Observe Azure Functions with OpenTelemetry

Ship traces, metrics, and logs from Azure Functions to an AKS observability stack.

Introduction

30 Second Summary

When something breaks in production, the first question is always the same: what just happened? Without visibility into your systems, debugging feels like searching for a needle in a haystack with the lights off.

In this project, you will build a full observability platform on Azure. You will deploy instrumented Azure Functions that emit traces, metrics, and logs through OpenTelemetry into a monitoring stack running on AKS.

What You'll Build

A cloud-native observability platform that collects distributed traces, metrics, and logs from Azure Functions and visualizes them in Grafana dashboards running on an AKS cluster.

By the end of this project, you'll have:

Azure Functions instrumented with OpenTelemetry to emit distributed traces, metrics, and structured logs.
An AKS cluster running Prometheus, Grafana, and Loki as your monitoring and logging stack.
An OpenTelemetry Collector receiving telemetry from your Functions and routing it to the right backends.
Secret Mission: Configure alerting rules that fire when your Functions start failing or slowing down.

Are there any prerequisites?

You should be comfortable navigating the Azure Portal and running terminal commands. Familiarity with C# basics and Kubernetes concepts will help, but the project walks you through each tool step by step.

Set Up Your Environment

Before building anything, you need to make sure your cloud environment is configured correctly. A misconfigured region can lead to higher latency, unexpected costs, or services that simply aren't available.

In this step, you'll select the right AWS region for your project and navigate to the service dashboard where you'll spend most of your time.

In this step, get ready to:

Select an AWS region for your project.
Navigate to the relevant service dashboard.

Select your AWS region

Every resource you create in AWS lives in a specific region. Choosing a region close to you reduces latency and keeps all your resources in one place.

In the AWS Management Console, look at the top-right corner of the navigation bar.
Click the Region dropdown (it shows your current region name, like US East (N. Virginia)).
Select US East (N. Virginia) if you're in North America, or the region closest to your physical location.

Why does region matter?

AWS services are deployed independently in each region. If you create a resource in one region and look for it in another, it won't appear.

Picking a single region and sticking with it for the entire project avoids confusion. US East (N. Virginia) has the broadest service availability, which is why it's the default for most tutorials.

Navigate to the service dashboard

With your region locked in, navigate to the service you'll use first in this project.

Click the Search bar at the top of the console (or press Alt+S on Windows or Option+S on macOS).
Type the name of the service you need and select it from the dropdown results.
Confirm your selected region is still displayed in the top-right corner of the dashboard.

Pin your most-used services

Click the star icon next to any service in search results to pin it to your navigation bar. This saves time when you need to switch between services later in the project.

Don't see the service you need?

Double-check that your region (top-right corner) matches what you selected earlier. Some services are regional and won't appear if you've accidentally switched.

If the service still doesn't show up, it may not be available in your chosen region. Switch to US East (N. Virginia) which supports the widest range of services.

Help me find my service in the AWS console

Your environment is ready to go. Next up, you'll start creating the core resources for your project.

Create Core Resources

With your environment ready, it's time to create the core resource that powers this project.

In this step, you'll create an S3 bucket in the AWS console and configure it with the settings your project needs.

In this step, get ready to:

Navigate to the S3 service in the AWS console.
Create a new S3 bucket with a unique name.
Apply the required configuration settings to your bucket.

Navigate to Amazon S3

Amazon S3 (Simple Storage Service) is an object storage service that stores your files as objects inside containers called buckets.

In the AWS Management Console, click the search bar at the top of the page.
Type S3 and select S3 from the results.

You should see the S3 dashboard with a list of buckets (which may be empty if this is your first time using S3).

Create your S3 bucket

Every S3 bucket needs a globally unique name. This means no other AWS account in the world can have a bucket with the same name as yours.

Click Create bucket.
In the Bucket name field, enter a unique name using this format: nextwork- followed by your name (e.g. nextwork-jane).
Confirm that the AWS Region matches the region you selected earlier.

Why do I have to enter my name in the bucket name?

S3 bucket names are globally unique across all AWS accounts worldwide. Adding your name makes it unlikely that someone else has already taken the same name.

Configure bucket settings and create

Leave Object Ownership set to ACLs disabled (recommended).
Under Block Public Access settings for this bucket, keep all checkboxes selected (Block all public access).
Leave all other settings at their defaults.
Scroll to the bottom and click Create bucket.

You should see a green success banner at the top of the page confirming your bucket was created successfully.

Seeing a bucket name error?

If you see a message saying the bucket name already exists, try adding a number to the end of your name (e.g. nextwork-jane2). Bucket names must be 3-63 characters, all lowercase, and contain only letters, numbers, and hyphens.

Help me fix my S3 bucket name error.

Your core resource is ready. Next up, you'll configure it and start building on top of it.

Configure Settings

Your resource is created, but it still needs configuration before it can do its job.

In this step, you will apply the settings, policies, and parameters that control how your resource behaves and who can access it.

In this step, get ready to:

Configure the resource settings for your use case.
Apply a policy to control access.
Set the required parameters for your configuration.

Update the resource settings

Settings determine how your resource operates. Applying the correct configuration ensures everything works as expected when you use the resource later.

Navigate to your resource in the console dashboard.
Open the Properties tab or settings panel for your resource.
Review the available configuration options.
Apply the required settings for your project.
Click Save changes.

Why do settings matter?

Settings control the behaviour of your resource. Without the correct configuration, your resource might not respond to requests or could block access entirely.

Apply a policy to your resource

Policies define who can interact with your resource and what actions they can perform. This is a critical step for security and functionality.

Open the Permissions section of your resource.
Locate the policy editor or policy configuration area.
Enter the required policy that grants the appropriate access level.
Click Save to apply the policy.

What is a policy?

A policy is a JSON document that specifies which actions are allowed or denied on your resource. It controls access at a granular level.

Policies follow the principle of least privilege. Only grant the minimum permissions needed for your use case.

Policy not saving?

Check that your policy JSON is valid. A missing comma or bracket will prevent it from saving. Also confirm you have the correct permissions to modify the resource.

help me fix my resource policy

Set the remaining parameters

Parameters fine-tune how your resource handles specific operations. These final settings complete your configuration.

Navigate to the additional configuration or parameters section.
Set each required parameter to the specified value.
Confirm that all parameter values are correct.
Click Save to apply your changes.

Double check before moving on

Review all three areas (settings, policy, and parameters) one more time. Catching a misconfiguration now saves debugging time later.

Your resource is fully configured. Next up, you will put it to work and verify everything functions as expected.

Test and Verify

Your resource is now fully configured with all the right settings and policies in place. The next question is whether it actually works as expected.

In this step, you will run a test against your resource to confirm it operates correctly. This is the moment where all your configuration comes together.

In this step, get ready to:

Run a test to exercise your configured resource.
Verify that the test results confirm successful operation.

Run your test

Testing your resource confirms that all the configuration you applied in the previous step is working correctly. A successful test means your resource is ready for real use.

In the AWS Management Console, navigate to your resource's dashboard.
Locate and click the Test or equivalent action button for your resource.
Execute the test using the default parameters provided by the console.

Why test in the console?

The AWS console provides a built-in way to test resources without needing external tools. This lets you confirm your configuration works before building anything on top of it.

Verify the results

After running your test, you need to check the output to make sure everything performed as expected.

Review the test output displayed in the console.
Confirm that the response indicates a successful operation (look for a success status or expected output).
If you see any errors, double-check the configuration you applied in the previous step.

Seeing an error in your test results?

Make sure your resource's policies and settings were saved correctly in the previous step. A missing permission or misconfigured parameter is the most common cause of test failures.

Also check that you are testing in the same region where you created your resource. Mismatched regions will prevent the test from finding your resource.

Help me troubleshoot my AWS resource test failure.

Your resource is now tested and verified. You have confirmed that all your configuration is working exactly as intended.

Secret mission

Add a Bonus Configuration

You've built and tested your core resource. Now extend it with an additional configuration to see how AWS services can be layered together.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

This project uses Amazon S3, which costs fractions of a cent per month for a small static website. There are no significant ongoing costs, but your bucket and its contents will remain in your AWS account until you remove them.

Resources you used:

Your S3 bucket (including all uploaded files and configuration).
Any additional resources or configuration you added during the Secret Mission.

Keep everything running

No action needed. Choose this if you are still actively building or want to keep your hosted website live.

Your S3 bucket will remain accessible at its endpoint URL.
Storage costs are negligible for a small static site (well within the AWS Free Tier for the first 12 months).
Your AWS account remains active. You can return to the S3 console at any time to manage your bucket.

Pause - I'll come back to this later

Restrict public access to your bucket so the website is no longer live, while keeping your files intact for later.

Open the S3 console at https://console.aws.amazon.com/s3/.
Click on your bucket name to open it.
Select the Permissions tab.
Under Block public access (bucket settings), click Edit.
Check the box for Block all public access, then click Save changes.
Type confirm in the confirmation field and click Confirm.
Your website URL will stop working, but all your files remain in the bucket for when you return.

Delete - I don't want to use this again

Remove all project resources from your AWS account. This cannot be undone.

Open the S3 console at https://console.aws.amazon.com/s3/.
Select the radio button next to your bucket name.
Click Empty.
Type permanently delete in the confirmation field, then click Empty.
Once the bucket is empty, go back to the Buckets list.
Select the radio button next to your bucket name again.
Click Delete.
Type your bucket name in the confirmation field, then click Delete bucket.
If you added any additional AWS resources during the Secret Mission, navigate to those services in the AWS Console and delete them using the same pattern (select the resource, then delete with confirmation).

Nice Work!

Nice work! You just created, configured, and tested an AWS resource from scratch using the AWS Management Console.

You've learned how to:

Navigate the AWS Management Console to find and launch AWS services.
Create and configure an AWS resource with the correct region, naming, and settings.
Test and verify your resource is working as expected using built-in AWS tools.
Complete a Secret Mission to extend your resource with additional configuration.

Ready to quiz yourself?