├── .gitignore
├── outputs.tf
├── versions.tf
├── locals.tf
├── release.config.js
├── examples
    ├── cloudwatch_log_sync
    │   └── main.tf
    └── full_integration
    │   └── main.tf
├── logs_monitoring_cloudtrail.tf
├── logs_monitoring_cloudwatch_log.tf
├── LICENSE
├── logs_monitoring.tf
├── .github
    └── workflows
    │   └── terraform_and_release.yml
├── logs_monitoring_elb.tf
├── CODE_OF_CONDUCT.md
├── vars.tf
├── main.tf
├── README.md
└── CHANGELOG.md


/.gitignore:
--------------------------------------------------------------------------------
1 | # Local .terraform directories
2 | **/.terraform/*
3 | 
4 | *.tfstate
5 | *.tfstate.*
6 | 
7 | .idea/
8 | 


--------------------------------------------------------------------------------
/outputs.tf:
--------------------------------------------------------------------------------
1 | output "datadog_logs_monitoring_lambda_function_name" {
2 |   value = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
3 | }
4 | output "datadog_iam_role" {
5 |   value = var.enable_datadog_aws_integration ? aws_iam_role.datadog-integration[0].name : ""
6 | }
7 | 


--------------------------------------------------------------------------------
/versions.tf:
--------------------------------------------------------------------------------
 1 | terraform {
 2 |   required_version = ">= 0.13"
 3 | 
 4 |   required_providers {
 5 |     datadog = {
 6 |       source  = "DataDog/datadog"
 7 |       version = ">= 2.10, < 4"
 8 |     }
 9 | 
10 |     aws = {
11 |       source  = "hashicorp/aws"
12 |       version = ">= 4.0"
13 |     }
14 |   }
15 | }
16 | 


--------------------------------------------------------------------------------
/locals.tf:
--------------------------------------------------------------------------------
 1 | locals {
 2 |   stack_prefix = var.env == "" ? "" : "${join("-", compact([var.namespace, var.env]))}-"
 3 |   default_tags = {
 4 |     env       = var.env
 5 |     namespace = var.namespace
 6 |     terraform = "true"
 7 |   }
 8 |   log_groups_to_use = length(var.log_group_prefixes) > 0 ? var.log_group_prefixes : var.cloudwatch_log_groups
 9 | }
10 | 


--------------------------------------------------------------------------------
/release.config.js:
--------------------------------------------------------------------------------
 1 | module.exports = {
 2 |   "plugins": [
 3 |     "@semantic-release/commit-analyzer",
 4 |     "@semantic-release/release-notes-generator",
 5 |     [
 6 |       "@semantic-release/changelog",
 7 |       {
 8 |         "changelogFile": "CHANGELOG.md"
 9 |       }
10 |     ],
11 |     "@semantic-release/github",
12 |     [
13 |       "@semantic-release/git",
14 |       {
15 |         "assets": [
16 |           "CHANGELOG.md"
17 |         ],
18 |         "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
19 |       }
20 |     ]
21 |   ]
22 | };
23 | 


--------------------------------------------------------------------------------
/examples/cloudwatch_log_sync/main.tf:
--------------------------------------------------------------------------------
 1 | variable "dd_api_key" {
 2 |   type    = string
 3 |   default = "1234567890"
 4 | }
 5 | 
 6 | variable "dd_app_key" {
 7 |   type    = string
 8 |   default = "1234567890"
 9 | }
10 | 
11 | variable "aws_region" {
12 |   type    = string
13 |   default = "us-west-2"
14 | }
15 | 
16 | provider "datadog" {
17 |   api_key = var.dd_api_key
18 |   app_key = var.dd_app_key
19 | }
20 | 
21 | provider "aws" {
22 |   region = var.aws_region
23 | }
24 | 
25 | module "datadog" {
26 |   source                         = "scribd/datadog/aws"
27 |   version                        = "~>1"
28 |   datadog_api_key                = var.dd_api_key
29 |   aws_region                     = var.aws_region
30 |   create_elb_logs_bucket         = false
31 |   enable_datadog_aws_integration = false
32 |   cloudwatch_log_groups          = ["cloudwatch_log_group_1", "cloudwatch_log_group_2"]
33 | }
34 | 


--------------------------------------------------------------------------------
/logs_monitoring_cloudtrail.tf:
--------------------------------------------------------------------------------
 1 | # Make lambda function accept invokes from S3
 2 | resource "aws_lambda_permission" "allow-ctbucket-trigger" {
 3 |   count         = var.cloudtrail_bucket_id != "" ? 1 : 0
 4 |   statement_id  = "AllowExecutionFromCTBucket"
 5 |   action        = "lambda:InvokeFunction"
 6 |   function_name = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
 7 |   principal     = "s3.amazonaws.com"
 8 |   source_arn    = var.cloudtrail_bucket_arn
 9 | }
10 | 
11 | # Tell S3 bucket to invoke DD lambda once an object is created/modified
12 | resource "aws_s3_bucket_notification" "ctbucket-notification-dd-log" {
13 |   count  = var.cloudtrail_bucket_id != "" ? 1 : 0
14 |   bucket = var.cloudtrail_bucket_id
15 | 
16 |   lambda_function {
17 |     lambda_function_arn = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
18 |     events              = ["s3:ObjectCreated:*"]
19 |   }
20 | }
21 | 


--------------------------------------------------------------------------------
/examples/full_integration/main.tf:
--------------------------------------------------------------------------------
 1 | variable "dd_api_key" {
 2 |   type    = string
 3 |   default = "1234567890"
 4 | }
 5 | 
 6 | variable "dd_app_key" {
 7 |   type    = string
 8 |   default = "1234567890"
 9 | }
10 | 
11 | variable "aws_region" {
12 |   type    = string
13 |   default = "us-west-2"
14 | }
15 | 
16 | provider "datadog" {
17 |   api_key = var.dd_api_key
18 |   app_key = var.dd_app_key
19 | }
20 | 
21 | provider "aws" {
22 |   region = var.aws_region
23 | }
24 | 
25 | data "aws_caller_identity" "current" {}
26 | 
27 | module "datadog" {
28 |   source          = "scribd/datadog/aws"
29 |   version         = "~>3"
30 |   aws_region      = var.aws_region
31 |   datadog_api_key = var.dd_api_key
32 |   aws_account_id  = data.aws_caller_identity.current.account_id
33 | 
34 |   cloudtrail_bucket_id  = "S3_BUCKET_ID"
35 |   cloudtrail_bucket_arn = "S3_BUCKET_ARN"
36 | 
37 |   cloudwatch_log_groups = ["cloudwatch_log_group_1", "cloudwatch_log_group_2"]
38 |   tags = {
39 |     Module = "scribd/datadog/aws"
40 |   }
41 | }
42 | 


--------------------------------------------------------------------------------
/logs_monitoring_cloudwatch_log.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_cloudwatch_log_subscription_filter" "test_lambdafunction_logfilter" {
 2 |   for_each        = { for lg in var.cloudwatch_log_groups : lg => lg }
 3 |   name            = "${each.value}-filter"
 4 |   log_group_name  = each.value
 5 |   filter_pattern  = ""
 6 |   destination_arn = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
 7 |   distribution    = "Random"
 8 | }
 9 | 
10 | resource "aws_lambda_permission" "allow_cloudwatch_logs_to_call_dd_lambda_handler" {
11 |   for_each      = { for lg in local.log_groups_to_use : lg => lg }
12 |   statement_id  = "${substr(replace(replace(each.value, "/aws/lambda", ""), "/", "_"), 1, 67)}-CW"
13 |   action        = "lambda:InvokeFunction"
14 |   function_name = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
15 |   principal     = "logs.${var.aws_region}.amazonaws.com"
16 |   source_arn = (length(var.log_group_prefixes) > 0 ?
17 |     "arn:aws:logs:${var.aws_region}:${var.aws_account_id}:log-group:${each.value}*" :
18 |   "arn:aws:logs:${var.aws_region}:${var.aws_account_id}:log-group:${each.value}:*")
19 | }
20 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) Scribd, Inc
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/logs_monitoring.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_cloudformation_stack" "datadog-forwarder" {
 2 |   name         = "${local.stack_prefix}datadog-forwarder"
 3 |   capabilities = ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM", "CAPABILITY_AUTO_EXPAND"]
 4 |   parameters = {
 5 |     DdApiKeySecretArn = aws_secretsmanager_secret.datadog_api_key.arn
 6 |     DdApiKey          = "dummy-value"
 7 |     DdTags            = "namespace:${var.namespace},env:${var.env}"
 8 |     DdSite            = var.dd_forwarder_dd_site
 9 |     ExcludeAtMatch    = var.log_exclude_at_match
10 |     FunctionName      = "${local.stack_prefix}datadog-forwarder"
11 |   }
12 |   template_url = "https://datadog-cloudformation-template.s3.amazonaws.com/aws/forwarder/${var.dd_forwarder_template_version}.yaml"
13 |   tags         = merge(local.default_tags, var.tags)
14 | 
15 |   lifecycle {
16 |     ignore_changes = [
17 |       parameters["DdApiKey"]
18 |     ]
19 |   }
20 | }
21 | 
22 | resource "aws_secretsmanager_secret" "datadog_api_key" {
23 |   name_prefix = "${local.stack_prefix}datadog-api-key"
24 |   description = "Datadog API Key"
25 |   tags        = merge(local.default_tags, var.tags)
26 | }
27 | 
28 | resource "aws_secretsmanager_secret_version" "datadog_api_key" {
29 |   secret_id     = aws_secretsmanager_secret.datadog_api_key.id
30 |   secret_string = var.datadog_api_key
31 | }
32 | 


--------------------------------------------------------------------------------
/.github/workflows/terraform_and_release.yml:
--------------------------------------------------------------------------------
 1 | name: 'CICD'
 2 | on:
 3 |   push:
 4 |   pull_request:
 5 | jobs:
 6 |   terraform:
 7 |     name: 'Terraform'
 8 |     runs-on: ubuntu-latest
 9 |     steps:
10 |       - name: 'Checkout'
11 |         uses: actions/checkout@master
12 | 
13 |       - uses: hashicorp/setup-terraform@v1
14 |         with:
15 |           terraform_version: 0.13.x
16 | 
17 |       - run: terraform fmt
18 |       - run: terraform init
19 | 
20 |       - name: 'Inject provider configs for validate command'
21 |         run: |
22 |             cat > providers.tf <<EOF
23 |             provider "aws" {
24 |               region = "us-east-2"
25 |             }
26 | 
27 |             provider "datadog" {
28 |               api_key = ""
29 |               app_key = ""
30 |             }
31 |             EOF
32 | 
33 |       - run: terraform validate
34 | 
35 |   release:
36 |     if: github.event_name == 'push'
37 |     needs: terraform
38 |     runs-on: ubuntu-latest
39 |     steps:
40 |     - uses: actions/checkout@v2
41 |     - name: Semantic Release
42 |       id: semantic
43 |       uses: cycjimmy/semantic-release-action@v2
44 |       env:
45 |         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
46 |       with:
47 |         semantic_version: 19
48 |         extra_plugins: |
49 |           @semantic-release/changelog@6
50 |           @semantic-release/git@10
51 | 


--------------------------------------------------------------------------------
/logs_monitoring_elb.tf:
--------------------------------------------------------------------------------
 1 | # Make lambda function accept invokes from S3
 2 | resource "aws_lambda_permission" "allow-elblog-trigger" {
 3 |   count         = var.create_elb_logs_bucket ? 1 : 0
 4 |   statement_id  = "AllowExecutionFromELBLogBucket"
 5 |   action        = "lambda:InvokeFunction"
 6 |   function_name = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
 7 |   principal     = "s3.amazonaws.com"
 8 |   source_arn    = aws_s3_bucket.elb_logs[0].arn
 9 | }
10 | 
11 | # Tell S3 bucket to invoke DD lambda once an object is created/modified
12 | resource "aws_s3_bucket_notification" "elblog-notification-dd-log" {
13 |   count  = var.create_elb_logs_bucket ? 1 : 0
14 |   bucket = aws_s3_bucket.elb_logs[0].id
15 | 
16 |   lambda_function {
17 |     lambda_function_arn = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
18 |     events              = ["s3:ObjectCreated:*"]
19 |   }
20 | }
21 | 
22 | data "aws_elb_service_account" "main" {}
23 | 
24 | locals {
25 |   elb_logs_s3_bucket = "${var.elb_logs_bucket_prefix}-${var.namespace}-${var.env}-elb-logs"
26 | }
27 | 
28 | data "aws_iam_policy_document" "elb_logs" {
29 |   statement {
30 |     actions = [
31 |       "s3:PutObject"
32 |     ]
33 |     resources = [
34 |       "arn:aws:s3:::${local.elb_logs_s3_bucket}/*",
35 |     ]
36 |     principals {
37 |       type        = "AWS"
38 |       identifiers = [data.aws_elb_service_account.main.arn]
39 |     }
40 |     effect = "Allow"
41 |   }
42 | }
43 | 
44 | resource "aws_s3_bucket" "elb_logs" {
45 |   count  = var.create_elb_logs_bucket ? 1 : 0
46 |   bucket = local.elb_logs_s3_bucket
47 |   tags   = merge(local.default_tags, var.tags)
48 | 
49 | }
50 | 
51 | resource "aws_s3_bucket_policy" "elb_logs" {
52 |   count  = var.create_elb_logs_bucket ? 1 : 0
53 |   bucket = aws_s3_bucket.elb_logs[0].id
54 |   policy = data.aws_iam_policy_document.elb_logs.json
55 | }
56 | 
57 | resource "aws_s3_bucket_lifecycle_configuration" "elb_logs" {
58 |   count  = var.create_elb_logs_bucket ? 1 : 0
59 |   bucket = aws_s3_bucket.elb_logs[0].id
60 | 
61 |   # Remove old versions of images after 15 days
62 |   rule {
63 |     id = "log"
64 |     transition {
65 |       days          = 30
66 |       storage_class = "STANDARD_IA" # or "ONEZONE_IA"
67 |     }
68 | 
69 |     transition {
70 |       days          = 60
71 |       storage_class = "GLACIER"
72 |     }
73 | 
74 |     expiration {
75 |       days = 365 # store logs for one year
76 |     }
77 |     status = "Enabled"
78 |   }
79 | }
80 | 
81 | resource "aws_s3_bucket_server_side_encryption_configuration" "elb_logs" {
82 |   count  = var.create_elb_logs_bucket ? 1 : 0
83 |   bucket = aws_s3_bucket.elb_logs[0].id
84 | 
85 |   rule {
86 |     apply_server_side_encryption_by_default {
87 |       sse_algorithm = "AES256"
88 |     }
89 |   }
90 | }
91 | 


--------------------------------------------------------------------------------
/CODE_OF_CONDUCT.md:
--------------------------------------------------------------------------------
 1 | # Contributor Covenant Code of Conduct
 2 | 
 3 | ## Our Pledge
 4 | 
 5 | In the interest of fostering an open and welcoming environment, we as
 6 | contributors and maintainers pledge to making participation in our project and
 7 | our community a harassment-free experience for everyone, regardless of age, body
 8 | size, disability, ethnicity, sex characteristics, gender identity and expression,
 9 | level of experience, education, socio-economic status, nationality, personal
10 | appearance, race, religion, or sexual identity and orientation.
11 | 
12 | ## Our Standards
13 | 
14 | Examples of behavior that contributes to creating a positive environment
15 | include:
16 | 
17 | * Using welcoming and inclusive language
18 | * Being respectful of differing viewpoints and experiences
19 | * Gracefully accepting constructive criticism
20 | * Focusing on what is best for the community
21 | * Showing empathy towards other community members
22 | 
23 | Examples of unacceptable behavior by participants include:
24 | 
25 | * The use of sexualized language or imagery and unwelcome sexual attention or
26 |  advances
27 | * Trolling, insulting/derogatory comments, and personal or political attacks
28 | * Public or private harassment
29 | * Publishing others' private information, such as a physical or electronic
30 |  address, without explicit permission
31 | * Other conduct which could reasonably be considered inappropriate in a
32 |  professional setting
33 | 
34 | ## Our Responsibilities
35 | 
36 | Project maintainers are responsible for clarifying the standards of acceptable
37 | behavior and are expected to take appropriate and fair corrective action in
38 | response to any instances of unacceptable behavior.
39 | 
40 | Project maintainers have the right and responsibility to remove, edit, or
41 | reject comments, commits, code, wiki edits, issues, and other contributions
42 | that are not aligned to this Code of Conduct, or to ban temporarily or
43 | permanently any contributor for other behaviors that they deem inappropriate,
44 | threatening, offensive, or harmful.
45 | 
46 | ## Scope
47 | 
48 | This Code of Conduct applies both within project spaces and in public spaces
49 | when an individual is representing the project or its community. Examples of
50 | representing a project or community include using an official project e-mail
51 | address, posting via an official social media account, or acting as an appointed
52 | representative at an online or offline event. Representation of a project may be
53 | further defined and clarified by project maintainers.
54 | 
55 | ## Enforcement
56 | 
57 | Instances of abusive, harassing, or otherwise unacceptable behavior may be
58 | reported by contacting the project team at rtyler@scribd.com. All
59 | complaints will be reviewed and investigated and will result in a response that
60 | is deemed necessary and appropriate to the circumstances. The project team is
61 | obligated to maintain confidentiality with regard to the reporter of an incident.
62 | Further details of specific enforcement policies may be posted separately.
63 | 
64 | Project maintainers who do not follow or enforce the Code of Conduct in good
65 | faith may face temporary or permanent repercussions as determined by other
66 | members of the project's leadership.
67 | 
68 | ## Attribution
69 | 
70 | This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
71 | available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
72 | 
73 | [homepage]: https://www.contributor-covenant.org
74 | 
75 | For answers to common questions about this code of conduct, see
76 | https://www.contributor-covenant.org/faq


--------------------------------------------------------------------------------
/vars.tf:
--------------------------------------------------------------------------------
  1 | variable "aws_account_id" {
  2 |   description = "The ID of the AWS account to create the integration for"
  3 |   type        = string
  4 |   default     = "" # only needed if enable_datadog_aws_integration is set to true
  5 | }
  6 | variable "aws_region" {
  7 |   description = "AWS Region"
  8 |   type        = string
  9 |   default     = "us-east-2"
 10 | }
 11 | variable "cloudtrail_bucket_id" {
 12 |   description = "The Cloudtrail bucket ID. Use only from org master account."
 13 |   type        = string
 14 |   default     = ""
 15 | }
 16 | variable "cloudtrail_bucket_arn" {
 17 |   description = "The Cloudtrail bucket ID. Use only from org master account"
 18 |   type        = string
 19 |   default     = ""
 20 | }
 21 | variable "datadog_api_key" {
 22 |   description = "The API key for the datadog integration."
 23 |   type        = string
 24 | }
 25 | variable "namespace" {
 26 |   description = "The namespace tag to apply to all data sent to datadog"
 27 |   type        = string
 28 |   default     = ""
 29 | }
 30 | variable "create_elb_logs_bucket" {
 31 |   description = "Create S3 bucket for ELB log sync"
 32 |   default     = true
 33 |   type        = bool
 34 | }
 35 | variable "cloudwatch_log_groups" {
 36 |   description = "Sync logs from cloudwatch by given list of log groups"
 37 |   type        = list(string)
 38 |   default     = []
 39 | }
 40 | variable "log_group_prefixes" {
 41 |   description = "List of CloudWatch Log Group prefixes to create lambda permissions"
 42 |   type        = list(string)
 43 |   default     = []
 44 | }
 45 | variable "enable_datadog_aws_integration" {
 46 |   description = "Use datadog provider to give datadog aws account access to our resources"
 47 |   type        = bool
 48 |   default     = true
 49 | }
 50 | variable "env" {
 51 |   description = "The env tag to apply to all data sent to datadog"
 52 |   type        = string
 53 |   default     = ""
 54 | }
 55 | variable "account_specific_namespace_rules" {
 56 |   description = "account_specific_namespace_rules argument for datadog_integration_aws resource"
 57 |   type        = map(any)
 58 |   default     = {}
 59 | }
 60 | variable "elb_logs_bucket_prefix" {
 61 |   description = "Prefix for ELB logs S3 bucket name"
 62 |   type        = string
 63 |   default     = "awsdd"
 64 | }
 65 | variable "log_exclude_at_match" {
 66 |   description = "Sets EXCLUDE_AT_MATCH environment variable, which allows excluding unwanted log lines"
 67 |   type        = string
 68 |   default     = "$x^" # <- never matches anything
 69 | }
 70 | 
 71 | variable "dd_forwarder_template_version" {
 72 |   description = "Sets Datadog Forwarder version to use"
 73 |   type        = string
 74 |   default     = "3.100.0"
 75 | }
 76 | 
 77 | variable "dd_forwarder_dd_site" {
 78 |   type        = string
 79 |   default     = "datadoghq.com"
 80 |   description = "Define your Datadog Site to send data to. For the Datadog EU site, set to datadoghq.eu"
 81 | }
 82 | 
 83 | variable "excluded_regions" {
 84 |   description = "An array of AWS regions to exclude from metrics collection"
 85 |   type        = list(string)
 86 |   default     = []
 87 | }
 88 | 
 89 | variable "filter_tags" {
 90 |   description = "Array of EC2 tags (in the form key:value) defines a filter that Datadog use when collecting metrics from EC2. Wildcards, such as ? (for single characters) and * (for multiple characters) can also be used. Only hosts that match one of the defined tags will be imported into Datadog. The rest will be ignored."
 91 |   type        = list(string)
 92 |   default     = []
 93 | }
 94 | 
 95 | variable "extra_policy_arns" {
 96 |   description = "Extra policy arns to attach to the datadog-integration-role"
 97 |   type        = list(string)
 98 |   default     = []
 99 | }
100 | 
101 | variable "tags" {
102 |   description = "A map of tags to assign to resources."
103 |   type        = map(string)
104 |   default     = {}
105 | }
106 | 


--------------------------------------------------------------------------------
/main.tf:
--------------------------------------------------------------------------------
  1 | ## This tf file will setup Datadog AWS integration
  2 | 
  3 | resource "datadog_integration_aws" "core" {
  4 |   count      = var.enable_datadog_aws_integration ? 1 : 0
  5 |   account_id = var.aws_account_id
  6 |   role_name  = "datadog-integration-role"
  7 | 
  8 |   host_tags = [
  9 |     "Namespace:${var.namespace}",
 10 |     "env:${var.env}"
 11 |   ]
 12 | 
 13 |   account_specific_namespace_rules = var.account_specific_namespace_rules
 14 |   excluded_regions                 = var.excluded_regions
 15 |   filter_tags                      = var.filter_tags
 16 | }
 17 | 
 18 | resource "aws_iam_role" "datadog-integration" {
 19 |   count = var.enable_datadog_aws_integration ? 1 : 0
 20 |   name  = "datadog-integration-role"
 21 | 
 22 |   assume_role_policy = <<EOF
 23 | {
 24 |   "Version": "2012-10-17",
 25 |   "Statement": [
 26 |     {
 27 |       "Effect": "Allow",
 28 |       "Principal": {
 29 |         "AWS": "arn:aws:iam::464622532012:root"
 30 |       },
 31 |       "Action": "sts:AssumeRole",
 32 |       "Condition": {
 33 |         "StringEquals": {
 34 |           "sts:ExternalId": "${datadog_integration_aws.core[0].external_id}"
 35 |         }
 36 |       }
 37 |     }
 38 |   ]
 39 | }
 40 | EOF
 41 | 
 42 |   tags = merge(local.default_tags, {
 43 |     description = "This role allows the datadog AWS account to access this account for metrics collection"
 44 |   }, var.tags)
 45 | }
 46 | 
 47 | resource "aws_iam_policy" "datadog-core" {
 48 |   count       = var.enable_datadog_aws_integration ? 1 : 0
 49 |   name        = "datadog-core-integration"
 50 |   path        = "/"
 51 |   description = "This IAM policy allows for core datadog integration permissions"
 52 |   tags        = merge(local.default_tags, var.tags)
 53 |   policy      = <<EOF
 54 | {
 55 |   "Version": "2012-10-17",
 56 |   "Statement": [
 57 |     {
 58 |       "Action": [
 59 |         "apigateway:GET",
 60 |         "autoscaling:Describe*",
 61 |         "budgets:ViewBudget",
 62 |         "cloudformation:DetectStack*",
 63 |         "cloudfront:GetDistributionConfig",
 64 |         "cloudfront:ListDistributions",
 65 |         "cloudtrail:LookupEvents",
 66 |         "cloudtrail:DescribeTrails",
 67 |         "cloudtrail:GetTrailStatus",
 68 |         "cloudwatch:Describe*",
 69 |         "cloudwatch:Get*",
 70 |         "cloudwatch:List*",
 71 |         "codedeploy:List*",
 72 |         "codedeploy:BatchGet*",
 73 |         "directconnect:Describe*",
 74 |         "dynamodb:List*",
 75 |         "dynamodb:Describe*",
 76 |         "ec2:Describe*",
 77 |         "ecs:Describe*",
 78 |         "ecs:List*",
 79 |         "elasticache:Describe*",
 80 |         "elasticache:List*",
 81 |         "elasticfilesystem:DescribeAccessPoints",
 82 |         "elasticfilesystem:DescribeFileSystems",
 83 |         "elasticfilesystem:DescribeTags",
 84 |         "elasticloadbalancing:Describe*",
 85 |         "elasticmapreduce:List*",
 86 |         "elasticmapreduce:Describe*",
 87 |         "es:ListTags",
 88 |         "es:ListDomainNames",
 89 |         "es:DescribeElasticsearchDomains",
 90 |         "fsx:DescribeFileSystems",
 91 |         "health:DescribeEvents",
 92 |         "health:DescribeEventDetails",
 93 |         "health:DescribeAffectedEntities",
 94 |         "kinesis:List*",
 95 |         "kinesis:Describe*",
 96 |         "lambda:AddPermission",
 97 |         "lambda:GetPolicy",
 98 |         "lambda:List*",
 99 |         "lambda:RemovePermission",
100 |         "logs:Get*",
101 |         "logs:Describe*",
102 |         "logs:FilterLogEvents",
103 |         "logs:TestMetricFilter",
104 |         "logs:PutSubscriptionFilter",
105 |         "logs:DeleteSubscriptionFilter",
106 |         "logs:DescribeSubscriptionFilters",
107 |         "organizations:DescribeOrganization",
108 |         "rds:Describe*",
109 |         "rds:List*",
110 |         "redshift:DescribeClusters",
111 |         "redshift:DescribeLoggingStatus",
112 |         "route53:List*",
113 |         "s3:GetBucketLogging",
114 |         "s3:GetBucketLocation",
115 |         "s3:GetBucketNotification",
116 |         "s3:GetBucketTagging",
117 |         "s3:ListAllMyBuckets",
118 |         "s3:PutBucketNotification",
119 |         "ses:Get*",
120 |         "sns:List*",
121 |         "sns:Publish",
122 |         "states:ListStateMachines",
123 |         "states:DescribeStateMachine",
124 |         "sqs:ListQueues",
125 |         "support:*",
126 |         "tag:GetResources",
127 |         "tag:GetTagKeys",
128 |         "tag:GetTagValues",
129 |         "xray:BatchGetTraces",
130 |         "xray:GetTraceSummaries"
131 |       ],
132 |       "Effect": "Allow",
133 |       "Resource": "*"
134 |     }
135 |   ]
136 | }
137 | EOF
138 | }
139 | 
140 | resource "aws_iam_role_policy_attachment" "datadog-core-attach" {
141 |   count      = var.enable_datadog_aws_integration ? 1 : 0
142 |   role       = aws_iam_role.datadog-integration[0].name
143 |   policy_arn = aws_iam_policy.datadog-core[0].arn
144 | }
145 | 
146 | resource "aws_iam_role_policy_attachment" "datadog-core-attach-extras" {
147 |   for_each   = toset(var.extra_policy_arns)
148 |   role       = aws_iam_role.datadog-integration[0].name
149 |   policy_arn = each.value
150 | }
151 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # terraform-aws-datadog
  2 | 
  3 | [![cicd](https://github.com/scribd/terraform-aws-datadog/workflows/CICD/badge.svg)](https://github.com/scribd/terraform-aws-datadog/actions)
  4 | [![terraformregistry](https://img.shields.io/badge/terraform-registry-blueviolet)](https://registry.terraform.io/modules/scribd/datadog/aws)
  5 | 
  6 | This module configures the AWS / Datadog integration.
  7 | 
  8 | There are two main components:
  9 | 
 10 | 1. Datadog core integration, enabling [datadog's AWS integration](https://docs.datadoghq.com/integrations/amazon_web_services/)
 11 | 2. Datadog logs_monitoring forwarder, enabling [logshipping watched S3 buckets](https://github.com/DataDog/datadog-serverless-functions/tree/master/aws/logs_monitoring)
 12 |   - Forward CloudWatch, ELB, S3, CloudTrail, VPC and CloudFront logs to Datadog
 13 |   - Forward S3 events to Datadog
 14 |   - Forward Kinesis data stream events to Datadog, only CloudWatch logs are supported
 15 |   - Forward custom metrics from AWS Lambda functions via CloudWatch logs
 16 |   - Forward traces from AWS Lambda functions via CloudWatch logs
 17 |   - Generate and submit enhanced Lambda metrics (`aws.lambda.enhanced.*`) parsed from the AWS REPORT log: duration, billed_duration, max_memory_used, and estimated_cost
 18 | 
 19 | 
 20 | ## Usage
 21 | 
 22 | **Set up all supported AWS / Datadog integrations**
 23 | 
 24 | ```
 25 | module "datadog" {
 26 |   source                = "scribd/datadog/aws"
 27 |   version               = "~>3"
 28 |   aws_account_id        = data.aws_caller_identity.current.account_id
 29 |   datadog_api_key       = var.datadog_api_key
 30 |   env                   = "prod"
 31 |   namespace             = "team_foo"
 32 | 
 33 |   cloudtrail_bucket_id  = aws_s3_bucket.org-cloudtrail-bucket.id
 34 |   cloudtrail_bucket_arn = aws_s3_bucket.org-cloudtrail-bucket.arn
 35 | 
 36 |   cloudwatch_log_groups = ["cloudwatch_log_group_1", "cloudwatch_log_group_2"]
 37 | 
 38 |   account_specific_namespace_rules = {
 39 |     elasticache = true
 40 |     network_elb = true
 41 |     lambda      = true
 42 |   }
 43 | }
 44 | ```
 45 | 
 46 | Note: The full integration setup should only be done within one terraform stack
 47 | per account since some of the resources it creates are global per account.
 48 | Creating this module in multiple terraform stacks will cause conflicts.
 49 | 
 50 | 
 51 | **Limit to only Cloudwatch log sync**
 52 | 
 53 | ```
 54 | module "datadog" {
 55 |   source                         = "scribd/datadog/aws"
 56 |   version                        = "~>3"
 57 |   datadog_api_key                = var.datadog_api_key
 58 |   create_elb_logs_bucket         = false
 59 |   enable_datadog_aws_integration = false
 60 |   env                            = "prod"
 61 |   namespace                      = "project_foo"
 62 | 
 63 |   cloudwatch_log_groups = ["cloudwatch_log_group_1", "cloudwatch_log_group_2"]
 64 | }
 65 | ```
 66 | 
 67 | Note: It is safe to create multiple Cloudwatch only modules across different
 68 | Terraform stacks within a single AWS account since all resouces used for
 69 | Cloudwatch log sync are namspaced by module.
 70 | 
 71 | **Be certain to use unique  `namespace`/`env` combinations, to avoid conflict with other instances of this module.
 72 | 
 73 | ## Module Versions
 74 | 
 75 | **Version 3.x.x** and greater require terraform version > 0.13.x and AWS provider > 4.0.0.  
 76 | **Version 2.x.x** and greater require terraform version > 0.13.x and AWS provider < 4.0.0.  
 77 | **Version 1.x.x** is the latest version that support terraform version 0.12.x and AWS provider < 4.0.0.  
 78 | When using this module, please be sure to [pin to a compatible version](https://www.terraform.io/docs/configuration/modules.html#module-versions).
 79 | 
 80 | ## Examples
 81 | 
 82 | - [Full AWS Datadog integration](https://github.com/scribd/terraform-aws-datadog/tree/master/examples/full_integration)
 83 | - [Cloudwatch log sync only](https://github.com/scribd/terraform-aws-datadog/tree/master/examples/cloudwatch_log_sync)
 84 | 
 85 | 
 86 | ## Development
 87 | 
 88 | Releases are cut using [semantic-release](https://github.com/semantic-release/semantic-release).
 89 | 
 90 | Please write commit messages following [Angular commit guidelines](https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines)
 91 | 
 92 | 
 93 | ### Release flow
 94 | 
 95 | Semantic-release is configured with the [default branch workflow](https://semantic-release.gitbook.io/semantic-release/usage/configuration#branches)
 96 | 
 97 | For this project, releases will be cut from master as features and bugs are developed.
 98 | 
 99 | In commit message summary, use `feat:` to cut new minor version, use `fix:` to cut new patch version. `BREAKING CHANGE:` in body of the commit message for new major version.
100 | 
101 | 
102 | ### Maintainers
103 | - [Jim](https://github.com/jim80net)
104 | - [QP](https://github.com/houqp)
105 | 
106 | ## Troubleshooting
107 | 
108 | If you should encounter `Datadog is not authorized to perform action sts:AssumeRole Accounts affected: 1234567890, 1234567891 Regions affected: every region Errors began reporting 18m ago, last seen 5m ago`
109 | Then perhaps the external ID has changed. Execute `./terraform taint module.datadog.datadog_integration_aws.core[0]` in the root module of the account repo to force a refresh.
110 | 


--------------------------------------------------------------------------------
/CHANGELOG.md:
--------------------------------------------------------------------------------
  1 | ## [3.3.4](https://github.com/scribd/terraform-aws-datadog/compare/v3.3.3...v3.3.4) (2025-02-21)
  2 | 
  3 | 
  4 | ### Bug Fixes
  5 | 
  6 | * New release with reduced sid length ([f841dd3](https://github.com/scribd/terraform-aws-datadog/commit/f841dd344cc9f471b7742ce2028b490a06bc9447))
  7 | 
  8 | ## [3.3.3](https://github.com/scribd/terraform-aws-datadog/compare/v3.3.2...v3.3.3) (2025-01-27)
  9 | 
 10 | 
 11 | ### Bug Fixes
 12 | 
 13 | * New release with optional tag var ([df82153](https://github.com/scribd/terraform-aws-datadog/commit/df821536e31d0b758fe7159fb46e00db20311f3b))
 14 | 
 15 | ## [3.3.2](https://github.com/scribd/terraform-aws-datadog/compare/v3.3.1...v3.3.2) (2024-09-30)
 16 | 
 17 | 
 18 | ### Bug Fixes
 19 | 
 20 | * Work around limit in lambda policy size ([201d6c3](https://github.com/scribd/terraform-aws-datadog/commit/201d6c3e560a13d357f999273732907bceec8fc9))
 21 | 
 22 | ## [3.3.1](https://github.com/scribd/terraform-aws-datadog/compare/v3.3.0...v3.3.1) (2024-02-19)
 23 | 
 24 | 
 25 | ### Bug Fixes
 26 | 
 27 | * bump datadog forwarder version ([3678529](https://github.com/scribd/terraform-aws-datadog/commit/367852991bbdccc8ee48942be9a5e8a9f2c9f28c))
 28 | 
 29 | # [3.3.0](https://github.com/scribd/terraform-aws-datadog/compare/v3.2.2...v3.3.0) (2024-02-15)
 30 | 
 31 | 
 32 | ### Features
 33 | 
 34 | * Switch to for_each for log forwarding resources ([0781beb](https://github.com/scribd/terraform-aws-datadog/commit/0781bebb3ef64c7923ef064c90f120ae4b2005a3))
 35 | 
 36 | ## [3.2.2](https://github.com/scribd/terraform-aws-datadog/compare/v3.2.1...v3.2.2) (2023-08-16)
 37 | 
 38 | 
 39 | ### Bug Fixes
 40 | 
 41 | * enforce only minimum version of terraform ([7195f64](https://github.com/scribd/terraform-aws-datadog/commit/7195f64ea19891492fb1356e7cfc3664c3c7441c)), closes [#55](https://github.com/scribd/terraform-aws-datadog/issues/55)
 42 | 
 43 | ## [3.2.1](https://github.com/scribd/terraform-aws-datadog/compare/v3.2.0...v3.2.1) (2023-07-20)
 44 | 
 45 | 
 46 | ### Bug Fixes
 47 | 
 48 | * Truncate `statement_id` length  after 100 characters ([#54](https://github.com/scribd/terraform-aws-datadog/issues/54)) ([3f98ed3](https://github.com/scribd/terraform-aws-datadog/commit/3f98ed333a084b350f974ca494e84b5d9e5ec373))
 49 | 
 50 | # [3.2.0](https://github.com/scribd/terraform-aws-datadog/compare/v3.1.0...v3.2.0) (2023-07-17)
 51 | 
 52 | 
 53 | ### Features
 54 | 
 55 | * remove terraform resource for ELB bucket ACL configuration (terraform-only change) ([fc770ec](https://github.com/scribd/terraform-aws-datadog/commit/fc770ec366c48ae3f7e3eccbb57135e6fe82a8b0))
 56 | 
 57 | # [3.1.0](https://github.com/scribd/terraform-aws-datadog/compare/v3.0.0...v3.1.0) (2023-01-26)
 58 | 
 59 | 
 60 | ### Features
 61 | 
 62 | * enable support for Terraform 1.3.x ([#51](https://github.com/scribd/terraform-aws-datadog/issues/51)) ([1d4c786](https://github.com/scribd/terraform-aws-datadog/commit/1d4c786b62206133408795d25ab94f7d707857ab))
 63 | 
 64 | # [3.0.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.7.0...v3.0.0) (2022-04-05)
 65 | 
 66 | 
 67 | * feat!: enable support for aws provider 4.0+ (#49) ([5bc98cb](https://github.com/scribd/terraform-aws-datadog/commit/5bc98cb56b7dd1b697f3bfa64251515d8e8ff61c)), closes [#49](https://github.com/scribd/terraform-aws-datadog/issues/49)
 68 | 
 69 | 
 70 | ### BREAKING CHANGES
 71 | 
 72 | * This release drops support for AWS provider <4.0
 73 | 
 74 | When updating to this version, the diff will show each of the new resources as needing to be created. However, each of the new aws_s3_bucket_* resources relies on S3 API calls that utilize a PUT action in order to modify the target S3 bucket. Because these API calls adhere to standard HTTP methods for REST APIs, they should handle situations where the target configuration already exists (as noted in the HTTP RFC). Given that this is the case, it's not strictly necessary to import any new aws_s3_bucket_* resources that are a one-to-one translation from previous versions of the AWS provider -- on the next terraform apply, they'll attempt the PUT, and update the state with the results as necessary.
 75 | 
 76 | # [2.7.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.6.1...v2.7.0) (2022-03-07)
 77 | 
 78 | 
 79 | ### Features
 80 | 
 81 | * enable support for Datadog provider 3.x ([e42de0e](https://github.com/scribd/terraform-aws-datadog/commit/e42de0e3ee6217db29251630370244e25debed6b))
 82 | 
 83 | ## [2.6.1](https://github.com/scribd/terraform-aws-datadog/compare/v2.6.0...v2.6.1) (2022-03-07)
 84 | 
 85 | 
 86 | ### Bug Fixes
 87 | 
 88 | * restrict aws provider to <4 for this major branch ([#47](https://github.com/scribd/terraform-aws-datadog/issues/47)) ([07de45a](https://github.com/scribd/terraform-aws-datadog/commit/07de45adb3ff85fc925a9066dc581248f151fb49))
 89 | 
 90 | # [2.6.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.5.0...v2.6.0) (2022-01-19)
 91 | 
 92 | 
 93 | ### Bug Fixes
 94 | 
 95 | * explicitly specify the versions for semantic-release ([#42](https://github.com/scribd/terraform-aws-datadog/issues/42)) ([09bd8b9](https://github.com/scribd/terraform-aws-datadog/commit/09bd8b96d3b78c302756e8b05baa2589b71daa4a))
 96 | 
 97 | 
 98 | ### Features
 99 | 
100 | * enable support for Terraform 1.1.3 ([#40](https://github.com/scribd/terraform-aws-datadog/issues/40)) ([51c5279](https://github.com/scribd/terraform-aws-datadog/commit/51c52792eed5f4b324420429677bbe9b10b0cef0))
101 | 
102 | # [2.5.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.4.0...v2.5.0) (2021-10-01)
103 | 
104 | 
105 | ### Features
106 | 
107 | * added states permissions to dd module's IAM policy ([#38](https://github.com/scribd/terraform-aws-datadog/issues/38)) ([0cb8ab8](https://github.com/scribd/terraform-aws-datadog/commit/0cb8ab8af13c1f7e12b3b4e71556a4773d595ce4))
108 | 
109 | # [2.4.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.3.1...v2.4.0) (2021-08-25)
110 | 
111 | 
112 | ### Features
113 | 
114 | * attach extra iam policies ([#37](https://github.com/scribd/terraform-aws-datadog/issues/37)) ([8411cad](https://github.com/scribd/terraform-aws-datadog/commit/8411cadea20cfb5f113d9ce54c85919eff9a14e6))
115 | 
116 | ## [2.3.1](https://github.com/scribd/terraform-aws-datadog/compare/v2.3.0...v2.3.1) (2021-08-17)
117 | 
118 | 
119 | ### Bug Fixes
120 | 
121 | * Merge pull request [#35](https://github.com/scribd/terraform-aws-datadog/issues/35) from scribd/taylorsmcclure/fix-iam-policy-v2 ([7bf7868](https://github.com/scribd/terraform-aws-datadog/commit/7bf78689e90293f4c6510025cce8cc48b8a4dafd))
122 | 
123 | # [2.3.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.2.0...v2.3.0) (2021-07-14)
124 | 
125 | 
126 | ### Features
127 | 
128 | * enable support for Terraform 1.0 ([#32](https://github.com/scribd/terraform-aws-datadog/issues/32)) ([5410502](https://github.com/scribd/terraform-aws-datadog/commit/5410502ac1d9cc6dfc4b3c1c0bbe49895f802570))
129 | 
130 | # [2.2.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.1.0...v2.2.0) (2021-03-19)
131 | 
132 | 
133 | ### Features
134 | 
135 | * enable support for terraform 0.14 ([c65a0d0](https://github.com/scribd/terraform-aws-datadog/commit/c65a0d04f1e7a07cf496002fc149afb9108a5c9f))
136 | 
137 | # [2.1.0](https://github.com/scribd/terraform-aws-datadog/compare/v2.0.1...v2.1.0) (2021-03-16)
138 | 
139 | 
140 | ### Features
141 | 
142 | * changes dd lambda default version from v3.17.0 to v3.27.0 ([8e455a8](https://github.com/scribd/terraform-aws-datadog/commit/8e455a8f217ba398a79be90a9251c59f8eb4b1fe))
143 | 
144 | ## [2.0.1](https://github.com/scribd/terraform-aws-datadog/compare/v2.0.0...v2.0.1) (2021-01-22)
145 | 
146 | 
147 | ### Bug Fixes
148 | 
149 | * Add missing cloudwatch:ListMetrics access for AWS integration ([#27](https://github.com/scribd/terraform-aws-datadog/issues/27)) ([f7c80c2](https://github.com/scribd/terraform-aws-datadog/commit/f7c80c2c7a73fa5bf1ab7132c51ff24f3703d611))
150 | 
151 | # [2.0.0](https://github.com/scribd/terraform-aws-datadog/compare/v1.3.5...v2.0.0) (2020-11-06)
152 | 
153 | 
154 | ### Features
155 | 
156 | * drop support for terraform 0.12.x ([be79b7e](https://github.com/scribd/terraform-aws-datadog/commit/be79b7e612b8932dd2d7c062b864a9a5ecff1db6))
157 | 
158 | 
159 | ### BREAKING CHANGES
160 | 
161 | * Please use a version constraint for this module
162 | if you are staying on terraform 0.12.x
163 | 
164 | Example:
165 | 
166 | ```
167 | module "datadog" {
168 |   source  = "scribd/datadog/aws"
169 |   version = "1.3.5"
170 |   # insert the 1 required variable here
171 | }
172 | ```
173 | 
174 | ## [1.3.5](https://github.com/scribd/terraform-aws-datadog/compare/v1.3.4...v1.3.5) (2020-11-06)
175 | 
176 | 
177 | ### Reverts
178 | 
179 | * Revert "fix: use proper provider source for datadog" ([7240d04](https://github.com/scribd/terraform-aws-datadog/commit/7240d04b0b303948490d7eb099906e8370dfbc35))
180 | 
181 | ## [1.3.4](https://github.com/scribd/terraform-aws-datadog/compare/v1.3.3...v1.3.4) (2020-11-03)
182 | 
183 | 
184 | ### Bug Fixes
185 | 
186 | * use proper provider source for datadog ([6f292e7](https://github.com/scribd/terraform-aws-datadog/commit/6f292e7d0b2c277c9751dce1c9806c47b1f22b89))
187 | 
188 | ## [1.3.3](https://github.com/scribd/terraform-aws-datadog/compare/v1.3.2...v1.3.3) (2020-11-03)
189 | 
190 | 
191 | ### Bug Fixes
192 | 
193 | * make minimum terraform version requirement an actual minimum ([f39e5e6](https://github.com/scribd/terraform-aws-datadog/commit/f39e5e69bf80b47cd56ce44f4e38e54d114289b9))
194 | * use a range of versions to limit the required versions ([d98714a](https://github.com/scribd/terraform-aws-datadog/commit/d98714af4bc1ffe55d9483eaaf0d8032d8501826))
195 | 
196 | ## [1.3.2](https://github.com/scribd/terraform-aws-datadog/compare/v1.3.1...v1.3.2) (2020-10-29)
197 | 
198 | 
199 | ### Bug Fixes
200 | 
201 | * Add cloudtrail:LookupEvents IAM rights ([#19](https://github.com/scribd/terraform-aws-datadog/issues/19)) ([bba2d91](https://github.com/scribd/terraform-aws-datadog/commit/bba2d9104715b5559a8edf8bc8cd445313abaacb))
202 | 
203 | ## [1.3.1](https://github.com/scribd/terraform-aws-datadog/compare/v1.3.0...v1.3.1) (2020-10-25)
204 | 
205 | 
206 | ### Bug Fixes
207 | 
208 | * Add missing IAM permissions for new version of log forwarder  ([#18](https://github.com/scribd/terraform-aws-datadog/issues/18)) ([b741a4b](https://github.com/scribd/terraform-aws-datadog/commit/b741a4b565b8ce54b545521700ff7406495df34f))
209 | 
210 | # [1.3.0](https://github.com/scribd/terraform-aws-datadog/compare/v1.2.1...v1.3.0) (2020-09-02)
211 | 
212 | 
213 | ### Features
214 | 
215 | * **log forwarding:** support DdSite option + upgrade default CF template version used ([1e0f7bc](https://github.com/scribd/terraform-aws-datadog/commit/1e0f7bc88f6fef7e0ab3ffc4c11a83daed60e09b))
216 | 
217 | ## [1.2.1](https://github.com/scribd/terraform-aws-datadog/compare/v1.2.0...v1.2.1) (2020-08-10)
218 | 
219 | 
220 | ### Bug Fixes
221 | 
222 | * use name_prefix instead of static name to avoid ([36a8077](https://github.com/scribd/terraform-aws-datadog/commit/36a8077e4c527c47be04b423b1bdee0e0bc721fe))
223 | 
224 | # [1.2.0](https://github.com/scribd/terraform-aws-datadog/compare/v1.1.0...v1.2.0) (2020-07-02)
225 | 
226 | 
227 | ### Features
228 | 
229 | * **aws integration:** add options to specify ignored regions and tags to filter out EC2 instances ([#10](https://github.com/scribd/terraform-aws-datadog/issues/10)) ([452a995](https://github.com/scribd/terraform-aws-datadog/commit/452a995d60b06fcef38a41e3b2445097b27e71f6))
230 | 
231 | # [1.1.0](https://github.com/scribd/terraform-aws-datadog/compare/v1.0.0...v1.1.0) (2020-06-29)
232 | 
233 | 
234 | ### Features
235 | 
236 | * add DdApiKey dummy value for CF stack ([c6c7ddd](https://github.com/scribd/terraform-aws-datadog/commit/c6c7ddd201ca921362cfe995544661f8e23d2989))
237 | * **CF:** use datadog supplied CF stack template ([1ecdb22](https://github.com/scribd/terraform-aws-datadog/commit/1ecdb2211b40ac8ceb4299c2f24ed603c1801942))
238 | 
239 | # 1.0.0 (2020-04-27)
240 | 
241 | 
242 | ### Bug Fixes
243 | 
244 | * Also set conditional for ForwarderRole ([d0ecc10](https://github.com/scribd/terraform-aws-datadog/commit/d0ecc10f3bba66be1e236486d4a6fa8b440cf9d4))
245 | * use AWS Secrets Manager instead of supplying API Key parameter ([647e8e9](https://github.com/scribd/terraform-aws-datadog/commit/647e8e9dd8d8d0dc953f64c86fed25ceebf1fead))
246 | 
247 | 
248 | ### Features
249 | 
250 | * add EXCLUDE_AT_MATCH env variable to datadog ([05bae6a](https://github.com/scribd/terraform-aws-datadog/commit/05bae6aa446ff485c1f231adcb72623944cbd11f))
251 | * Update AWS DD Forwarder to v3.5.0 ([797da3a](https://github.com/scribd/terraform-aws-datadog/commit/797da3a8a50cbd9b3f09677fc3e1639ffbad7187))
252 | 
253 | # CHANGELOG
254 | 
255 | <!--- next entry here -->
256 | 
257 | - Initial public release
258 | 


--------------------------------------------------------------------------------