-
Notifications
You must be signed in to change notification settings - Fork 1
/
agent.tf
44 lines (40 loc) · 1.33 KB
/
agent.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
locals {
sidecar_name = "datadog-agent"
agent_sidecar = {
name = "datadog-agent"
image = "public.ecr.aws/datadog/agent:latest"
essential = true
portMappings = jsonencode([
{ protocol = "tcp", containerPort = 4317 },
{ protocol = "tcp", containerPort = 4318 },
{ protocol = "tcp", containerPort = 8126 },
])
environment = jsonencode([
{ name = "ECS_FARGATE", value = "true" },
{ name = "DD_APM_ENABLED", value = "true" },
{ name = "DD_SITE", value = "datadoghq.com" },
{ name = "DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_GRPC_ENDPOINT", value = "0.0.0.0:4317" },
{ name = "DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_ENDPOINT", value = "0.0.0.0:4318" }
])
secrets = jsonencode([{ name = "DD_API_KEY", valueFrom = local.api_key_secret_id }])
}
}
resource "aws_iam_role_policy_attachment" "execution-datadog" {
role = local.execution_role_name
policy_arn = aws_iam_policy.datadog.arn
}
resource "aws_iam_policy" "datadog" {
name = "${local.resource_name}-datadog"
policy = data.aws_iam_policy_document.datadog.json
}
data "aws_iam_policy_document" "datadog" {
statement {
sid = "AllowReadDatadogApiKey"
effect = "Allow"
resources = [local.api_key_secret_id]
actions = [
"secretsmanager:GetSecretValue",
"kms:Decrypt"
]
}
}