DEV Community: Jay Motka

Datadog-Cloudformation Integration using Serverless Framework

Jay Motka — Thu, 31 Aug 2023 09:39:14 +0000

🤓 Introduction

Datadog is a cloud monitoring service provider which helps to track and analyse your cloud services from a health and operations perspective and providing support for debugging issues.

Datadog provides different integrations with multiple cloud providers like AWS, GCP, and Azure. In this blog we will be seeing Datadog integration with AWS using one of the AWS Cloudformation service with the help of Serverless framework.

📄 Pre Requisites

You will need AWS and Datadog account and knowledge of AWS services like IAMRole, Cloudformation and Serverless framework.

Note: Here we are using Serverless framework with TypeScript and Serverless Compose to deploy multiple different stack.

🛠 Datadog Cloudformation Setup

In order to create Datadog Resources using Cloudformation, Datadog needs Cloudformation Extension Plugins to be activated, so our first step is to start with adding an activation stack to our Serverless application. These extension plugins needs IAM roles to be attached in order to execute the Cloudformation events. You can find more details regarding this in Datadog Amazon Cloudformation Documentation

Note: Here you can find a basic setup guide for Datadog-Cloudformation Integration

We'll create two service stack in the Serverless application, one for the Extensions Activation which contains Cloudformation extension activation (as we'll only deploy it once because we can not deploy it multiple times to activate the same resources) and one for the Infra Resources (To create different Datadog monitors and dashboards).

🧩 Setting Up the Extension Activation Stack

Let's create a IAM Role for the Role Delegation and Extensions Executions Role.

🧮 Setting Up the IAM Role

We are providing access to Datadog AWS account (464622532012) using Role Delegation to our IAMRole with necessary permissions.

DatadogExecutionRole: {
    Type: "AWS::IAM::Role",
    Properties: {
      Path: "/",
      RoleName: `DatadogAWSIntegrationRole`,
      Description: "IAM Role to integrate Datadog using Cloudformation",
      MaxSessionDuration: 8400,
      AssumeRolePolicyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Allow",
            Principal: {
              AWS: "arn:aws:iam::464622532012:root",
            },
            Action: "sts:AssumeRole",
            Condition: {
              StringEquals: {
                "sts:ExternalId": ["${ssm:/datadog/integration/externalId}"],
              },
            },
          },
          {
            Effect: "Allow",
            Principal: {
              Service: [
                "hooks.cloudformation.amazonaws.com",
                "resources.cloudformation.amazonaws.com",
              ],
            },
            Action: "sts:AssumeRole",
          },
        ],
      },
      Policies: [
        {
          PolicyName: `DatadogIntegrationRolePolicy`,
          PolicyDocument: {
            Version: "2012-10-17",
            Statement: [
              {
                Sid: "VisualEditor0",
                Effect: "Allow",
                Action: [
                  "health:DescribeAffectedEntities",
                  "budgets:ViewBudget",
                  "logs:DeleteSubscriptionFilter",
                  "states:ListStateMachines",
                  "states:DescribeStateMachine",
                  "tag:GetTagValues",
                  "logs:DescribeSubscriptionFilters",
                  "cloudtrail:GetTrailStatus",
                  "codedeploy:List*",
                  "es:ListTags",
                  "cloudwatch:Describe*",
                  "elasticmapreduce:Describe*",
                  "dynamodb:Describe*",
                  "rds:Describe*",
                  "route53:List*",
                  "elasticloadbalancing:Describe*",
                  "logs:FilterLogEvents",
                  "cloudfront:GetDistributionConfig",
                  "apigateway:GET",
                  "ses:Get*",
                  "cloudtrail:LookupEvents",
                  "fsx:ListTagsForResource",
                  "support:DescribeTrustedAdvisor*",
                  "events:CreateEventBus",
                  "lambda:List*",
                  "dynamodb:List*",
                  "s3:GetBucketNotification",
                  "cloudtrail:DescribeTrails",
                  "s3:PutBucketNotification",
                  "organizations:Describe*",
                  "organizations:List*",
                  "logs:PutSubscriptionFilter",
                  "fsx:DescribeFileSystems",
                  "kinesis:Describe*",
                  "codedeploy:BatchGet*",
                  "autoscaling:Describe*",
                  "s3:GetBucketTagging",
                  "tag:GetResources",
                  "logs:DescribeLogStreams",
                  "rds:List*",
                  "s3:GetBucketLogging",
                  "tag:GetTagKeys",
                  "elasticmapreduce:List*",
                  "backup:List*",
                  "sns:Publish",
                  "elasticache:List*",
                  "redshift:DescribeLoggingStatus",
                  "cloudwatch:Get*",
                  "support:RefreshTrustedAdvisorCheck",
                  "elasticfilesystem:DescribeFileSystems",
                  "es:DescribeElasticsearchDomains",
                  "xray:GetTraceSummaries",
                  "ecs:List*",
                  "health:DescribeEvents",
                  "sqs:ListQueues",
                  "logs:DescribeLogGroups",
                  "kinesis:List*",
                  "ecs:Describe*",
                  "health:DescribeEventDetails",
                  "cloudwatch:List*",
                  "logs:TestMetricFilter",
                  "elasticfilesystem:DescribeAccessPoints",
                  "elasticache:Describe*",
                  "sns:List*",
                  "xray:BatchGetTraces",
                  "ec2:Describe*",
                  "directconnect:Describe*",
                  "es:ListDomainNames",
                  "elasticfilesystem:DescribeTags",
                  "s3:ListAllMyBuckets",
                  "cloudfront:ListDistributions",
                  "redshift:DescribeClusters",
                  "s3:GetBucketLocation",
                  "lambda:GetPolicy",
                  "secretsmanager:CreateSecret",
                  "secretsmanager:DeleteSecret",
                  "secretsmanager:DescribeSecret",
                ],
                Resource: "*",
              },
            ],
          },
        },
      ],
    },
  }

Note: This role will work as extension execution role as well, if you need to have separate roles than you can create separate roles as well.

Now we'll create four AWS::CloudFormation::TypeActivation resources to attach to Activation Stack which will include.

Datadog::Dashboards::Dashboard - to create and manage Datadog Dashboards
Datadog::Monitors::Monitor - to create and manage Datadog Monitors
Datadog::Monitors::Downtime - to create and manage Monitors Downtime
Datadog::Integrations::AWS - to create integration between AWS and Datadog

Please refer to the Cloudformation Extension - Activation Guide on how to activate the Cloudformation extensions

If we deploy this Activation Stack we will be able to create the IAMRole along with the Cloudformation Extension Activation. (Note: We'll need to deploy this stack only once)

To use the activated extensions, you will need to set the Type Configurations for each extensions plugins using below code block. Also helpful if you are creating different stages and account for deployment with same AWS account.

aws cloudformation set-type-configuration --type-name "Datadog::Monitors::Monitor" --type RESOURCE --configuration-alias ConfigurationName --configuration '{"DatadogCredentials": {"ApiKey": "DATADOG_API_KEY_PROD", "ApplicationKey": "DATADOG_APPLICATION_KEY_PROD", "ApiURL": "https://api.datadoghq.eu" }}'

Now we move on to creating the Datadog Resources such as Integration, Monitors and Dashboards.

🏗 Creating Infra Stack

We'll create a different Serverless service stack to deploy the datadog resources.

⚙️ Datadog AWS Integration

Here you will need to provide your AWS Account ID so that Datadog account can do the integration between the two AWS accounts.

RoleName would be the same as we have created in the Activation Stack before.

Note:- ExternalIDSecretName should be unique in your account Secret Manager and will be used to store the external ID by the extension.

DatadogAWSIntegration: {
    Type: "Datadog::Integrations::AWS",
    Properties: {
      AccountID: "AWS_ACCOUNT_ID", // your AWS account ID
      ExternalIDSecretName: "DatadogIntegrationExternalID",
      RoleName: "DatadogAWSIntegrationRole",
    },
},

📊 Datadog Dashboards

Dashboards are helpful to monitor the services and different widgets for any services. Find more about Dashboards in Datadog Dashboards Documentation

Dashboard: {
    Type: "Datadog::Dashboards::Dashboard",
    Properties: {
      DashboardDefinition: "", // stringified object with  dashboard configurations and definitions.
    },
},

⏱ Datadog Monitor

Monitors are to create and capture events for any particular services. You can find more about monitors in Datadog Monitors Documentation

Monitor: {
  Type: "Datadog::Monitors::Monitor",
  Properties: {
    Type: "event-v2 alert", // type of the monitor
    Query: "defines the query of the monitor to capture specific triggered events",
    Name: "monitor-name",
    Message: "message body which will be sent to the communication channel",
    Tags: [], // array of tags assigned to the monitor
    Options: {
      NotifyAudit: false,
      Locked: false,
      EnableLogsSample: false,
      Thresholds: {
        Critical: 1,
        CriticalRecovery: 0.5,
        Warning: 0.75,
      },
      NewHostDelay: 300,
      NotifyNoData: false,
      IncludeTags: true,
      EscalationMessage: "",
    },
    Priority: 1, // priority level - critical
  }

Hope this has been a worthwhile reading! ✨

Furthermore you can explore many more solutions and services that Datadog provides like Logs Forwarding, Cloud Security, Tracing, etc.

Cloudformation Extension - Activation Guide

Jay Motka — Tue, 22 Aug 2023 11:28:11 +0000

📖 Cloudformation Registry

Cloudformation Provides registry extensions to use in the Cloudformation template through which we can create custom resources, manage or view resource configuraitons at the build time of the Cloudformation stack. More on the AWS Cloudformation Docs

The CloudFormation registry lets you manage extensions, both public and private, such as resources, modules, and hooks that are available for use in your AWS account. Currently, you can use the following extension types in the AWS registry: resources types, modules, and hooks. The registry makes it easier to discover and provision extensions in your AWS CloudFormation templates in the same manner you use AWS-provided resources.

In this guide, we will be using Serverless framework to write the CF template.

Note: We can only deploy the activation resources once as we can only Activate the extension one time in a single AWS Account. Deploying same after the extension is activated might throw error in the Cloudformation.

🛠 Extension Setup & Configurations

Cloudformation Extensions require Execution Role which can help extension perform certain actions for the resource we want to create or manage.

Additionally we can provide the Logging Config which can help log the events from the extensions. We can also pass Extention Configurations to have any additional configurations added to the extension at run time.

💡Extension Activation

In this article we will try to activate public third party extensions of different types.

First we will create execution role which can be used by the Extensions to perform actions on Cloudformation Resources.

🔐 Execution Role

You can define more permissions in the role policy if you need to attach other service policies.

ExecutionRole: {
    Type: "AWS::IAM::Role",
    Properties: {
      Path: "/",
      RoleName: `ExtensionExecutionRule`,
      Description: "IAM Role Execution role for Cloudformation Extension",
      MaxSessionDuration: 8400,
      AssumeRolePolicyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Allow",
            Principal: {
              Service: [
                "hooks.cloudformation.amazonaws.com",
                "resources.cloudformation.amazonaws.com",
              ],
            },
            Action: "sts:AssumeRole",
          },
        ],
      },
    },
  }

Resource Type

Github::Repository::Secret is a public third party RESOURCE type extension.

GithubRepoSecretExtensionActivation: {
  Type: "AWS::CloudFormation::TypeActivation",
  Properties: {
    AutoUpdate: true,
    ExecutionRoleArn: {
      "Fn::GetAtt": ["ExecutionRole", "Arn"],
    },
        LoggingConfig: {
            LogGroupName : {
                Ref: "GithubRepoSecretExtensionLogGroup"
            },
          LogRoleArn : ["ExtensionLogRole", "Arn"]
        }
    PublicTypeArn: {
      "Fn::Join": [
        "",
        [
          "arn:aws:cloudformation:",
          { Ref: "AWS::Region" },
          "::type/resource/c830e97710da0c9954d80ba8df021e5439e7134b/GitHub-Repositories-Secret",
        ],
      ],
    },
    Type: "RESOURCE",
    TypeName: "GitHub::Repositories::Secret",
    VersionBump: "MAJOR",
  },
}

Module Type

JFrog::Vpc::MultiAz::MODULE is a public third party MODULE resource.

JFrogModuleExtensionActivation: {
  Type: "AWS::CloudFormation::TypeActivation",
  Properties: {
    AutoUpdate: true,
    ExecutionRoleArn: {
      "Fn::GetAtt": ["ExecutionRole", "Arn"],
    },
        LoggingConfig: {
            LogGroupName : {
                Ref: "JFrogModuleExtensionLogGroup"
            },
          LogRoleArn : ["ExtensionLogRole", "Arn"]
        }
    PublicTypeArn: {
      "Fn::Join": [
        "",
        [
          "arn:aws:cloudformation:",
          { Ref: "AWS::Region" },
          "::type/module/06ff50c2e47f57b381f874871d9fac41796c9522/JFrog-Vpc-MultiAz-MODULE",
        ],
      ],
    },
    Type: "MODULE",
    TypeName: "JFrog::Vpc::MultiAz::MODULE",
    VersionBump: "MAJOR",
  },
}

Hooks Type

Generic::SecretsProtection::Hook is a third party HOOK resource type.

GenericSecretsProtectionHookExtensionActivation: {
  Type: "AWS::CloudFormation::TypeActivation",
  Properties: {
    AutoUpdate: true,
    ExecutionRoleArn: {
      "Fn::GetAtt": ["ExecutionRole", "Arn"],
    },
        LoggingConfig: {
            LogGroupName : {
                Ref: "GenericSecretsProtectionHookExtensionLogGroup"
            },
          LogRoleArn : ["ExtensionLogRole", "Arn"]
        }
    PublicTypeArn: {
      "Fn::Join": [
        "",
        [
          "arn:aws:cloudformation:",
          { Ref: "AWS::Region" },
          "::type/hook/e1238fdd31aee1839e14fb3fb2dac9db154dae29/Generic-SecretsProtection-Hook",
        ],
      ],
    },
    Type: "HOOK",
    TypeName: "Generic::SecretsProtection::Hook",
    VersionBump: "MAJOR",
  },
}

In addition to these fields you can pass TypeNameAlias properties which can be set to any custom values developer wants. And can be used in Cloudformation using that Alias Name. You can find all the properties for Cloudformation TypeActivation in AWS Docs.

⚙️ Setting up Extension Configurations

If the extension needs any additional configurations needed then we can set them using an AWS CLI command

aws cloudformation set-type-configuration --type-name "GitHub::Repositories::Secret" --type RESOURCE --configuration-alias ConfigurationName --configuration '{"Credentials": {"ApiKey": "abc", "ApplicationKey": "abc"}}'

Note: If you specify TypeNameAlias field when extension activation, you’ll need to enter that Alias as --type-name while executing above command to set type configurations.

Hope this help a developer in need! 🎁