AWSTemplateFormatVersion: 2010-09-09
Description: Datadog AWS Integration
Parameters:
  APIKey:
    Description: >-
      API key for the Datadog account (find at https://app.datadoghq.com/organization-settings/api-keys)
    Type: String
    Default: ""
  APPKey:
    Description: >-
      APP key for the Datadog account (find at https://app.datadoghq.com/organization-settings/application-keys). 
      If this template was launched from the Datadog app, this key is tied to the user that launched the template,
      and is a key specifically generated for this integration.
    Type: String
    Default: ""
  DatadogSite:
    Type: String
    Default: datadoghq.com
    Description: Define your Datadog Site to send data to.
    AllowedValues:
      - datadoghq.com
      - datadoghq.eu
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ddog-gov.com
  IAMRoleName:
    Description: Customize the name of IAM role for Datadog AWS integration
    Type: String
    Default: DatadogIntegrationRole
  InstallLambdaLogForwarder:
    Type: String
    AllowedValues:
      - true
      - false
    Description: >-
      Determines whether the default configuration for the Datadog Lambda Log Forwarder is installed 
      as part of this stack. This is useful for sending logs to Datadog for use in Log Management or Cloud SIEM. 
      Customers who want to customize this setup to include specific custom tags, data scrubbing or redaction rules,
      or send logs using AWS PrivateLink should select “no” and install this independently
      (https://docs.datadoghq.com/serverless/libraries_integrations/forwarder/#installation).
    Default: true
  DisableMetricCollection:
    Type: String
    AllowedValues:
      - true
      - false
    Description: >-
      Disabling metric collection for this account will lead to a loss in visibility into your AWS services. 
      Disable this if you only want to collect tags or resource configuration information from this AWS account, 
      and do not want to use Datadog Infrastructure Monitoring.
    Default: false
  CloudSecurityPostureManagement:
    Type: String
    AllowedValues:
      - true
      - false
    Description: >-
      Add the AWS Managed SecurityAudit policy to your Datadog AWS Integration role, and enable 
      Datadog Cloud Security Posture Management (CSPM) to start performing configuration checks across your AWS account.
      Datadog CSPM is a product that automatically detects resource misconfigurations in your AWS account according to 
      industry benchmarks. More info: https://www.datadoghq.com/product/security-platform/cloud-security-posture-management/
    Default: false
Conditions:
  InstallForwarder:
    Fn::Equals:
      - !Ref InstallLambdaLogForwarder
      - true
  CloudSecurityPostureManagementPermissions:
    Fn::Equals:
      - !Ref CloudSecurityPostureManagement
      - true
Resources:
  # A Macro used to generate policies for the integration IAM role based on user inputs
  DatadogAPICall:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: "https://datadog-cloudformation-template.s3.amazonaws.com/aws/datadog_integration_api_call_v2.yaml"
      Parameters:
        DatadogApiKey: !Ref APIKey
        DatadogAppKey: !Ref APPKey
        DatadogSite: !Ref DatadogSite
        RoleName: !Ref IAMRoleName
        CloudSecurityPostureManagement: !Ref CloudSecurityPostureManagement
        DisableMetricCollection: !Ref DisableMetricCollection
  # The IAM role for Datadog integration
  DatadogIntegrationRoleStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: "https://datadog-cloudformation-template.s3.amazonaws.com/aws/datadog_integration_role.yaml"
      Parameters:
        ExternalId: !GetAtt DatadogAPICall.Outputs.ExternalId
        IAMRoleName: !Ref IAMRoleName
        CloudSecurityPostureManagementPermissions: !If [CloudSecurityPostureManagementPermissions, true, false]
        DdAWSAccountId: 464622532012
  # The Lambda function to ship logs from S3 and CloudWatch, custom metrics and traces from Lambda functions to Datadog
  # https://github.com/DataDog/datadog-serverless-functions/tree/master/aws/logs_monitoring
  ForwarderStack:
    Type: AWS::CloudFormation::Stack
    Condition: InstallForwarder
    Properties:
      TemplateURL: "https://datadog-cloudformation-template.s3.amazonaws.com/aws/forwarder/latest.yaml"
      Parameters:
        DdApiKey: !Ref APIKey
        DdSite: !Ref DatadogSite
Outputs:
  IAMRoleName:
    Description: AWS IAM Role named to be used with the DataDog AWS Integration 
    Value: !Ref IAMRoleName
  AccountId:
    Description: AWS Account number
    Value: !Ref "AWS::AccountId"
  Region:
    Description: AWS Region
    Value: !Ref "AWS::Region"
  DatadogForwarderArn:
    Description: Datadog Forwarder Lambda Function ARN
    Condition: InstallForwarder
    Value:
      Fn::GetAtt:
        - ForwarderStack
        - Outputs.DatadogForwarderArn
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-DatadogForwarderArn
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Required
      Parameters:
        - APIKey
        - APPKey
        - DatadogSite
        - InstallLambdaLogForwarder
        - CloudSecurityPostureManagement
    - Label:
        default: Advanced
      Parameters:
        - IAMRoleName
        - DisableMetricCollection
    ParameterLabels:
      APIKey:
        default: "DatadogApiKey *"
      APPKey:
        default: "DatadogAppKey *"
      DatadogSite:
        default: "DatadogSite *"
      CloudSecurityPostureManagement:
        default: "CloudSecurityPostureManagement *"
      InstallLambdaLogForwarder:
        default: "InstallLambdaLogForwarder *"
