigation finds an empty timeline.
aws-grafana
account_access_type ORGANIZATION lets a workspace query observability data in accounts whose owners never approved it, and SERVICE_MANAGED means AWS wrote those data-source policies. Current account, a role you wrote, and an endpoint narrowed to a prefix list rather than the whole internet.
aws-prometheus
Alerting needs BOTH an alert manager definition and a rule group namespace; with either missing the workspace stores metrics and raises nothing while every dashboard reports it healthy. Without logging_configuration a throttled remote_write likewise produces no metrics, no error and no alert.
aws-cloudtrail-lake
A CloudTrail Lake event data store with the retention decided rather than inherited. The aws provider defaults retention to 2555 days; on the default pricing option AWS includes 366 and bills the rest, so the provider default quietly buys 2,189 days of storage. This module defaults to 366, prints the billed days, and keeps termination protection on.
aws-cloudtrail
Multi-region trail with log file validation always on, a bucket that blocks public access, versions, encrypts and denies non-TLS, a policy pinned to this trail, optional CloudWatch delivery and opt-in data events.
aws-cloudwatch
A self-contained CloudWatch observability bundle - an encrypted log group with retention, a metric alarm, and a dashboard - that stands up from just a name and points at any real metric.