Skip to content

Commit b2008b5

Browse files
DrizzlyOwlDrizzlyOwl
committed
Datadog Service Log Forwarder Lambda
* The Datadog Forwarder is an AWS Lambda function that ships logs from AWS to Datadog
1 parent 12dc58b commit b2008b5

File tree

1,307 files changed

+227571
-8
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,307 files changed

+227571
-8
lines changed

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,6 @@ backend.vars
1212

1313
# caches
1414
lambdas/.zip-cache/*
15+
16+
# Junk files
17+
.DS_Store

‎README.md

+33
Large diffs are not rendered by default.

‎datadog-forwarder-lambda.tf

+224
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
resource "aws_kms_key" "datadog_forwarder" {
2+
count = local.enable_datadog_forwarder ? 1 : 0
3+
4+
description = "This key is used to encrypt the DataDog Forwarder Lambda logs (${local.project_name})"
5+
deletion_window_in_days = 10
6+
enable_key_rotation = true
7+
policy = templatefile(
8+
"${path.root}/policies/kms-key-policy.json.tpl",
9+
{
10+
statement = <<EOT
11+
[
12+
${templatefile("${path.root}/policies/kms-key-policy-statements/root-allow-all.json.tpl",
13+
{
14+
aws_account_id = local.aws_account_id
15+
}
16+
)},
17+
${templatefile("${path.root}/policies/kms-key-policy-statements/cloudwatch-logs-allow.json.tpl",
18+
{
19+
log_group_arn = "arn:aws:logs:${local.aws_region}:${local.aws_account_id}:log-group:/aws/lambda/datadog-forwarder"
20+
}
21+
)}
22+
]
23+
EOT
24+
}
25+
)
26+
}
27+
28+
resource "aws_kms_alias" "datadog_forwarder" {
29+
count = local.enable_datadog_forwarder ? 1 : 0
30+
31+
name = "alias/${local.project_name}-datadog-forwarder-lambda"
32+
target_key_id = aws_kms_key.datadog_forwarder[0].key_id
33+
}
34+
35+
resource "aws_cloudwatch_log_group" "datadog_forwarder_log_group" {
36+
count = local.enable_datadog_forwarder ? 1 : 0
37+
38+
name = "/aws/lambda/datadog-forwarder"
39+
kms_key_id = aws_kms_key.datadog_forwarder[0].arn
40+
retention_in_days = local.datadog_forwarder_log_retention
41+
}
42+
43+
resource "aws_iam_role" "datadog_forwarder" {
44+
count = local.enable_datadog_forwarder ? 1 : 0
45+
46+
name = "${local.project_name}-${substr(sha512("datadog-forwarder"), 0, 6)}"
47+
description = "${local.project_name}-datadog-forwarder"
48+
assume_role_policy = templatefile(
49+
"${path.root}/policies/assume-roles/service-principle-standard.json.tpl",
50+
{ services = jsonencode(["lambda.amazonaws.com"]) }
51+
)
52+
}
53+
54+
resource "aws_iam_policy" "datadog_forwarder" {
55+
count = local.enable_datadog_forwarder ? 1 : 0
56+
57+
name = "${local.project_name}-datadog-forwarder"
58+
policy = templatefile(
59+
"${path.root}/policies/lambda-default.json.tpl",
60+
{
61+
region = local.aws_region
62+
account_id = local.aws_account_id
63+
function_name = "datadog-forwarder"
64+
}
65+
)
66+
}
67+
68+
resource "aws_iam_role_policy_attachment" "datadog_forwarder" {
69+
count = local.enable_datadog_forwarder ? 1 : 0
70+
71+
role = aws_iam_role.datadog_forwarder[0].name
72+
policy_arn = aws_iam_policy.datadog_forwarder[0].arn
73+
}
74+
75+
resource "aws_iam_policy" "datalog_forwarder_s3_object_read" {
76+
count = local.enable_datadog_forwarder ? 1 : 0
77+
78+
name = "${local.project_name}-datadog-forwarder-s3-object-read"
79+
policy = templatefile(
80+
"${path.root}/policies/s3-object-read.json.tpl",
81+
{
82+
bucket_arn : "*"
83+
}
84+
)
85+
}
86+
87+
resource "aws_iam_role_policy_attachment" "datalog_forwarder_s3_object_read" {
88+
count = local.enable_datadog_forwarder ? 1 : 0
89+
90+
role = aws_iam_role.datadog_forwarder[0].name
91+
policy_arn = aws_iam_policy.datalog_forwarder_s3_object_read[0].arn
92+
}
93+
94+
resource "aws_iam_policy" "datalog_forwarder_s3_object_rw" {
95+
count = local.enable_datadog_forwarder ? 1 : 0
96+
97+
name = "${local.project_name}-datadog-forwarder-s3-object-rw"
98+
policy = templatefile(
99+
"${path.root}/policies/s3-object-rw.json.tpl",
100+
{
101+
bucket_arn : aws_s3_bucket.datadog_lambda[0].arn
102+
}
103+
)
104+
}
105+
106+
resource "aws_iam_role_policy_attachment" "datalog_forwarder_s3_object_rw" {
107+
count = local.enable_datadog_forwarder ? 1 : 0
108+
109+
role = aws_iam_role.datadog_forwarder[0].name
110+
policy_arn = aws_iam_policy.datalog_forwarder_s3_object_rw[0].arn
111+
}
112+
113+
resource "aws_iam_policy" "datalog_forwarder_kms_encrypt" {
114+
count = local.enable_datadog_forwarder ? 1 : 0
115+
116+
name = "${local.project_name}-datadog-forwarder-kms-encrypt"
117+
policy = templatefile(
118+
"${path.root}/policies/kms-encrypt.json.tpl",
119+
{
120+
kms_key_arn : aws_kms_key.datadog_forwarder[0].arn
121+
}
122+
)
123+
}
124+
125+
resource "aws_iam_role_policy_attachment" "datalog_forwarder_kms_encrypt" {
126+
count = local.enable_datadog_forwarder ? 1 : 0
127+
128+
role = aws_iam_role.datadog_forwarder[0].name
129+
policy_arn = aws_iam_policy.datalog_forwarder_kms_encrypt[0].arn
130+
}
131+
132+
resource "aws_iam_policy" "datalog_forwarder_secret" {
133+
count = local.enable_datadog_forwarder ? 1 : 0
134+
135+
name = "${local.project_name}-datadog-forwarder-secrets-manager-get-secret-value"
136+
policy = templatefile(
137+
"${path.root}/policies/secrets-manager-get-secret-value.json.tpl",
138+
{
139+
secret_name_arns : jsonencode([
140+
aws_secretsmanager_secret.datadog_api_key[0].arn
141+
])
142+
}
143+
)
144+
}
145+
146+
resource "aws_iam_role_policy_attachment" "datalog_forwarder_secret" {
147+
count = local.enable_datadog_forwarder ? 1 : 0
148+
149+
role = aws_iam_role.datadog_forwarder[0].name
150+
policy_arn = aws_iam_policy.datalog_forwarder_secret[0].arn
151+
}
152+
153+
data "archive_file" "datadog_forwarder" {
154+
count = local.enable_datadog_forwarder ? 1 : 0
155+
156+
type = "zip"
157+
source_dir = "lambdas/aws-dd-forwarder-3.127.0"
158+
output_path = "lambdas/.zip-cache/aws-dd-forwarder-3.127.0.zip"
159+
}
160+
161+
resource "aws_lambda_function" "datalog_service_log_forwarder" {
162+
count = local.enable_datadog_forwarder ? 1 : 0
163+
164+
filename = data.archive_file.datadog_forwarder[0].output_path
165+
function_name = "datadog-forwarder"
166+
description = "${local.project_name} DataDog AWS Service Log Forwarder"
167+
handler = "lambda_function.datadog_forwarder"
168+
runtime = "python3.11"
169+
role = aws_iam_role.datadog_forwarder[0].arn
170+
source_code_hash = data.archive_file.datadog_forwarder[0].output_base64sha256
171+
memory_size = 128
172+
package_type = "Zip"
173+
timeout = 900
174+
175+
environment {
176+
variables = {
177+
DD_STORE_FAILED_EVENTS : local.datadog_forwarder_store_failed_events,
178+
DD_API_KEY_SECRET_ARN : aws_secretsmanager_secret.datadog_api_key[0].arn,
179+
DD_ENHANCED_METRICS : local.datadog_forwarder_enhanced_metrics,
180+
DD_S3_BUCKET_NAME : aws_s3_bucket.datadog_lambda[0].bucket,
181+
DD_SITE : local.datadog_site,
182+
DD_API_URL : local.datadog_api_url,
183+
}
184+
}
185+
186+
tracing_config {
187+
mode = "Active"
188+
}
189+
190+
depends_on = [
191+
aws_iam_role_policy_attachment.datadog_forwarder,
192+
aws_iam_role_policy_attachment.datalog_forwarder_s3_object_read,
193+
aws_iam_role_policy_attachment.datalog_forwarder_s3_object_rw,
194+
aws_iam_role_policy_attachment.datalog_forwarder_secret,
195+
]
196+
}
197+
198+
#tfsec:ignore:aws-ssm-secret-use-customer-key
199+
resource "aws_secretsmanager_secret" "datadog_api_key" {
200+
count = local.enable_datadog_forwarder ? 1 : 0
201+
202+
name = "${local.project_name_hash}/datadog/DD_API_KEY"
203+
}
204+
205+
resource "aws_secretsmanager_secret_version" "datadog_api_key" {
206+
count = local.enable_datadog_forwarder ? 1 : 0
207+
208+
secret_id = aws_secretsmanager_secret.datadog_api_key[0].id
209+
secret_string = local.datadog_api_key
210+
}
211+
212+
resource "datadog_integration_aws_lambda_arn" "datadog_forwarder_arn" {
213+
count = local.enable_datadog_forwarder ? 1 : 0
214+
215+
account_id = local.aws_account_id
216+
lambda_arn = aws_lambda_function.datalog_service_log_forwarder[0].arn
217+
}
218+
219+
resource "datadog_integration_aws_log_collection" "datadog_forwarder" {
220+
count = local.enable_datadog_forwarder ? 1 : 0
221+
222+
account_id = local.aws_account_id
223+
services = ["cloudfront", "waf", "elbv2", "s3"]
224+
}

‎lambdas/aws-dd-forwarder-3.127.0/.DS_Store

18 KB
Binary file not shown.

‎lambdas/aws-dd-forwarder-3.127.0/Deprecated-1.2.14.dist-info/INSTALLER

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
pip

‎lambdas/aws-dd-forwarder-3.127.0/Deprecated-1.2.14.dist-info/LICENSE.rst

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2017 Laurent LAPORTE
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

0 commit comments

Comments
 (0)