diff --git a/content/en/integrations/guide/aws-terraform-setup.md b/content/en/integrations/guide/aws-terraform-setup.md index f498a4672fe95..d532cec251f6d 100644 --- a/content/en/integrations/guide/aws-terraform-setup.md +++ b/content/en/integrations/guide/aws-terraform-setup.md @@ -1,6 +1,5 @@ --- title: The AWS Integration with Terraform - aliases: - /integrations/faq/aws-integration-with-terraform/ disable_toc: true @@ -12,158 +11,270 @@ further_reading: Using [Terraform][1], you can create the Datadog IAM role, policy document, and the Datadog-AWS integration with a single `terraform apply` command. - 1. Configure the [Datadog Terraform provider][2] to interact with the Datadog API through a Terraform configuration. -{{< site-region region="us,us3,us5,eu" >}} +**Note**: The `datadog_integration_aws_account` resource replaced the `datadog_integration_aws` resource in version `3.50.0` of the Datadog Terraform provider. To upgrade from the `datadog_integration_aws` resource, see [Upgrading from datadog_integration_aws resources][3]. +{{< site-region region="us,us3,us5,eu" >}} 2. Set up your Terraform configuration file using the example below as a base template. Ensure to update the following parameters before you apply the changes: * `AWS_PERMISSIONS_LIST`: The IAM policies needed by Datadog AWS integrations. The current list is available in the [Datadog AWS integration][1] documentation. * `AWS_ACCOUNT_ID`: Your AWS account ID. - See the [Datadog AWS integration resource][2] page in the Terraform registry for further example usage and the full list of optional parameters, as well as additional Datadog resources. - - ```hcl - data "aws_iam_policy_document" "datadog_aws_integration_assume_role" { - statement { - actions = ["sts:AssumeRole"] - - principals { - type = "AWS" - identifiers = ["arn:aws:iam::464622532012:root"] - } - condition { - test = "StringEquals" - variable = "sts:ExternalId" - - values = [ - "${datadog_integration_aws.sandbox.external_id}" - ] - } - } - } - - data "aws_iam_policy_document" "datadog_aws_integration" { - statement { - actions = [] - - resources = ["*"] - } - } - - resource "aws_iam_policy" "datadog_aws_integration" { - name = "DatadogAWSIntegrationPolicy" - policy = "${data.aws_iam_policy_document.datadog_aws_integration.json}" - } - - resource "aws_iam_role" "datadog_aws_integration" { - name = "DatadogAWSIntegrationRole" - description = "Role for Datadog AWS Integration" - assume_role_policy = "${data.aws_iam_policy_document.datadog_aws_integration_assume_role.json}" - } - - resource "aws_iam_role_policy_attachment" "datadog_aws_integration" { - role = "${aws_iam_role.datadog_aws_integration.name}" - policy_arn = "${aws_iam_policy.datadog_aws_integration.arn}" - } - - resource "aws_iam_role_policy_attachment" "datadog_aws_integration_security_audit" { - role = "${aws_iam_role.datadog_aws_integration.name}" - policy_arn = "arn:aws:iam::aws:policy/SecurityAudit" - } - - resource "datadog_integration_aws" "sandbox" { - account_id = "" - role_name = "DatadogAWSIntegrationRole" - } - ``` - - [1]: /integrations/amazon_web_services/?tab=manual#aws-iam-permissions - [2]: https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws +See the [Terraform Registry][2] for further example usage and the full list of optional parameters, as well as additional Datadog resources. + +```hcl +data "aws_iam_policy_document" "datadog_aws_integration_assume_role" { + statement { + actions = ["sts:AssumeRole"] + principals { + type = "AWS" + identifiers = ["arn:aws:iam::464622532012:root"] + } + condition { + test = "StringEquals" + variable = "sts:ExternalId" + values = [ + "${datadog_integration_aws_account.datadog_integration.auth_config.aws_auth_config_role.external_id}" + ] + } + } +} + +data "aws_iam_policy_document" "datadog_aws_integration" { + statement { + actions = [] + resources = ["*"] + } +} + +resource "aws_iam_policy" "datadog_aws_integration" { + name = "DatadogAWSIntegrationPolicy" + policy = data.aws_iam_policy_document.datadog_aws_integration.json +} +resource "aws_iam_role" "datadog_aws_integration" { + name = "DatadogIntegrationRole" + description = "Role for Datadog AWS Integration" + assume_role_policy = data.aws_iam_policy_document.datadog_aws_integration_assume_role.json +} +resource "aws_iam_role_policy_attachment" "datadog_aws_integration" { + role = aws_iam_role.datadog_aws_integration.name + policy_arn = aws_iam_policy.datadog_aws_integration.arn +} +resource "aws_iam_role_policy_attachment" "datadog_aws_integration_security_audit" { + role = aws_iam_role.datadog_aws_integration.name + policy_arn = "arn:aws:iam::aws:policy/SecurityAudit" +} + +resource "datadog_integration_aws_account" "datadog_integration" { + account_tags = [] + aws_account_id = "" + aws_partition = "aws" + aws_regions { + include_all = true + } + auth_config { + aws_auth_config_role { + role_name = "DatadogIntegrationRole" + } + } + resources_config { + cloud_security_posture_management_collection = true + extended_collection = true + } + traces_config { + xray_services { + } + } + logs_config { + lambda_forwarder { + } + } + metrics_config { + namespace_filters { + } + } +} +``` + +[1]: /integrations/amazon_web_services/?tab=manual#aws-iam-permissions +[2]: https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws_account {{< /site-region >}} {{< site-region region="ap1" >}} - 2. Set up your Terraform configuration file using the example below as a base template. Ensure to update the following parameters before you apply the changes: * `AWS_PERMISSIONS_LIST`: The IAM policies needed by Datadog AWS integrations. The current list is available in the [Datadog AWS integration][1] documentation. * `AWS_ACCOUNT_ID`: Your AWS account ID. - See the [Terraform Registry][2] for further example usage and the full list of optional parameters, as well as additional Datadog resources. - - ```hcl - data "aws_iam_policy_document" "datadog_aws_integration_assume_role" { - statement { - actions = ["sts:AssumeRole"] - - principals { - type = "AWS" - identifiers = ["arn:aws:iam::417141415827:root"] - } - condition { - test = "StringEquals" - variable = "sts:ExternalId" - - values = [ - "${datadog_integration_aws.sandbox.external_id}" - ] - } - } - } - - data "aws_iam_policy_document" "datadog_aws_integration" { - statement { - actions = [] - - resources = ["*"] - } - } - - resource "aws_iam_policy" "datadog_aws_integration" { - name = "DatadogAWSIntegrationPolicy" - policy = "${data.aws_iam_policy_document.datadog_aws_integration.json}" - } - - resource "aws_iam_role" "datadog_aws_integration" { - name = "DatadogAWSIntegrationRole" - description = "Role for Datadog AWS Integration" - assume_role_policy = "${data.aws_iam_policy_document.datadog_aws_integration_assume_role.json}" - } - - resource "aws_iam_role_policy_attachment" "datadog_aws_integration" { - role = "${aws_iam_role.datadog_aws_integration.name}" - policy_arn = "${aws_iam_policy.datadog_aws_integration.arn}" - } - - resource "datadog_integration_aws" "sandbox" { - account_id = "" - role_name = "DatadogAWSIntegrationRole" - } - ``` +See the [Terraform Registry][2] for further example usage and the full list of optional parameters, as well as additional Datadog resources. + +```hcl +data "aws_iam_policy_document" "datadog_aws_integration_assume_role" { + statement { + actions = ["sts:AssumeRole"] + principals { + type = "AWS" + identifiers = ["arn:aws:iam::417141415827:root"] + } + condition { + test = "StringEquals" + variable = "sts:ExternalId" + values = [ + "${datadog_integration_aws_account.datadog_integration.auth_config.aws_auth_config_role.external_id}" + ] + } + } +} + +data "aws_iam_policy_document" "datadog_aws_integration" { + statement { + actions = [] + resources = ["*"] + } +} + +resource "aws_iam_policy" "datadog_aws_integration" { + name = "DatadogAWSIntegrationPolicy" + policy = data.aws_iam_policy_document.datadog_aws_integration.json +} +resource "aws_iam_role" "datadog_aws_integration" { + name = "DatadogIntegrationRole" + description = "Role for Datadog AWS Integration" + assume_role_policy = data.aws_iam_policy_document.datadog_aws_integration_assume_role.json +} +resource "aws_iam_role_policy_attachment" "datadog_aws_integration" { + role = aws_iam_role.datadog_aws_integration.name + policy_arn = aws_iam_policy.datadog_aws_integration.arn +} +resource "aws_iam_role_policy_attachment" "datadog_aws_integration_security_audit" { + role = aws_iam_role.datadog_aws_integration.name + policy_arn = "arn:aws:iam::aws:policy/SecurityAudit" +} + +resource "datadog_integration_aws_account" "datadog_integration" { + account_tags = [] + aws_account_id = "" + aws_partition = "aws" + aws_regions { + include_all = true + } + auth_config { + aws_auth_config_role { + role_name = "DatadogIntegrationRole" + } + } + resources_config { + cloud_security_posture_management_collection = true + extended_collection = true + } + traces_config { + xray_services { + } + } + logs_config { + lambda_forwarder { + } + } + metrics_config { + namespace_filters { + } + } +} +``` [1]: /integrations/amazon_web_services/?tab=manual#aws-iam-permissions [2]: https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws {{< /site-region >}} {{< site-region region="gov" >}} +2. Set up your Terraform configuration file using the example below as a base template. Ensure to update the following parameters before you apply the changes: + * `AWS_PERMISSIONS_LIST`: The IAM policies needed by Datadog AWS integrations. The current list is available in the [Datadog AWS integration][1] documentation. + * `AWS_ACCOUNT_ID`: Your AWS account ID. -2. If you are using access keys to install the Datadog AWS integration, ensure that you have created an IAM user with the [necessary permissions][1] and access key as described in the [AWS manual setup guide][3]. Add your access key ID and secret access key to the placeholders in the example below. For information about using Terraform to set up the AWS user and associated access key, see the [AWS Provider][2] resources in the Terraform Registry. - - ``` - resource "datadog_integration_aws" "sandbox" { - access_key_id = "" - secret_access_key = "" - } - ``` +See the [Terraform Registry][2] for further example usage and the full list of optional parameters, as well as additional Datadog resources. + +```hcl +data "aws_iam_policy_document" "datadog_aws_integration_assume_role" { + statement { + actions = ["sts:AssumeRole"] + principals { + type = "AWS" + identifiers = ["arn:aws:iam::065115117704:root"] + } + condition { + test = "StringEquals" + variable = "sts:ExternalId" + values = [ + "${datadog_integration_aws_account.datadog_integration.auth_config.aws_auth_config_role.external_id}" + ] + } + } +} + +data "aws_iam_policy_document" "datadog_aws_integration" { + statement { + actions = [] + resources = ["*"] + } +} + +resource "aws_iam_policy" "datadog_aws_integration" { + name = "DatadogAWSIntegrationPolicy" + policy = data.aws_iam_policy_document.datadog_aws_integration.json +} +resource "aws_iam_role" "datadog_aws_integration" { + name = "DatadogIntegrationRole" + description = "Role for Datadog AWS Integration" + assume_role_policy = data.aws_iam_policy_document.datadog_aws_integration_assume_role.json +} +resource "aws_iam_role_policy_attachment" "datadog_aws_integration" { + role = aws_iam_role.datadog_aws_integration.name + policy_arn = aws_iam_policy.datadog_aws_integration.arn +} +resource "aws_iam_role_policy_attachment" "datadog_aws_integration_security_audit" { + role = aws_iam_role.datadog_aws_integration.name + policy_arn = "arn:aws:iam::aws:policy/SecurityAudit" +} + +resource "datadog_integration_aws_account" "datadog_integration" { + account_tags = [] + aws_account_id = "" + aws_partition = "aws" + aws_regions { + include_all = true + } + auth_config { + aws_auth_config_role { + role_name = "DatadogIntegrationRole" + } + } + resources_config { + cloud_security_posture_management_collection = true + extended_collection = true + } + traces_config { + xray_services { + } + } + logs_config { + lambda_forwarder { + } + } + metrics_config { + namespace_filters { + } + } +} +``` -[1]: /integrations/guide/aws-manual-setup/?tab=accesskeysgovcloudorchinaonly#aws-integration-iam-policy -[2]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs -[3]: /integrations/guide/aws-manual-setup/?tab=accesskeysgovcloudorchinaonly#aws -{{< /site-region>}} +[1]: /integrations/amazon_web_services/?tab=manual#aws-iam-permissions +[2]: https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws +{{< /site-region >}} -3. Run `terraform apply`. Wait up to 10 minutes for data to start being collected, and then view the out-of-the-box [AWS overview dashboard][5] to see metrics sent by your AWS services and infrastructure. +3. Run `terraform apply`. Wait up to 10 minutes for data to start being collected, and then view the out-of-the-box [AWS overview dashboard][4] to see metrics sent by your AWS services and infrastructure. {{< partial name="whats-next/whats-next.html" >}} [1]: https://www.terraform.io [2]: https://registry.terraform.io/providers/DataDog/datadog/latest/docs -[5]: https://app.datadoghq.com/screen/integration/7/aws-overview +[3]: https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws_account#upgrading-from-datadog_integration_aws-resources +[4]: https://app.datadoghq.com/screen/integration/7/aws-overview