Skip to content

[TON-466] feat(aws_quickstart): forward CloudTrail resource update events to Datadog#310

Closed
raymondeah wants to merge 9 commits into
masterfrom
ray.eah/ton-466-agent-install-event-forwarding
Closed

[TON-466] feat(aws_quickstart): forward CloudTrail resource update events to Datadog#310
raymondeah wants to merge 9 commits into
masterfrom
ray.eah/ton-466-agent-install-event-forwarding

Conversation

@raymondeah
Copy link
Copy Markdown
Contributor

Note: Please remember to review the contribution guidelines
if you have not yet done so.

What does this PR do?

A brief description of the change being made with this pull request.

Motivation

What inspired you to submit this pull request?

Testing Guidelines

How did you test this pull request?

Additional Notes

Anything else we should know when reviewing?

…instrumenter-events intake

Adds an EventBridge connection, API destination, invocation role, and EC2
CloudTrail rule as a new nested stack, conditionally deployed when
InstrumentationResourceTypes is set. Single-region by design.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@datadog-datadog-prod-us1-2

This comment has been minimized.

raymondeah and others added 4 commits May 19, 2026 15:45
…tionResourceTypes; add EKS

Add an EKS CloudTrail rule (CreateCluster, TagResource, UntagResource) and gate
each rule on whether its UDM type appears in InstrumentationResourceTypes.
Substring check is via Fn::Split / Fn::Join — CFN has no Conditions-level
substring intrinsic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…type

EC2 CreateTags/DeleteTags are scoped to instances via resourcesSet item resourceId
prefix "i-"; EKS TagResource/UntagResource are scoped to cluster ARNs via
wildcard match. Creation events (RunInstances, CreateCluster) bypass the filter
through EventBridge $or because their request payloads don't carry the filter
field.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…4.11.0, changelog

- Rename datadog_agent_install_forwarding.yaml to datadog_agent_resource_update_forwarding.yaml
  (the pipeline forwards resource update events; agent install is one consumer)
- DatadogAgentInstallForwardingStack -> DatadogAgentResourceUpdateForwardingStack in main_v2.yaml
- Bump version.txt to v4.11.0 + add 4.11.0 changelog entry
- Revert README — leave matching current prod

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ored comments

Drop "instrumenter-events" from connection and rule descriptions, the main_v2
comment, and the changelog entry. Remove the explanatory comments I added under
Conditions and Resources (substring-trick and $or rationale). The intake URL
itself stays — it's the actual ApiDestination endpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@raymondeah raymondeah changed the title [TON-466] feat(aws_quickstart): forward CloudTrail events to instrumenter intake [TON-466] feat(aws_quickstart): forward CloudTrail resource update events to Datadog May 19, 2026
raymondeah and others added 4 commits May 19, 2026 16:07
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…gement"

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ded and main_extended_workflow

These two templates also need the InstrumentationResourceTypes parameter
(originally added only to main_v2 in v4.10.0) plus the same gating, role-stack
wiring, and conditional forwarding stack as main_v2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@raymondeah
Copy link
Copy Markdown
Contributor Author

Superseded — reopening as a new draft that also covers main_extended and main_extended_workflow (the templates this actually belongs in; main_v2 deprecating).

@raymondeah raymondeah closed this May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant