Skip to content

[TON-513] Fix workflow instrumentation permissions #314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gh-worker-dd-mergequeue-cf854d merged 2 commits into from
May 27, 2026
Merged

[TON-513] Fix workflow instrumentation permissions #314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a449d96
[TON-513] fix workflow instrumentation permissions
fanny-jiang May 27, 2026
3c3df53
[TON-513] include extended instrumentation permissions
fanny-jiang May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions aws_quickstart/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# 4.11.1 (May 27, 2026)

- Forward `InstrumentationResourceTypes` and `DatadogSite` from workflow and extended templates to the nested integration role stack, so launches can attach the Agent instrumentation IAM permissions selected during onboarding. Affects `main_workflow.yaml`, `main_extended_workflow.yaml`, and `main_extended.yaml`

# 4.11.0 (May 19, 2026)

- Allow the Datadog Agent running in agentless scanner instances to read the systemd journal.
Expand Down
10 changes: 10 additions & 0 deletions aws_quickstart/main_extended.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,13 @@ Parameters:
Datadog CSPM is a product that automatically detects resource misconfigurations in your AWS account according to
industry benchmarks. More info: https://www.datadoghq.com/product/security-platform/cloud-security-posture-management/
Default: false
InstrumentationResourceTypes:
Type: CommaDelimitedList
Description: >-
Comma-separated list of AWS resource types (UDM form, e.g. aws:ec2:instance, aws:ecs:cluster, aws:eks:cluster)
that the Datadog integration role should be granted the IAM permissions required to instrument with the Datadog
Agent. Leave blank to skip granting any extra instrumentation permissions.
Default: ""
AgentlessVulnerabilityScanning:
Type: String
AllowedValues:
Expand Down Expand Up @@ -269,6 +276,8 @@ Resources:
ExternalId: !GetAtt DatadogAPICall.Outputs.ExternalId
IAMRoleName: !Ref IAMRoleName
ResourceCollectionPermissions: !If [ResourceCollectionPermissions, true, false]
InstrumentationResourceTypes: !Join [",", !Ref InstrumentationResourceTypes]
DatadogSite: !Ref DatadogSite
DdAWSAccountId: !If
- IsGov
- !If
Expand Down Expand Up @@ -327,6 +336,7 @@ Metadata:
- ScannerDelegateRoleName
- ScannerInstanceRoleARN
- DisableMetricCollection
- InstrumentationResourceTypes
ParameterLabels:
APIKey:
default: "DatadogApiKey *"
Expand Down
10 changes: 10 additions & 0 deletions aws_quickstart/main_extended_workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,13 @@ Parameters:
Datadog CSPM is a product that automatically detects resource misconfigurations in your AWS account according to
industry benchmarks. More info: https://www.datadoghq.com/product/security-platform/cloud-security-posture-management/
Default: false
InstrumentationResourceTypes:
Type: CommaDelimitedList
Description: >-
Comma-separated list of AWS resource types (UDM form, e.g. aws:ec2:instance, aws:ecs:cluster, aws:eks:cluster)
that the Datadog integration role should be granted the IAM permissions required to instrument with the Datadog
Agent. Leave blank to skip granting any extra instrumentation permissions.
Default: ""
AgentlessVulnerabilityScanning:
Type: String
AllowedValues:
Expand Down Expand Up @@ -474,6 +481,8 @@ Resources:
ExternalId: !Ref ExternalId
IAMRoleName: !Ref IAMRoleName
ResourceCollectionPermissions: !If [ResourceCollectionPermissions, true, false]
InstrumentationResourceTypes: !Join [",", !Ref InstrumentationResourceTypes]
Copy link
Copy Markdown
Contributor

@gpalmz gpalmz May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

main_extended.yaml looks like it has the same gap. Its DatadogIntegrationRoleStack invocation doesn't forward InstrumentationResourceTypes or DatadogSite to the nested stack either, so users launching that template manually (instead of via the Datadog UI) would hit the same missing-perms behavior this PR fixes for the workflow path. Worth folding in here, or filing a follow-up?

Copy link
Copy Markdown
Contributor Author

@fanny-jiang fanny-jiang May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I'll fold the fix in with this PR

DatadogSite: !Ref DatadogSite
DdAWSAccountId: !If
- IsGov
- !If
Expand Down Expand Up @@ -756,6 +765,7 @@ Metadata:
- ScannerDelegateRoleName
- ScannerInstanceRoleARN
- DisableMetricCollection
- InstrumentationResourceTypes
ParameterLabels:
APIKey:
default: "DatadogApiKey *"
Expand Down
10 changes: 10 additions & 0 deletions aws_quickstart/main_workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,13 @@ Parameters:
Disabling resource collection for this account will lead to a loss in visibility into your AWS services.
Disable this if you do not want to collect configuration information for the resources in this AWS account.
Default: false
InstrumentationResourceTypes:
Type: CommaDelimitedList
Description: >-
Comma-separated list of AWS resource types (UDM form, e.g. aws:ec2:instance, aws:ecs:cluster, aws:eks:cluster)
that the Datadog integration role should be granted the IAM permissions required to instrument with the Datadog
Agent. Leave blank to skip granting any extra instrumentation permissions.
Default: ""
WorkflowId:
Description: >-
Unique identifier for this workflow instance. This is generated by the Datadog UI and used to track
Expand Down Expand Up @@ -330,6 +337,8 @@ Resources:
ExternalId: !Ref ExternalId
IAMRoleName: !Ref IAMRoleName
ResourceCollectionPermissions: !If [ResourceCollectionPermissions, true, false]
InstrumentationResourceTypes: !Join [",", !Ref InstrumentationResourceTypes]
DatadogSite: !Ref DatadogSite
DdAWSAccountId: !If
- IsGov
- !If
Expand Down Expand Up @@ -490,6 +499,7 @@ Metadata:
Parameters:
- IAMRoleName
- DisableResourceCollection
- InstrumentationResourceTypes
ParameterLabels:
APIKey:
default: "DatadogApiKey *"
Expand Down
2 changes: 1 addition & 1 deletion aws_quickstart/version.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v4.11.0
v4.11.1
Loading