Guest telemetry: tracing to X-Ray, metrics to CloudWatch

deploy/nix/deployment.nix

@@ -80,6 +80,19 @@
   # which names it "/${name_prefix}-${environment}/guest".
   guestLogGroup = "/CHANGE-ME-production/guest";
 
+  # Guest telemetry: what a guest reports through wit/telemetry. `xray`
+  # exports each guest invocation as one X-Ray trace, attributed to its
+  # tenant; `metricsNamespace` publishes guest metrics to CloudWatch under that
+  # namespace (not under `AWS/`), or "" for none. Each needs the instance
+  # role's grant — `deploy/tofu` gives it when `telemetry` is set there.
+  #
+  # Measured by PCR0 like everything here, so a client can tell from an
+  # attestation whether an enclave ships its traces off the box. What a trace
+  # carries is the guest's own text plus the tenant id; see
+  # runtime/src/telemetry.
+  xray = false;
+  metricsNamespace = "";
+
   # The guest is not here either. The runtime fetches it from
   # `guest/guest.wasm` in `rootsBucket` (`bucketPrefix` is not applied) and
   # measures it into PCR16 before it asks KMS for a key, so changing the guest

deploy/tofu/main.tf

@@ -278,6 +278,50 @@ resource "aws_iam_role_policy" "push" {
   policy = data.aws_iam_policy_document.push[0].json
 }
 
+# Guest telemetry, as the image names it (`xray` and `metricsNamespace` in
+# deploy/nix/deployment.nix), and only what the runtime calls. X-Ray takes no
+# resource-level scoping, so trace segments are account-wide; metrics are held to the
+# image's one namespace by condition. Nothing when telemetry is off.
+locals {
+  telemetry_on = var.telemetry.xray || var.telemetry.metrics_namespace != ""
+}
+
+data "aws_iam_policy_document" "telemetry" {
+  count = local.telemetry_on ? 1 : 0
+
+  dynamic "statement" {
+    for_each = var.telemetry.xray ? [1] : []
+    content {
+      sid       = "PutGuestTraces"
+      effect    = "Allow"
+      actions   = ["xray:PutTraceSegments"]
+      resources = ["*"]
+    }
+  }
+
+  dynamic "statement" {
+    for_each = var.telemetry.metrics_namespace != "" ? [1] : []
+    content {
+      sid       = "PutGuestMetrics"
+      effect    = "Allow"
+      actions   = ["cloudwatch:PutMetricData"]
+      resources = ["*"]
+      condition {
+        test     = "StringEquals"
+        variable = "cloudwatch:namespace"
+        values   = [var.telemetry.metrics_namespace]
+      }
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "telemetry" {
+  count  = local.telemetry_on ? 1 : 0
+  name   = "${local.name}-telemetry"
+  role   = aws_iam_role.parent.id
+  policy = data.aws_iam_policy_document.telemetry[0].json
+}
+
 # For a shell without opening port 22.
 resource "aws_iam_role_policy_attachment" "ssm" {
   role       = aws_iam_role.parent.name

deploy/tofu/variables.tf

@@ -91,6 +91,15 @@ variable "push_app_id" {
   default     = ""
 }
 
+variable "telemetry" {
+  description = "Guest telemetry, as the image names it (xray and metricsNamespace in deployment.nix). With xray the parent's role may put X-Ray trace segments; with a metrics_namespace it may publish CloudWatch metrics to that namespace and no other."
+  type = object({
+    xray              = optional(bool, false)
+    metrics_namespace = optional(string, "")
+  })
+  default = {}
+}
+
 variable "pool_size_gib" {
   type        = number
   default     = 32