The standalone configuration to emit when the user has no existing Terraform project. When they do,
take only the resources below the provider blocks and add them to what they already have.
Placeholders to replace before writing the file:
Placeholder
Source
<DD_SITE>
Phase 0 (DD_SITE)
<DATADOG_TRUSTED_ACCOUNT_ID>
The trusted-account table in Phase 1, keyed by DD_SITE
<AWS_ACCOUNT_ID>
Phase 1 (the user’s 12-digit account ID)
hcl
# No root variables hold the Datadog keys. The provider reads them from DD_API_KEY and DD_APP_KEY in the# environment, so there is nothing for Terraform to record: no variable value in state, none in a saved# plan, and no `-var=` on any command line. This also means an existing project needs no variable changes.locals { datadog_site = "<DD_SITE>"}terraform { required_providers { aws = { source = "hashicorp/aws" } datadog = { source = "DataDog/datadog" } }}
Specific regions instead of all. Replace the aws_regions block’s include_all = true with
include_only = ["us-east-1", "eu-west-1"] using the regions the user named in Phase 1.
GovCloud or China partitions. Do not reach for this template by flipping aws_partition. The
trust policy above delegates to a commercial-partition Datadog account, and a partition swap alone leaves
it trusting a principal that cannot assume the role. AWS China has no role-delegation path to Datadog at
all. For GovCloud, the trusted account differs from the commercial one and differs depending on
whether the monitored AWS account is itself in the GovCloud partition - this file deliberately carries no
literal for it. Read the value from
Datadog’s AWS manual setup guide (opens in a new tab) with
the DATADOG SITE selector set to the user’s site, exactly as the skill’s Phase 1 says, and never
reuse the commercial id.
error_message = "AWS credentials are for account ${data.aws_caller_identity.current.account_id}, but this configuration registers <AWS_ACCOUNT_ID> with Datadog. Fix the credentials or the account id before applying."