|
1 | 1 | # Component: `datadog-integration` |
2 | 2 |
|
3 | | -This component is responsible for provisioning Datadog AWS integrations. |
| 3 | +This component is responsible for provisioning Datadog AWS integrations. |
4 | 4 |
|
5 | 5 | See Datadog's [documentation about provisioning keys](https://docs.datadoghq.com/account_management/api-app-keys) for more information. |
6 | 6 |
|
@@ -91,6 +91,49 @@ No resources. |
91 | 91 | <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
92 | 92 |
|
93 | 93 |
|
| 94 | +## FAQ: |
| 95 | + |
| 96 | +### Stack Errors (Spacelift): |
| 97 | + |
| 98 | +``` |
| 99 | +╷ |
| 100 | +│ Error: error creating AWS integration from https://api.datadoghq.com/api/v1/integration/aws: 409 Conflict: {"errors": ["Could not update AWS Integration due to conflicting updates"]} |
| 101 | +│ |
| 102 | +│ with module.datadog_integration.datadog_integration_aws.integration[0], |
| 103 | +│ on .terraform/modules/datadog_integration/main.tf line 18, in resource "datadog_integration_aws" "integration": |
| 104 | +│ 18: resource "datadog_integration_aws" "integration" { |
| 105 | +│ |
| 106 | +╵ |
| 107 | +``` |
| 108 | +
|
| 109 | +This can happen when you apply multiple integrations at the same time. Fix is easy though, re-trigger the stack. |
| 110 | +
|
| 111 | +## Enabling Security Audits |
| 112 | +
|
| 113 | +To enable the Datadog compliance capabilities, AWS integration to must have the `SecurityAudit` policy attached to the Datadog IAM role. This is handled by our [https://github.com/cloudposse/terraform-aws-datadog-integration](https://github.com/cloudposse/terraform-aws-datadog-integration) module used |
| 114 | +
|
| 115 | +the by the `datadog-integration` component. |
| 116 | +
|
| 117 | +Attaching the `SecurityAudit` policy allows Datadog to collect information about how AWS resources are configured (used in Datadog Cloud Security Posture Management to read security configuration metadata) |
| 118 | +
|
| 119 | +- Datadog Cloud Security Posture Management (CSPM) makes it easier to assess and visualize the current and historic security posture of cloud environments, automate audit evidence collection, and catch misconfigurations that leave your organization vulnerable to attacks |
| 120 | +
|
| 121 | +- Cloud Security Posture Management (CSPM) can be accessed at [https://app.datadoghq.com/security/compliance/home](https://app.datadoghq.com/security/compliance/home) |
| 122 | +
|
| 123 | +- The process to enable Datadog Cloud Security Posture Management (CSPM) consists of two steps (one automated, the other manual): |
| 124 | +
|
| 125 | +- Enable `SecurityAudit` policy and provision it with terraform |
| 126 | +
|
| 127 | +- In Datadog UI, perform the following manual steps: |
| 128 | +
|
| 129 | +``` |
| 130 | +Go to the Datadog AWS integration tile |
| 131 | +Click on the AWS account where you wish to enable resource collection |
| 132 | +Go to the Resource collection section for that account and check the box "Route resource data to the Cloud Security Posture Management product" |
| 133 | +At the bottom left of the tile, click Update Configuration |
| 134 | + |
| 135 | +``` |
| 136 | +
|
94 | 137 | ## References |
95 | 138 | * Datadog's [documentation about provisioning keys](https://docs.datadoghq.com/account_management/api-app-keys) |
96 | 139 | * [cloudposse/terraform-aws-components](https://github.com/cloudposse/terraform-aws-components/tree/master/modules/datadog-integration) - Cloud Posse's upstream component |
|
0 commit comments