Examkin

Question

Difficulty: MediumInstrumenting Distributed Tracing with AWS X-Ray

A developer is deploying a Node.js application to Amazon ECS on AWS Fargate. The developer wants to instrument the application to send distributed tracing data to AWS X-Ray. The developer includes the AWS X-Ray SDK in the application code and configures the SDK to instrument incoming HTTP requests. However, after deployment, no traces appear in the AWS X-Ray console, and the application logs show errors indicating that connection to the X-Ray daemon on port 2000 failed. Which of the following actions should the developer take to resolve this issue and enable successful tracing?

  1. Create a sidecar container for the AWS X-Ray daemon in the ECS task definition, and attach the AWSXRayDaemonWriteAccess policy to the ECS task role.Answer
  2. B
    Create a sidecar container for the AWS X-Ray daemon in the ECS task definition, and attach the AWSXRayDaemonWriteAccess policy to the ECS task execution role.
  3. C
    Initialize the AWS SDK clients within the Node.js application by passing hardcoded IAM credentials containing the AWSXRayDaemonWriteAccess policy directly into the constructors.
  4. D
    Set the AWS_XRAY_CONTEXT_MISSING environment variable to IGNORE_ERROR to allow the SDK to function without a running X-Ray daemon.

Answer

Create a sidecar container for the AWS X-Ray daemon in the ECS task definition, and attach the AWSXRayDaemonWriteAccess policy to the ECS task role.
To instrument an application running on Amazon ECS with Fargate, the AWS X-Ray daemon must be run as a sidecar container in the same task definition. Because Fargate tasks use the awsvpc network mode, the application container can communicate with the daemon container over localhost (127.0.0.1) on UDP port 2000. Additionally, the ECS Task Role must have the necessary permissions (such as AWSXRayDaemonWriteAccess) to allow the daemon to upload segment data to the AWS X-Ray service. The Task Role defines permissions for the containers running inside the task.

Step-by-Step Solution

1
Analyze application logs showing connection failure to the X-Ray daemon on port 2000.
Identify that the X-Ray daemon is either not running or is unreachable by the application container.
On ECS Fargate, applications communicate with the X-Ray daemon over UDP localhost (127.0.0.1:2000), which requires the daemon to be running inside the same task.
2
Configure the X-Ray daemon as a sidecar container in the ECS task definition.
The daemon starts inside the same network namespace, making port 2000 reachable by the application container over localhost.
This establishes local UDP network connectivity between the application's X-Ray SDK client and the X-Ray daemon.
3
Attach the AWSXRayDaemonWriteAccess managed policy to the ECS Task Role.
The X-Ray daemon has permissions to send trace segments to the AWS X-Ray service endpoint at runtime.
The Task Role provides credentials to the running containers, unlike the Task Execution Role, which is only used by the ECS agent for pulling images and publishing startup logs.

Key Concept

Instrumenting Distributed Tracing with AWS X-Ray on Amazon ECS
Rate this question

Topics

Instrumenting Distributed Tracing with AWS X-Ray

More questions from this topic