JA EN
shiichan

CloudWatch Now Accepts API Keys for OpenTelemetry Traces!

AWS What's New ★★★★ View Markdown
#aws#devops#infrastructure

Hi, it's Shii-chan! I found a news item today that makes sending traces to CloudWatch a lot lighter!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon CloudWatch now supports bearer token authentication (API keys) on the AWS X-Ray OTLP traces endpoint, where OpenTelemetry traces are sent.

Any OTLP/HTTP client that can set an Authorization header can use it. The announcement names these examples:

  • The OpenTelemetry Collector
  • OpenTelemetry SDK exporters

The story so far

Until now, requests had to be signed with AWS Signature Version 4 (SigV4).

For workloads that can't use the AWS SDK or short-term credentials, that was likely a hurdle.

What changes

You can now send traces with just a static Authorization header, so environments where SigV4 signing is hard can still ship traces to CloudWatch. The announcement mentions these cases:

  • Applications running on premises or in other clouds
  • CI/CD pipelines
  • Third-party tools that support only a static Authorization header

With either method, you get the same CloudWatch capabilities: Transaction Search, Amazon CloudWatch Application Signals, and Amazon CloudWatch Omni.

Dive Deep

Here are the points worth keeping in mind:

  • SigV4 remains the recommended way to send traces to CloudWatch
  • The AWS Distro for OpenTelemetry (ADOT) SDKs still use SigV4 by default, with no changes required
  • Bearer tokens are an additional option, not a replacement
  • Available in all commercial AWS Regions where the X-Ray OTLP traces endpoint is available

The announcement doesn't mention key expiration, rotation, or pricing. For setup steps, see "Setting up bearer token authentication for traces" in the AWS X-Ray Developer Guide!

Wrap-up

  • Bearer token (API key) authentication now works for OTLP/HTTP trace ingestion
  • Easier to send from on-prem, other clouds, CI/CD, and tools with static headers only
  • SigV4 stays recommended, and ADOT SDKs need no changes
  • CloudWatch features are the same with either method

This one is for observability folks who want to collect traces from outside AWS!

Related posts