Serverless Telemetry with ADOT Lambda Layer

Instrument AWS Lambda functions with the AWS Distro for OpenTelemetry (ADOT) Lambda Layer to send serverless traces, metrics, and logs to Bronto over OTLP.

​

When to Use the ADOT Lambda Layer

The ADOT Lambda Layer is the recommended Lambda ingestion path when your function runtime has a layer. It is a good fit when you want to:

• Send traces, metrics, and logs from AWS Lambda directly to Bronto over OTLP, without going through CloudWatch
• Avoid CloudWatch ingestion fees on the telemetry you export
• Use the same service.name / service.namespace identity across Lambda, ECS, and EKS workloads

The layer exports logs written through your logging framework once it is bridged to OpenTelemetry (see Setup). Lambda’s automatic stdout / stderr capture goes to CloudWatch Logs by default — to also ship those, use the CloudWatch Log Forwarder or set the function’s log destination to Amazon Data Firehose.

---

​

Supported Runtimes

The layer is the AWS Lambda Layer for OpenTelemetry. It runs the ADOT SDK inside your function and exports straight to an OTLP endpoint, with no Collector in the function.

Runtime	Layer name	Lambda runtimes	Architectures	Signals to Bronto
Python	AWSOpenTelemetryDistroPython	Python 3.10–3.14	x86_64, arm64	Traces, metrics, logs
Node.js	AWSOpenTelemetryDistroJs	Node.js 18, 20, 22, 24	x86_64, arm64	Traces, metrics, logs
Java	AWSOpenTelemetryDistroJava	Java 11, 17, 21, 25	x86_64, arm64	Traces, metrics, logs
.NET	AWSOpenTelemetryDistroDotNet	.NET 8	x86_64	Traces

For Go, Ruby, and custom runtimes there is no layer. Instrument the function with the OpenTelemetry SDK for your language and export straight to Bronto, or use the CloudWatch Log Forwarder. For non-Lambda compute, see ADOT — ECS / EKS or the overview.

---

​

Bronto OTLP Endpoints

Region	Logs Endpoint	Metrics Endpoint	Traces Endpoint
EU	https://ingestion.eu.bronto.io/v1/logs	https://ingestion.eu.bronto.io/v1/metrics	https://ingestion.eu.bronto.io/v1/traces
US	https://ingestion.us.bronto.io/v1/logs	https://ingestion.us.bronto.io/v1/metrics	https://ingestion.us.bronto.io/v1/traces

The layer exports OTLP over HTTP with protobuf encoding (http/protobuf). Every request needs the header:

x-bronto-api-key: <YOUR_API_KEY>

See API Keys for how to generate a key.

---

​

Setup

​

Step 1 — Add the layer

Layer ARNs are specific to the region and runtime. Find the ARN for your region and runtime under ADOT Lambda Layer ARNs in the ADOT Lambda documentation.

Via AWS CLI:

aws lambda update-function-configuration \
  --function-name <YOUR_FUNCTION_NAME> \
  --layers <ADOT_LAYER_ARN>

Via Terraform:

resource "aws_lambda_function" "example" {
  # ... other config ...
  layers = ["<ADOT_LAYER_ARN>"]
}

For functions deployed as container images, which can’t use layers, download layer.zip from the latest release of the runtime’s ADOT repository and unzip it into /opt in the image.

​

Step 2 — Point the layer at Bronto

Set these environment variables on the function, for every runtime:

Variable	Value
AWS_LAMBDA_EXEC_WRAPPER	/opt/otel-instrument
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT	https://ingestion.<REGION>.bronto.io/v1/traces
OTEL_EXPORTER_OTLP_METRICS_ENDPOINT	https://ingestion.<REGION>.bronto.io/v1/metrics
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT	https://ingestion.<REGION>.bronto.io/v1/logs
OTEL_EXPORTER_OTLP_HEADERS	x-bronto-api-key=<YOUR_API_KEY>
OTEL_METRICS_EXPORTER	otlp
OTEL_LOGS_EXPORTER	otlp
OTEL_TRACES_SAMPLER	always_on
OTEL_AWS_APPLICATION_SIGNALS_ENABLED	false

Set OTEL_EXPORTER_OTLP_TRACES_ENDPOINT explicitly. On Lambda, the Python, Node.js, and Java layers send traces to the local X-Ray endpoint unless this variable is set. OTEL_EXPORTER_OTLP_ENDPOINT on its own is not enough, and traces silently go to X-Ray instead of Bronto.

• OTEL_METRICS_EXPORTER and OTEL_LOGS_EXPORTER — the layer turns metrics and logs off by default. Setting them to otlp sends them to Bronto.
• OTEL_TRACES_SAMPLER=always_on — by default the layer follows the sampling decision in Lambda’s X-Ray trace header. With Lambda active tracing off, that can drop every span. always_on records every invocation. For a fixed share instead, set OTEL_TRACES_SAMPLER=traceidratio and OTEL_TRACES_SAMPLER_ARG to a value such as 0.25.
• OTEL_AWS_APPLICATION_SIGNALS_ENABLED=false — turns off the CloudWatch Application Signals processing, which adds overhead and AWS-specific attributes that Bronto doesn’t use. Lambda active tracing and the Application Signals IAM policy aren’t needed to export to Bronto.

Don’t set OTEL_AWS_LAMBDA_FAST_START=true. That mode only sends traces to X-Ray, with no OTLP, metrics, or logs.

​

Step 3 — Set the runtime-specific settings

Python

Variable	Value
OTEL_PYTHON_DISTRO	aws_distro
OTEL_PYTHON_CONFIGURATOR	aws_configurator
OTEL_PYTHON_LOGGING_AUTO_INSTRUMENTATION_ENABLED	true
OTEL_EXPORTER_OTLP_METRICS_DEFAULT_HISTOGRAM_AGGREGATION	explicit_bucket_histogram

• With Application Signals off, the layer no longer selects the ADOT distro and configurator by itself. Set them explicitly so the HTTP exporters bundled in the layer are used.
• OTEL_PYTHON_LOGGING_AUTO_INSTRUMENTATION_ENABLED=true bridges Python’s logging module to OpenTelemetry. The bridge sits on the root logger, so set the root logger level (for example logging.getLogger().setLevel(logging.INFO)) to the lowest level you want to export.
• The layer sends exponential histograms by default, which Bronto doesn’t ingest. explicit_bucket_histogram switches to explicit histograms.
• To keep cold starts short, the layer enables only the botocore and aws-lambda instrumentations. Set OTEL_PYTHON_DISABLED_INSTRUMENTATIONS=none to enable all of them, at a cold-start cost.

Node.js

Variable	Value
OTEL_NODE_ENABLED_INSTRUMENTATIONS	aws-sdk,aws-lambda,http,pino (or winston, bunyan)

• Logs are exported only from a logging library with an OpenTelemetry instrumentation. Add yours to OTEL_NODE_ENABLED_INSTRUMENTATIONS. console.log output is not exported.
• For winston, also add the @opentelemetry/winston-transport package and the OpenTelemetryTransportV3 transport to your logger.
• To keep cold starts short, the layer enables only the aws-sdk, aws-lambda, and http instrumentations. Set OTEL_NODE_DISABLED_INSTRUMENTATIONS=none to enable all of them, at a cold-start cost.

Java

Variable	Value
OTEL_INSTRUMENTATION_LOG4J_APPENDER_ENABLED	true (Log4j 2)
OTEL_INSTRUMENTATION_LOGBACK_APPENDER_ENABLED	true (Logback)

• The layer runs the ADOT Java agent with most instrumentations off to keep cold starts short. Enable the appender for your logging framework so its logs are exported.
• Only http/protobuf is supported; the Java SDK has no OTLP/HTTP JSON exporter.
• Telemetry is flushed at the end of each invocation for handlers that implement RequestHandler or RequestStreamHandler.
• The Java agent adds the most cold-start time of the four runtimes. OTEL_JAVA_AGENT_FAST_STARTUP_ENABLED=true trades peak performance for faster startup.

.NET

The .NET layer exports traces only. Leave OTEL_METRICS_EXPORTER and OTEL_LOGS_EXPORTER unset (the layer’s default is none). The layer doesn’t flush logs or metrics when an invocation ends, so they’re lost when the environment freezes, and ADOT warns against enabling them on Lambda.

• OTEL_EXPORTER_OTLP_ENDPOINT=https://ingestion.<REGION>.bronto.io also works for traces on .NET, but the per-signal variable from Step 2 is fine.
• The handler must be a class library handler in Assembly::Type::Method form. The layer is x86_64 only.
• Only http/protobuf is supported for OTLP over HTTP.

---

​

Resource Identity and Log Organization

The layer attaches OpenTelemetry resource attributes to every signal, including cloud.* and faas.* attributes for the function. For logs only, Bronto maps service.name to a Dataset and service.namespace to a Collection. Metrics and traces use these attributes for identity and filtering, but are not stored in datasets or collections.

Variable	All signals	Additional behavior for logs only
OTEL_SERVICE_NAME	Sets service.name. Defaults to the function name	Selects the log dataset
OTEL_RESOURCE_ATTRIBUTES	Sets additional resource attributes	service.namespace selects the log collection

To override log routing, set headers on the logs exporter only with OTEL_EXPORTER_OTLP_LOGS_HEADERS. It replaces OTEL_EXPORTER_OTLP_HEADERS for logs, so repeat the API key:

OTEL_EXPORTER_OTLP_LOGS_HEADERS=x-bronto-api-key=<YOUR_API_KEY>,x-bronto-dataset=<YOUR_DATASET_NAME>,x-bronto-collection=<YOUR_COLLECTION_NAME>,x-bronto-tags=env=prod

Header	Description
x-bronto-dataset	Overrides service.name for the log dataset
x-bronto-collection	Overrides service.namespace for the log collection
x-bronto-tags	Comma-separated tags to attach to the log dataset

---

​

Cost Notes

• The ADOT Lambda Layer itself is free.
• Traces, metrics, and logs exported through the layer go straight to Bronto — no CloudWatch ingestion fees for those signals.
• Lambda’s automatic stdout / stderr capture writes to CloudWatch Logs by default. To stop paying for that, log through a bridged logging framework, or set the function’s log destination to Amazon Data Firehose; to keep both paths, add the CloudWatch Log Forwarder alongside the layer.

---

​

References

• ADOT — AWS Lambda Layer for OpenTelemetry
• CloudWatch — enable your applications on Lambda

---

For assistance, contact [e-mail].