Serverless Monitoring Guide: AWS Lambda, Cold Starts & Observability (2026)

# CloudWatch Insights query: Identify cold start invocations
fields @timestamp, @requestId, @initDuration, @duration, @memorySize
| filter ispresent(@initDuration)
| sort @timestamp desc
| limit 100

# Lambda Powertools for structured logging with cold start detection
import { Logger } from '@aws-lambda-powertools/logger';

const logger = new Logger({ serviceName: 'order-service' });

// Cold start flag in logs — filter on is_cold_start=true in CloudWatch
export const handler = async (event: APIGatewayEvent) => {
  logger.addContext(context);
  logger.info('Processing request', {
    event,
    is_cold_start: (context as any).coldStart, // Powertools tracks this
  });
};

# Terraform: Essential Lambda CloudWatch alarms
resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
  alarm_name          = "${var.function_name}-errors"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "Errors"
  namespace           = "AWS/Lambda"
  period              = 300
  statistic           = "Sum"
  threshold           = var.invocations_per_period * 0.01  # 1% error rate

  dimensions = {
    FunctionName = var.function_name
  }

  alarm_actions = [aws_sns_topic.alerts.arn]
}

resource "aws_cloudwatch_metric_alarm" "lambda_throttles" {
  alarm_name          = "${var.function_name}-throttles"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "Throttles"
  namespace           = "AWS/Lambda"
  period              = 60
  statistic           = "Sum"
  threshold           = 0  # Alert on any throttle

  dimensions = {
    FunctionName = var.function_name
  }

  alarm_actions = [aws_sns_topic.alerts.arn]
}

resource "aws_cloudwatch_metric_alarm" "lambda_duration_p99" {
  alarm_name                = "${var.function_name}-duration-p99"
  comparison_operator       = "GreaterThanThreshold"
  evaluation_periods        = 3
  extended_statistic        = "p99"
  metric_name               = "Duration"
  namespace                 = "AWS/Lambda"
  period                    = 300
  threshold                 = var.timeout_ms * 0.8  # 80% of timeout

  dimensions = {
    FunctionName = var.function_name
  }

  alarm_actions = [aws_sns_topic.alerts.arn]
}

# Enable X-Ray in SAM template
Resources:
  OrderFunction:
    Type: AWS::Serverless::Function
    Properties:
      Tracing: Active  # Enables X-Ray

# Enable in Terraform
resource "aws_lambda_function" "order" {
  tracing_config {
    mode = "Active"
  }
}

# Node.js — instrument AWS SDK calls
import AWSXRay from 'aws-xray-sdk';
import { DynamoDB } from '@aws-sdk/client-dynamodb';

// Wrap SDK client to auto-create X-Ray subsegments
const dynamodb = AWSXRay.captureAWSv3Client(new DynamoDB({}));

// Add custom annotations for business context
export const handler = async (event: any) => {
  const segment = AWSXRay.getSegment();
  const subsegment = segment?.addNewSubsegment('order-validation');

  subsegment?.addAnnotation('orderId', event.orderId);
  subsegment?.addAnnotation('customerId', event.customerId);
  subsegment?.addMetadata('orderDetails', event);

  try {
    await validateOrder(event);
    subsegment?.close();
  } catch (err) {
    subsegment?.close(err as Error);
    throw err;
  }
};