main.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Datadog AWS Integration
Parameters:
  ExternalId:
    Description: >-
      External ID for the Datadog role (generate at
      https://app.datadoghq.com/account/settings#integrations/amazon-web-services)
    Type: String
    AllowedPattern: .+
    ConstraintDescription: ExternalId is required
  DdApiKey:
    Description: >-
      API key for the Datadog account (find at
      https://app.datadoghq.com/account/settings#api)
      It will be stored in AWS Secrets Manager securely. If DdApiKeySecretArn is also set, this value is ignored.
    Type: String
    NoEcho: true
    Default: ''
  DdApiKeySecretArn:
    Type: String
    AllowedPattern: '(arn:.*:secretsmanager:.*)?'
    Default: ''
    Description: The ARN of the secret storing the Datadog API key, if you already have it stored in Secrets Manager. You must store the secret as a plaintext, rather than a key-value pair.
  DdSite:
    Type: String
    Default: datadoghq.com
    Description: Define your Datadog Site to send data to. For the Datadog EU site, set to datadoghq.eu
    AllowedPattern: .+
    ConstraintDescription: DdSite is required
  IAMRoleName:
    Description: Customize the name of IAM role for Datadog AWS integration
    Type: String
    Default: DatadogIntegrationRole
  BasePermissions:
    Description: >-
      Customize the base permissions for the Datadog IAM role.
      Select "Core" to only grant Datadog permissions to a very limited set of metrics and metadata (not recommended).
    Type: String
    Default: Full
    AllowedValues:
      - Full
      - Core
  LogArchives:
    Description: >-
      S3 paths to store log archives for log rehydration. Separate multiple paths with comma,
      e.g., "my-bucket,my-bucket-with-path/path". Permissions will be automatically added to
      the Datadog integration IAM role. https://docs.datadoghq.com/logs/archives/rehydrating/?tab=awss3
    Type: String
    Default: ''
  CloudTrails:
    Description: >-
      S3 buckets for Datadog CloudTrail integration. Separate multiple buckets with comma,
      e.g., "bucket1,bucket2". Permissions will be automatically added to the Datadog integration IAM role.
      https://docs.datadoghq.com/integrations/amazon_cloudtrail/
    Type: String
    Default: ''
  DdAWSAccountId:
    Description: >-
      Datadog AWS account ID allowed to assume the integration IAM role. DO NOT CHANGE!
    Type: String
    Default: '464622532012'
  DdForwarderName:
    Type: String
    Default: DatadogForwarder
    Description: >-
      The Datadog Forwarder Lambda function name. DO NOT change when updating an existing CloudFormation stack,
      otherwise the current forwarder function will be replaced and all the triggers will be lost.
  InstallDatadogPolicyMacro:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    Description: If you already deployed a stack using this template, set this parameter to "false" to skip the installation of the DatadogPolicy Macro again.
  CloudSecurityPostureManagementPermissions:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: >-
      Set this value to "true" to add permissions for Datadog to monitor your AWS cloud resource configurations.
      You need this set to "true" to use Cloud Security Posture Management. You will also need "BasePermissions" set to "Full".
Conditions:
  ShouldInstallDatadogPolicyMacro:
    Fn::Equals:
      - Ref: InstallDatadogPolicyMacro
      - true
  WillCreateDdApiKeySecretArn:
    Fn::Equals:
      - Ref: DdApiKeySecretArn
      - ''
Rules:
  MustSetDdApiKey:
    Assertions:
      - Assert:
          Fn::Or:
            - Fn::Not:
                - Fn::Equals:
                    - Ref: DdApiKey
                    - ''
            - Fn::Not:
                - Fn::Equals:
                    - Ref: DdApiKeySecretArn
                    - ''
        AssertDescription: DdApiKey or DdApiKeySecretArn must be set
Resources:
  # A Macro used to generate policies for the integration IAM role based on user inputs
  DatadogPolicyMacroStack:
    Type: AWS::CloudFormation::Stack
    Condition: ShouldInstallDatadogPolicyMacro
    Properties:
      TemplateURL: 'https://<BUCKET_PLACEHOLDER>.s3.amazonaws.com/aws/datadog_policy_macro.yaml'
  # The IAM role for Datadog integration
  DatadogIntegrationRoleStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: 'https://<BUCKET_PLACEHOLDER>.s3.amazonaws.com/aws/datadog_integration_role.yaml'
      Parameters:
        ExternalId: !Ref ExternalId
        BasePermissions: !Ref BasePermissions
        IAMRoleName: !Ref IAMRoleName
        LogArchives: !Ref LogArchives
        CloudTrails: !Ref CloudTrails
        CloudSecurityPostureManagementPermissions: !Ref CloudSecurityPostureManagementPermissions
        DdAWSAccountId: !Ref DdAWSAccountId
      Tags:
        - # A trick to create a conditional dependency on DatadogPolicyMacroStack
          # https://stackoverflow.com/questions/34607476/cloudformation-apply-condition-on-dependson
          Key: 'DatadogPolicyMacroStackId'
          Value:
            !If [
              ShouldInstallDatadogPolicyMacro,
              !Ref DatadogPolicyMacroStack,
              'null',
            ]
  # The Lambda function to ship logs from S3 and CloudWatch, custom metrics and traces from Lambda functions to Datadog
  # https://github.com/DataDog/datadog-serverless-functions/tree/master/aws/logs_monitoring
  ForwarderStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: 'https://datadog-cloudformation-template.s3.amazonaws.com/aws/forwarder/latest.yaml'
      Parameters:
        DdApiKey: !Ref DdApiKey
        DdApiKeySecretArn:
          !If [
            WillCreateDdApiKeySecretArn,
            'arn:aws:secretsmanager:DEFAULT',
            !Ref DdApiKeySecretArn,
          ]
        DdSite: !Ref DdSite
        FunctionName: !Ref DdForwarderName
Outputs:
  IAMRoleName:
    Description: AWS IAM Role named to be used with the DataDog AWS Integration
    Value: !Ref IAMRoleName
  AccountId:
    Description: AWS Account number
    Value: !Ref 'AWS::AccountId'
  Region:
    Description: AWS Region
    Value: !Ref 'AWS::Region'
  DatadogForwarderArn:
    Description: Datadog Forwarder Lambda Function ARN
    Value:
      Fn::GetAtt:
        - ForwarderStack
        - Outputs.DatadogForwarderArn
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-DatadogForwarderArn
  DdApiKeySecretArn:
    Description: ARN of SecretsManager Secret with Datadog API Key
    Value:
      Fn::GetAtt:
        - ForwarderStack
        - Outputs.DdApiKeySecretArn
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-ApiKeySecretArn
    Condition: WillCreateDdApiKeySecretArn
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Required
        Parameters:
          - IAMRoleName
          - ExternalId
          - DdApiKey
          - DdApiKeySecretArn
          - BasePermissions
          - DdSite
      - Label:
          default: Optional
        Parameters:
          - LogArchives
          - CloudTrails
          - CloudSecurityPostureManagementPermissions
      - Label:
          default: Advanced
        Parameters:
          - DdAWSAccountId
          - DdForwarderName
          - InstallDatadogPolicyMacro
    ParameterLabels:
      ExternalId:
        default: 'ExternalId *'
      DdApiKey:
        default: 'DdApiKey *'
      DdSite:
        default: 'DdSite *'