What remote instrumentation for AWS Lambda does

At the center of it is a single Lambda function you deploy into your own AWS account, named datadog-remote-instrumenter. Per the project README, it "ensures your target functions have the Datadog Lambda extension and Datadog Lambda library added." It does this by inspecting your account's Lambda functions, deciding which ones match the rules you've configured, and updating those functions' layers and environment variables directly through the AWS Lambda API — no source code changes, no CI pipeline changes, no redeploy of the functions themselves.

Why this exists#

Manually instrumenting Lambda functions works well for a handful of functions you control end to end. It gets harder at scale: dozens or hundreds of functions, owned by different teams, some newly created every week. Remote instrumentation moves the decision of "should this function be instrumented" out of each team's deploy pipeline and into a central, tag- and name-driven policy that runs continuously.

What it changes on a target function#

For a function that matches your targeting rules, the instrumenter:

• Attaches the Datadog Lambda extension layer and the language-specific tracing library layer for the function's runtime.
• Sets the environment variables the Datadog layers need to send telemetry (API key delivery, tracing, and log forwarding flags).
• Leaves functions that are already manually instrumented — meaning they already carry Datadog layers or Datadog environment variables — untouched, so it never overwrites configuration a team set up themselves.

See Function Targeting for the exact rules and skip conditions, and How It Works for the mechanics of how the instrumenter decides when to run.

Requirements before you start#

Per Datadog's documentation, you need:

• The Datadog-AWS integration configured, with resource collection enabled.
• A Datadog user with the Serverless AWS Instrumentation Read and Write permissions.
• A Datadog API key with Remote Configuration access.

The Quickstart walks through deployment once these are in place.