Create a gist now

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Datadog AWS Integration Automated Setup - CloudFormation
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"SharedSecret": {
"Default": "SOOPASEKRET",
"Description": "Shared Secret, aka External ID",
"Type": "String",
"NoEcho": "true"
}
},
"Resources": {
"DatadogAWSIntegrationRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Condition": {
"StringEquals": { "sts:ExternalId": { "Ref": "SharedSecret" } }
},
"Principal": { "AWS": "arn:aws:iam::464622532012:root" }
}
]
},
"Path": "/"
}
},
"DatadogAWSIntegrationPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Properties": {
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"autoscaling:Describe*",
"cloudtrail:DescribeTrails",
"cloudtrail:GetTrailStatus",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"ec2:Describe*",
"ec2:Get*",
"ecs:Describe*",
"ecs:List*",
"elasticache:Describe*",
"elasticache:List*",
"elasticloadbalancing:Describe*",
"elasticmapreduce:List*",
"iam:Get*",
"iam:List*",
"kinesis:Get*",
"kinesis:List*",
"kinesis:Describe*",
"logs:Get*",
"logs:Describe*",
"logs:TestMetricFilter",
"rds:Describe*",
"rds:List*",
"route53:List*",
"ses:Get*",
"ses:List*",
"sns:List*",
"sns:Publish",
"sqs:GetQueueAttributes",
"sqs:ListQueues",
"sqs:ReceiveMessage"
],
"Effect": "Allow",
"Resource": "*"
}
]
},
"Path": "/",
"Roles": [ { "Ref": "DatadogAWSIntegrationRole" } ]
}
}
},
"Outputs": {
"RoleName": {
"Description": "The IAM Role to share with Datadog",
"Value": { "Fn::GetAtt": [ "DatadogAWSIntegrationRole", "Arn" ] }
},
"SharedSecret": {
"Description": "The Shared Secret aka External ID",
"Value": { "Ref": "SharedSecret" }
}
}
}
$ aws cloudformation create-stack --stack-name DatadogAWSIntegration --capabilities CAPABILITY_IAM --template-body file://datadog-role-delegation.json --parameters ParameterKey=SharedSecret,ParameterValue=some-complex-generated-shared-secret
{
"StackId": "arn:aws:cloudformation:us-east-1:123456789012:stack/DatadogAWSIntegration/some-long-guid"
}
$ aws cloudformation describe-stacks --stack-name DatadogAWSIntegration --output json | jq '.Stacks[].Outputs[]'
{
"Description": "The IAM Role to share with Datadog",
"OutputKey": "RoleName",
"OutputValue": "arn:aws:iam::123456789012:role/DatadogAWSIntegration-DatadogAWSIntegrationRole-ILKF6RXU0UQT"
}
{
"Description": "The Shared Secret aka External ID",
"OutputKey": "SharedSecret",
"OutputValue": "some-complex-generated-shared-secret"
}
@schlomo

This comment has been minimized.

Show comment
Hide comment
@schlomo

schlomo Jun 16, 2016

Nice. Do you have any ideas how to automate the creation of DD metrics and monitors through Cloud Formation? Maybe as custom resource?

schlomo commented Jun 16, 2016

Nice. Do you have any ideas how to automate the creation of DD metrics and monitors through Cloud Formation? Maybe as custom resource?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment