[DOCS-14545] Add AWS Lambda to the AWS integration instrumentation guides - #39708
Draft
tedkahwaji wants to merge 6 commits into
Draft
[DOCS-14545] Add AWS Lambda to the AWS integration instrumentation guides#39708tedkahwaji wants to merge 6 commits into
tedkahwaji wants to merge 6 commits into
Conversation
github-actions
Bot
added
Architecture
Contributor
Preview links (active after the
|
tedkahwaji
marked this pull request as draft
September 3, 2026 16:23
…ides Expand the AWS integration instrumentation guide and technical reference to cover AWS Lambda functions alongside Amazon EC2 instances: - Per-workload prerequisites, including supported Lambda runtimes, architectures, package type, partition, and the layer limit - Per-workload IAM permission tables, with change-notification permissions split out as shared - What Datadog changes on a function, and the workload identity federation model that avoids writing an API key into the function - Lambda reconciliation, layer version rollout, and checkpoint-based uninstall - Lambda troubleshooting, including exclusivity with remote instrumentation Generalize the aws-agent-installation shortcode to describe permissions per workload. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ording - Rule coverage is fixed at save time for Lambda as well as EC2: the UI sends is_frozen on create and update for every workload. Removes the open question and restores the workload-agnostic wording. - Link out to the existing serverless Lambda docs for extension configuration, monitoring features, and troubleshooting. - Reword implementation details that read as internal: intake mapping reconciliation, permissions boundaries, and control-plane throttling. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Lambda instrumentation authenticates through Workload Identity Federation, but neither page linked the WIF documentation. Adds the link inline and to further reading on both pages, and states that Datadog sets up the authorization so there is nothing for the customer to configure. Flags a pre-publish dependency: WIF for intake is documented as Enterprise-only, and Lambda instrumentation needs it available to the orgs this feature targets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Drops the pre-publish caveat about Enterprise-only gating for Workload Identity Federation; these pages stay gated with private: true until the rollout, by which point the gate is lifted. Also names Workload Identity Federation in the AWS partition prerequisite, which described it as "cloud-based authentication", and links it there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add a comparison section to the setup guide covering where the work runs, how functions are selected, layer version control, credentials, and removal, plus a pointer to it from the technical reference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tedkahwaji
force-pushed
the
teddy/docs14545-aws-lambda-instrumentation
branch
from
September 4, 2026 16:21
0ebf59e to
746639d
Compare
The header row began with an empty cell, which Hugo drops, shifting the header labels one column left and leaving the third column unlabeled. Also scope the authentication row to the function, since the stack's EventBridge connection does hold Datadog keys in the account, and keep the "what runs in your account" row to compute only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Fixes DOCS-14545
Expands #39078 (Amazon EC2 only) to cover AWS Lambda functions, now that managed Lambda instrumentation is available as a workload in the same AWS integration flow. Both pages stay gated with
private: true.hugo/content/en/integrations/guide/aws-agent-installation.md:awspartition, Zip package type, architecture, the AWS five-layer limit, and the supported runtime matrix.DD_SITE/DD_ORG_UUID, handler redirection for Node.js and Python, exec wrapper for Java and .NET) and notes that no Datadog API key is written into the function.hugo/content/en/integrations/guide/aws-agent-installation-technical-reference.md:hugo/layouts/shortcodes/aws-agent-installation.en.md: describes the required permissions per workload, since the CloudFormation stack grants only the permissions for the workloads selected.Both page titles now say "Datadog Instrumentation" rather than "the Datadog Agent", since on Lambda the product installs layers rather than the Agent. Filenames and URLs are unchanged.
Also links out to the existing serverless Lambda documentation for extension configuration, monitoring features, and troubleshooting, so a customer who finishes this flow knows where to tune what the extension collects.
Rule coverage is fixed at save time for Lambda the same way it is for EC2 (the resource-selection flow sends
is_frozenon create and update for every workload), so that section stays workload-agnostic.Two
TODO(DOCS-14545)comments are added for pre-publish follow-ups: the "How it works" diagram and the setup-toggle screenshot are both EC2-only and predate the Lambda workload.Preview
Merge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Claude Code was used to read the implementation across the instrumenter services and the AWS Quick Start template, and to draft the documentation changes. All content was reviewed against the source.
Additional notes
Both pages remain gated with
private: trueand must be un-gated together, since they cross-link. The screenshots and diagram should be refreshed for the Lambda workload before publish.