Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
Datadog AWS Integration Automated Setup - CloudFormation
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"SharedSecret": {
"Default": "SOOPASEKRET",
"Description": "Shared Secret, aka External ID",
"Type": "String",
"NoEcho": "true"
}
},
"Resources": {
"DatadogAWSIntegrationRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Condition": {
"StringEquals": { "sts:ExternalId": { "Ref": "SharedSecret" } }
},
"Principal": { "AWS": "arn:aws:iam::464622532012:root" }
}
]
},
"Path": "/"
}
},
"DatadogAWSIntegrationPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Properties": {
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"autoscaling:Describe*",
"cloudtrail:DescribeTrails",
"cloudtrail:GetTrailStatus",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"ec2:Describe*",
"ec2:Get*",
"ecs:Describe*",
"ecs:List*",
"elasticache:Describe*",
"elasticache:List*",
"elasticloadbalancing:Describe*",
"elasticmapreduce:List*",
"iam:Get*",
"iam:List*",
"kinesis:Get*",
"kinesis:List*",
"kinesis:Describe*",
"logs:Get*",
"logs:Describe*",
"logs:TestMetricFilter",
"rds:Describe*",
"rds:List*",
"route53:List*",
"ses:Get*",
"ses:List*",
"sns:List*",
"sns:Publish",
"sqs:GetQueueAttributes",
"sqs:ListQueues",
"sqs:ReceiveMessage"
],
"Effect": "Allow",
"Resource": "*"
}
]
},
"Path": "/",
"Roles": [ { "Ref": "DatadogAWSIntegrationRole" } ]
}
}
},
"Outputs": {
"RoleName": {
"Description": "The IAM Role to share with Datadog",
"Value": { "Fn::GetAtt": [ "DatadogAWSIntegrationRole", "Arn" ] }
},
"SharedSecret": {
"Description": "The Shared Secret aka External ID",
"Value": { "Ref": "SharedSecret" }
}
}
}
$ aws cloudformation create-stack --stack-name DatadogAWSIntegration --capabilities CAPABILITY_IAM --template-body file://datadog-role-delegation.json --parameters ParameterKey=SharedSecret,ParameterValue=some-complex-generated-shared-secret
{
"StackId": "arn:aws:cloudformation:us-east-1:123456789012:stack/DatadogAWSIntegration/some-long-guid"
}
$ aws cloudformation describe-stacks --stack-name DatadogAWSIntegration --output json | jq '.Stacks[].Outputs[]'
{
"Description": "The IAM Role to share with Datadog",
"OutputKey": "RoleName",
"OutputValue": "arn:aws:iam::123456789012:role/DatadogAWSIntegration-DatadogAWSIntegrationRole-ILKF6RXU0UQT"
}
{
"Description": "The Shared Secret aka External ID",
"OutputKey": "SharedSecret",
"OutputValue": "some-complex-generated-shared-secret"
}

schlomo commented Jun 16, 2016

Nice. Do you have any ideas how to automate the creation of DD metrics and monitors through Cloud Formation? Maybe as custom resource?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment