Upstream Datadog (cloudposse/terraform-aws-components#525)

Author: Benbentwo

src/README.md

@@ -21,11 +21,7 @@ components:
         spacelift:
           workspace_enabled: true
       vars:
-        datadog_secrets_store_type: SSM
-        datadog_secrets_source_store_account: "tools"
-        datadog_secrets_source_store_region: "us-west-2"
-        datadog_api_secret_key: "dev"
-        datadog_app_secret_key: "dev"
+        enabled: true
 ```
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -34,35 +30,25 @@ components:
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 4.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9.0 |
 | <a name="requirement_datadog"></a> [datadog](#requirement\_datadog) | >= 3.3.0 |
 
 ## Providers
 
-| Name | Version |
-|------|---------|
-| <a name="provider_aws.api_keys"></a> [aws.api\_keys](#provider\_aws.api\_keys) | ~> 4.0 |
+No providers.
 
 ## Modules
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_datadog_integration"></a> [datadog\_integration](#module\_datadog\_integration) | cloudposse/datadog-integration/aws | 0.18.0 |
+| <a name="module_datadog_configuration"></a> [datadog\_configuration](#module\_datadog\_configuration) | ../datadog-configuration/modules/datadog_keys | n/a |
+| <a name="module_datadog_integration"></a> [datadog\_integration](#module\_datadog\_integration) | cloudposse/datadog-integration/aws | 1.0.0 |
 | <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a |
-| <a name="module_iam_roles_datadog_secrets"></a> [iam\_roles\_datadog\_secrets](#module\_iam\_roles\_datadog\_secrets) | ../account-map/modules/iam-roles | n/a |
-| <a name="module_store_write"></a> [store\_write](#module\_store\_write) | cloudposse/ssm-parameter-store/aws | 0.10.0 |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
 
 ## Resources
 
-| Name | Type |
-|------|------|
-| [aws_secretsmanager_secret.datadog_api_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret) | data source |
-| [aws_secretsmanager_secret.datadog_app_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret) | data source |
-| [aws_secretsmanager_secret_version.datadog_api_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret_version) | data source |
-| [aws_secretsmanager_secret_version.datadog_app_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret_version) | data source |
-| [aws_ssm_parameter.datadog_api_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
-| [aws_ssm_parameter.datadog_app_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
+No resources.
 
 ## Inputs
 
@@ -73,16 +59,7 @@ components:
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
 | <a name="input_context_host_and_filter_tags"></a> [context\_host\_and\_filter\_tags](#input\_context\_host\_and\_filter\_tags) | Automatically add host and filter tags for these context keys | `list(string)` | <pre>[<br>  "namespace",<br>  "tenant",<br>  "stage"<br>]</pre> | no |
-| <a name="input_datadog_api_secret_key"></a> [datadog\_api\_secret\_key](#input\_datadog\_api\_secret\_key) | The name of the Datadog API secret | `string` | `"default"` | no |
-| <a name="input_datadog_api_secret_key_source_pattern"></a> [datadog\_api\_secret\_key\_source\_pattern](#input\_datadog\_api\_secret\_key\_source\_pattern) | The format string (%v will be replaced by the var.datadog\_api\_secret\_key) for the key of the Datadog API secret in the source account | `string` | `"/datadog/%v/datadog_api_key"` | no |
-| <a name="input_datadog_api_secret_key_target_pattern"></a> [datadog\_api\_secret\_key\_target\_pattern](#input\_datadog\_api\_secret\_key\_target\_pattern) | The format string (%v will be replaced by the var.datadog\_api\_secret\_key) for the key of the Datadog API secret in the target account | `string` | `"/datadog/datadog_api_key"` | no |
-| <a name="input_datadog_app_secret_key"></a> [datadog\_app\_secret\_key](#input\_datadog\_app\_secret\_key) | The name of the Datadog APP secret | `string` | `"default"` | no |
-| <a name="input_datadog_app_secret_key_source_pattern"></a> [datadog\_app\_secret\_key\_source\_pattern](#input\_datadog\_app\_secret\_key\_source\_pattern) | The format string (%v will be replaced by the var.datadog\_app\_secret\_key) for the key of the Datadog APP secret in the source account | `string` | `"/datadog/%v/datadog_app_key"` | no |
-| <a name="input_datadog_app_secret_key_target_pattern"></a> [datadog\_app\_secret\_key\_target\_pattern](#input\_datadog\_app\_secret\_key\_target\_pattern) | The format string (%v will be replaced by the var.datadog\_api\_secret\_key) for the key of the Datadog APP secret in the target account | `string` | `"/datadog/datadog_app_key"` | no |
 | <a name="input_datadog_aws_account_id"></a> [datadog\_aws\_account\_id](#input\_datadog\_aws\_account\_id) | The AWS account ID Datadog's integration servers use for all integrations | `string` | `"464622532012"` | no |
-| <a name="input_datadog_secrets_source_store_account_stage"></a> [datadog\_secrets\_source\_store\_account\_stage](#input\_datadog\_secrets\_source\_store\_account\_stage) | Stage holding Secret Store for Datadog API and app keys. | `string` | `"tools"` | no |
-| <a name="input_datadog_secrets_source_store_account_tenant"></a> [datadog\_secrets\_source\_store\_account\_tenant](#input\_datadog\_secrets\_source\_store\_account\_tenant) | Tenant holding Secret Store for Datadog API and app keys. | `string` | `"core"` | no |
-| <a name="input_datadog_secrets_store_type"></a> [datadog\_secrets\_store\_type](#input\_datadog\_secrets\_store\_type) | Secret Store type for Datadog API and app keys. Valid values: `SSM`, `ASM` | `string` | `"SSM"` | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |

src/asm.tf

@@ -1,6 +1,8 @@
 module "datadog_integration" {
   source  = "cloudposse/datadog-integration/aws"
-  version = "0.18.0"
+  version = "1.0.0"
+
+  count = module.this.enabled && length(var.integrations) > 0 ? 1 : 0
 
   datadog_aws_account_id           = var.datadog_aws_account_id
   integrations                     = var.integrations
@@ -13,13 +15,7 @@ module "datadog_integration" {
 }
 
 locals {
-  enabled     = module.this.enabled
-  asm_enabled = local.enabled && var.datadog_secrets_store_type == "ASM"
-  ssm_enabled = local.enabled && var.datadog_secrets_store_type == "SSM"
-
-  # https://docs.datadoghq.com/account_management/api-app-keys/
-  datadog_api_key = local.enabled ? (local.asm_enabled ? data.aws_secretsmanager_secret_version.datadog_api_key[0].secret_string : data.aws_ssm_parameter.datadog_api_key[0].value) : null
-  datadog_app_key = local.enabled ? (local.asm_enabled ? data.aws_secretsmanager_secret_version.datadog_app_key[0].secret_string : data.aws_ssm_parameter.datadog_app_key[0].value) : null
+  enabled = module.this.enabled
 
   # Get the context tags and skip tags that we don't want applied to every resource.
   # i.e. we don't want name since each metric would be called something other than this component's name.

src/default.auto.tfvars

@@ -1,14 +1,14 @@
 output "aws_account_id" {
-  value       = module.datadog_integration.aws_account_id
+  value       = one(module.datadog_integration[*].aws_account_id)
   description = "AWS Account ID of the IAM Role for the Datadog integration"
 }
 
 output "aws_role_name" {
-  value       = module.datadog_integration.aws_role_name
+  value       = one(module.datadog_integration[*].aws_role_name)
   description = "Name of the AWS IAM Role for the Datadog integration"
 }
 
 output "datadog_external_id" {
-  value       = module.datadog_integration.datadog_external_id
+  value       = one(module.datadog_integration[*].datadog_external_id)
   description = "Datadog integration external ID"
 }

src/main.tf

@@ -0,0 +1,12 @@
+module "datadog_configuration" {
+  source  = "../datadog-configuration/modules/datadog_keys"
+  region  = var.region
+  context = module.this.context
+}
+
+provider "datadog" {
+  api_key  = module.datadog_configuration.datadog_api_key
+  app_key  = module.datadog_configuration.datadog_app_key
+  api_url  = module.datadog_configuration.datadog_api_url
+  validate = local.enabled
+}

src/outputs.tf

@@ -2,6 +2,7 @@ provider "aws" {
   region = var.region
 
   profile = module.iam_roles.profiles_enabled ? coalesce(var.import_profile_name, module.iam_roles.terraform_profile_name) : null
+
   dynamic "assume_role" {
     for_each = module.iam_roles.profiles_enabled ? [] : ["role"]
     content {
@@ -26,29 +27,3 @@ variable "import_role_arn" {
   default     = null
   description = "IAM Role ARN to use when importing a resource"
 }
-
-provider "aws" {
-  alias  = "api_keys"
-  region = var.region
-
-  profile = module.iam_roles_datadog_secrets.profiles_enabled ? coalesce(var.import_profile_name, module.iam_roles_datadog_secrets.terraform_profile_name) : null
-  dynamic "assume_role" {
-    for_each = module.iam_roles.profiles_enabled ? [] : ["role"]
-    content {
-      role_arn = coalesce(var.import_role_arn, module.iam_roles_datadog_secrets.terraform_role_arn)
-    }
-  }
-}
-
-module "iam_roles_datadog_secrets" {
-  source  = "../account-map/modules/iam-roles"
-  stage   = var.datadog_secrets_source_store_account_stage
-  tenant  = var.datadog_secrets_source_store_account_tenant
-  context = module.this.context
-}
-
-provider "datadog" {
-  api_key  = local.datadog_api_key
-  app_key  = local.datadog_app_key
-  validate = local.enabled
-}

src/provider-datadog.tf

@@ -39,60 +39,6 @@ variable "account_specific_namespace_rules" {
   default     = {}
 }
 
-variable "datadog_secrets_store_type" {
-  type        = string
-  description = "Secret Store type for Datadog API and app keys. Valid values: `SSM`, `ASM`"
-  default     = "SSM"
-}
-
-variable "datadog_secrets_source_store_account_stage" {
-  type        = string
-  description = "Stage holding Secret Store for Datadog API and app keys."
-  default     = "tools"
-}
-
-variable "datadog_secrets_source_store_account_tenant" {
-  type        = string
-  description = "Tenant holding Secret Store for Datadog API and app keys."
-  default     = "core"
-}
-
-variable "datadog_api_secret_key_source_pattern" {
-  type        = string
-  description = "The format string (%v will be replaced by the var.datadog_api_secret_key) for the key of the Datadog API secret in the source account"
-  default     = "/datadog/%v/datadog_api_key"
-}
-
-variable "datadog_app_secret_key_source_pattern" {
-  type        = string
-  description = "The format string (%v will be replaced by the var.datadog_app_secret_key) for the key of the Datadog APP secret in the source account"
-  default     = "/datadog/%v/datadog_app_key"
-}
-
-variable "datadog_api_secret_key_target_pattern" {
-  type        = string
-  description = "The format string (%v will be replaced by the var.datadog_api_secret_key) for the key of the Datadog API secret in the target account"
-  default     = "/datadog/datadog_api_key"
-}
-
-variable "datadog_app_secret_key_target_pattern" {
-  type        = string
-  description = "The format string (%v will be replaced by the var.datadog_api_secret_key) for the key of the Datadog APP secret in the target account"
-  default     = "/datadog/datadog_app_key"
-}
-
-variable "datadog_api_secret_key" {
-  type        = string
-  description = "The name of the Datadog API secret"
-  default     = "default"
-}
-
-variable "datadog_app_secret_key" {
-  type        = string
-  description = "The name of the Datadog APP secret"
-  default     = "default"
-}
-#
 variable "context_host_and_filter_tags" {
   type        = list(string)
   description = "Automatically add host and filter tags for these context keys"

src/providers.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.0"
+      version = ">= 4.9.0"
     }
     datadog = {
       source  = "datadog/datadog"