AWS Datadog Forwarders Terraform module

Terraform module which creates resources to forward logs and metrics to Datadog on AWS.

The following resources are supported:

• Log Forwarder
• RDS Enhanced Monitoring Forwarder
• VPC Flow Log Forwarder
• Agent PrivateLink VPC Endpoint
• API PrivateLink VPC Endpoint
• Log Forwarder PrivateLink VPC Endpoint
• Metrics PrivateLink VPC Endpoint
• Process PrivateLink VPC Endpoint
• Traces PrivateLink VPC Endpoint

Please refer to the official Datadog datadog-serverless-functions for further information on the forwarder lambda functions, configuraion via environment variables, and integration with PrivateLink endpoints.

Security

There are several factors to keep in mind when working with and/or using this module that largely revolve around the decisions made based on security implications.

1. Based on the functionality provided by the Datadog team at datadog-serverless-functions, the recommended approach for providing your Datadog API key is through AWS Secrets Manager. The creation of this secret is not facilitated by this module and should be created manually (or through some other means where the secret is not passed as plain text into Terraform as input).
   • Note: even though this is not the recommended approach, the pattern used in the past of providing the DD_API_KEY as an environment variable is still supported by the module. Users are able to provde any and all environment variables to the forwarders through inputs (i.e. - log_forwarder_environment_variables) to configure the forwarders as desired. See settings.py for more details on what environment variables are supported to configure the forwarders.
2. The use of a KMS key to encrypt/decrypt API and APP keys is required by the rds_enhanced_monitoring_forwarder and vpc_flow_log_forwarder modules/functions per the upstream source at datadog-serverless-functions. The creation of a KMS key has been left out of this module so that users are able to better manage their KMS CMK key (and therefore the policies and usage of said key) as they see fit without over-complicating this module.
3. The roles and their permissions created by this module have several built in conditional checks in order to provide permission sets that allow the desired functionality while following the recommended approach of least privelege access. Nearly all attributes for the IAM roles and their permissions are accessible via inputs - even allowing users to provide their own IAM roles and/or policies to meet their organizational requirements.

Vendored Artifacts

Due to Terraform not dealing with dynamically created files, especially in ephemeral environments like CI/CD pipelines, the decision was made to vendor the Lambda function artifacts within the VPC Flow Log and RDS Enhanced Monitoring modules to avoid issues. When the upstream artifacts are hosted as zipped archives available on GitHub, similar to the Log Forwarder, then this vendoring hack will be removed in favor of pulling directly from the project. Ref Issue #374

Usage

See examples directory for working examples to reference:

# Note: you will need to create this secret manually prior to running
# This avoids having to pass the key to Terraform in plaintext
data "aws_secretsmanager_secret" "datadog_api_key" {
  name = "datadog/api_key"
}

module "datadog_forwarders" {
  source  = "terraform-aws-modules/datadog-forwarders/aws"

  kms_alias             = "alias/datadog" # KMS key will need to be created outside of module
  dd_api_key_secret_arn = data.aws_secretsmanager_secret.datadog_api_key.arn

  tags = {
    Terraform   = "true"
    Environment = "dev"
  }
}

Examples

Examples codified under the examples are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module(s). If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!

• Complete
• Simple

Requirements

Providers

Modules

Resources

Inputs

{
  "sse_algorithm": "AES256"
}

[
  "arm64"
]

[
  "arm64"
]

[
  "arm64"
]

Outputs

License

Apache-2.0 Licensed. See LICENSE.