> ## Documentation Index
> Fetch the complete documentation index at: https://docs.odigos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CDK: Destinations

> Configure where the Odigos AWS CDK constructs send telemetry, and which signals to enable.

Both Lambda and Fargate constructs take a `destination` — where your telemetry is sent, and which OpenTelemetry
signals to include. Configure it once on the construct; every workload that construct instruments uses the
same settings.

<Note>
  Read [Odigos AWS CDK](/cloud-connectors/aws/cdk/overview) first for install and when to use the package.
  This page covers only the shared `destination` options.
</Note>

## Choosing a destination

You give the construct an endpoint in one of two formats, depending on which protocol your destination
speaks:

<ParamField path="destination.endpoint" type="string">
  OTLP over **gRPC**, written as a bare `host:port` with **no** `https://` prefix — for example
  `otlp.example.com:4317`. Port 4317 is the convention.
</ParamField>

<ParamField path="destination.httpEndpoint" type="string">
  OTLP over **HTTP**, written as a full URL **including** the scheme — for example
  `https://otlp.example.com:4318`. Port 4318 is the convention.
</ParamField>

The two formats aren't interchangeable, and getting them mixed up is the most common mistake here — so the
construct checks: a scheme in `endpoint`, or a missing one in `httpEndpoint`, stops the build immediately
rather than deploying something that starts up fine and then quietly delivers nothing. Using a port that
belongs to the other protocol (4318 with gRPC, or 4317 with HTTP) produces a warning.

<Note>
  **How many endpoints to set differs between the two constructs.** Lambda takes
  **exactly one**. Fargate accepts **either or both**, and often should get both —
  see [Fargate → Transport](/cloud-connectors/aws/cdk/fargate#transport) for why.
</Note>

Two more optional settings:

<ParamField path="destination.insecure" type="boolean" default="false">
  Skip TLS verification. Applies to the gRPC `endpoint` only — the HTTP exporter takes its transport from
  the URL scheme.
</ParamField>

<ParamField path="destination.headers" type="object">
  Headers sent with every request, which in practice means your destination's credential (an API key or
  token).

  <Warning>
    These are stored as a plain environment variable on the workload — readable by
    anyone who can describe the function or task definition, and visible in the AWS
    console. For a long-lived credential, prefer a destination that authenticates by
    network position (a private VPC endpoint, or mTLS), or send telemetry to a
    collector you run that holds the real credential.
  </Warning>
</ParamField>

## Choosing which signals to send

OpenTelemetry produces three kinds of data, and you choose which ones to send:

<ParamField path="destination.traces" type="boolean" default="true">
  Traces — the request-by-request timelines. On by default.
</ParamField>

<ParamField path="destination.metrics" type="boolean" default="false">
  Metrics — numeric measurements over time. **Off unless you turn it on.**
</ParamField>

<ParamField path="destination.logs" type="boolean" default="false">
  Logs. **Off unless you turn it on.**
</ParamField>

```typescript theme={null}
destination: {
  endpoint: 'otlp.example.com:4317',
  metrics: true,   // off unless you ask
  logs: true,      // off unless you ask
}
```

Traces are on by default because that is the primary signal most teams set up OpenTelemetry for.
Metrics and logs are opt-in: enabling a signal you are not ready to receive is not free — refused
batches are retried on a backoff, and on Lambda that retrying happens inside billed duration. Turn them
on when you want those signals and your destination is configured to accept them.

<Warning>
  **Match this to what your destination in Odigos has enabled.** Odigos compares
  the workload's full telemetry configuration against what it expects, so a
  traces-only workload checked against a destination configured for all three
  signals is reported as *drifted* — even though the workload is working fine.
  Read the enabled signals off the destination in Odigos and state the same ones
  here.
</Warning>

<Note>
  Turning all three off stops the build — a workload with instrumentation but
  nowhere to send anything would be silent, which is never what you meant.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Lambda construct" icon="bolt" href="/cloud-connectors/aws/cdk/lambda">
    Layer sources, web-server mode, Java handler interfaces.
  </Card>

  <Card title="Fargate construct" icon="cubes" href="/cloud-connectors/aws/cdk/fargate">
    Languages, service naming, the agents image.
  </Card>
</CardGroup>