AWS X-Ray

2026/10/19 - AWS X-Ray - 1 updated api methods

Changes  Adds support for encrypting the Transaction Search spans log group with a customer managed AWS KMS key. Pass the key ARN in the new CloudWatchLogsConfiguration.SpansLogGroupKmsKeyId field of UpdateTraceSegmentDestination. X-Ray applies the key when it creates the log group.

UpdateTraceSegmentDestination (updated) Link ΒΆ
Changes (request)
{'CloudWatchLogsConfiguration': {'SpansLogGroupKmsKeyId': 'string'}}

Modifies the destination of data sent to PutTraceSegments. The Transaction Search feature requires the CloudWatchLogs destination. For more information, see Transaction Search.

See also: AWS API Documentation

Request Syntax

client.update_trace_segment_destination(
    Destination='XRay'|'CloudWatchLogs',
    CloudWatchLogsConfiguration={
        'SpansLogGroupKmsKeyId': 'string'
    }
)
type Destination:

string

param Destination:

The configured destination of trace segments.

type CloudWatchLogsConfiguration:

dict

param CloudWatchLogsConfiguration:

Specifies settings for the CloudWatch Logs log groups that X-Ray creates for Transaction Search. Specify this only when Destination is CloudWatchLogs.

  • SpansLogGroupKmsKeyId (string) --

    The ARN of an AWS Key Management Service (AWS KMS) key that you create and manage, in the same account and Region, used to encrypt the aws/spans log group. Key IDs and alias ARNs are not supported.

    X-Ray applies the key only when it creates aws/spans. If the account already has an aws/spans log group, X-Ray fails the request with an InvalidRequestException and does not change the log group. To enable Transaction Search with the existing log group as it is, call UpdateTraceSegmentDestination again without SpansLogGroupKmsKeyId. To set or change the key of the existing log group, use the CloudWatch Logs AssociateKmsKey operation.

    You need kms:DescribeKey permission on the key, and the key policy must allow CloudWatch Logs to use the key. For more information, see Encrypt log data in CloudWatch Logs using AWS Key Management Service.

rtype:

dict

returns:

Response Syntax

{
    'Destination': 'XRay'|'CloudWatchLogs',
    'Status': 'PENDING'|'ACTIVE'
}

Response Structure

  • (dict) --

    • Destination (string) --

      The destination of the trace segments.

    • Status (string) --

      The status of the update.