Enable Enhanced Metrics for Lambda Functions

Opportunity Name: Lambda Enhanced Metrics Enablement

AWS Resource Type: AWS Lambda

Opportunity Description:
This Finder identifies Lambda functions that are not publishing enhanced metrics to CloudWatch, thereby limiting observability into key performance and error indicators. Enhanced monitoring unlocks fine-grained visibility, helping teams troubleshoot issues faster, monitor cold starts, and optimize function performance.

While not a direct cost-saving opportunity, this Finder is part of a broader best practices initiative for performance and business continuity (BCP) preparedness. It ensures critical Lambda workloads are adequately instrumented for proactive monitoring.

Criteria for identifying the opportunity:

• Lambda function does not have CloudWatch Enhanced Monitoring enabled.
• Function exhibits production-level characteristics (e.g., high invocation rates, business-critical operations).
• Metrics currently available are limited to basic invocation, duration, error, and throttle metrics.

Potential Savings (if known):
This Finder is not a cost optimization opportunity, but rather a performance observability and operations enhancement. However, enabling enhanced metrics can indirectly reduce costs by accelerating issue resolution and reducing unplanned downtime. Note that enabling Lambda Insights is a best practice that may slightly increase your CloudWatch costs, since the extension publishes additional metrics and logs.

What happens when the Fixer is executed?
This Finder has an automatic Fixer. CloudFix enables AWS Lambda Insights — not AWS Distro for OpenTelemetry — for the function via an SSM Automation runbook that performs the following steps, in order:

1. Attach the managed IAM policy — calls iam:AttachRolePolicy to attach arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy to the function's execution role, granting it permission to publish the Lambda Insights metrics and logs.
2. Add the Lambda Insights extension layer — calls lambda:UpdateFunctionConfiguration to attach the region- and architecture-appropriate Lambda Insights extension layer (the correct layer ARN is selected automatically based on whether the function is x86_64 or arm64/Graviton).
3. Tag the function — calls lambda:TagResource to record the fixer ID and execution date on the resource.

Before recommending the fix, the Finder also checks that Lambda Insights is not already enabled (it looks for a Lambda Insights extension layer already attached) and that the function's uncompressed deployment package is under the size threshold Lambda Insights supports.

Is it possible to roll back once CloudFix implements the fixer?
Yes, but not automatically — there is no rollback runbook for this Fixer. To revert, remove the Lambda Insights extension layer from the function's configuration and, if no other function relies on it, detach CloudWatchLambdaInsightsExecutionRolePolicy from the execution role. Both changes can be made from the Lambda console or CLI at any time with no impact to the function's existing code or other configuration.

Can CloudFix implement the fix automatically once I accept the recommendation?
Yes. Once you approve the recommendation, CloudFix runs the automation above to attach the IAM policy and the Lambda Insights layer — no manual configuration, code change, or embedded instrumentation library is required.

Does this fix require downtime?
No. Attaching the IAM policy and adding the Lambda Insights layer are configuration-only changes; the function's code is untouched and there is no interruption to invocations.

Additional Resources:

• Monitoring Lambda Functions with CloudWatch
• Lambda Function Insights and Enhanced Metrics
• Using Lambda Insights in Amazon CloudWatch