From aefe0a5e0a07279da2070e40b59e5fb6129ea15e Mon Sep 17 00:00:00 2001 From: Teddy Kahwaji Date: Thu, 27 Aug 2026 13:44:54 -0400 Subject: [PATCH] Forward Lambda changes through EventBridge --- aws_quickstart/CHANGELOG.md | 2 +- aws_quickstart/cfn_common_test.py | 16 ++++++- ...adog_agent_resource_update_forwarding.yaml | 46 +++++++++++++++---- aws_quickstart/main_agent_installation.yaml | 16 ++++++- aws_quickstart/main_extended_workflow.yaml | 14 ++++++ aws_quickstart/main_workflow.yaml | 14 ++++++ 6 files changed, 95 insertions(+), 13 deletions(-) diff --git a/aws_quickstart/CHANGELOG.md b/aws_quickstart/CHANGELOG.md index 37af1aaa..b2b9b9ad 100644 --- a/aws_quickstart/CHANGELOG.md +++ b/aws_quickstart/CHANGELOG.md @@ -1,6 +1,6 @@ # 4.20.0 (August 27, 2026) -- Add AWS Lambda as a managed instrumentation resource type and avoid provisioning EventBridge resources when only resource types without event forwarding are selected. +- Add AWS Lambda as a managed instrumentation resource type and forward Lambda lifecycle, configuration, and tag changes for event-driven reconciliation. # 4.19.1 (August 25, 2026) diff --git a/aws_quickstart/cfn_common_test.py b/aws_quickstart/cfn_common_test.py index fca6c00a..88dc4b55 100644 --- a/aws_quickstart/cfn_common_test.py +++ b/aws_quickstart/cfn_common_test.py @@ -73,7 +73,7 @@ def test_shared_helper_composes_with_each_handler(self): class TestForwardingConditions(unittest.TestCase): - def test_parent_templates_gate_forwarding_on_ec2_or_eks(self): + def test_parent_templates_gate_forwarding_on_supported_resource_types(self): directory = Path(__file__).parent condition = """ IncludeEC2: Fn::Not: @@ -101,10 +101,24 @@ def test_parent_templates_gate_forwarding_on_ec2_or_eks(self): - !Sub - ",${NormalizedResourceTypes}," - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + IncludeLambda: + Fn::Not: + - Fn::Equals: + - !Join + - "" + - !Split + - ",aws:lambda:function," + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] ShouldForwardEvents: Fn::Or: - Condition: IncludeEC2 - Condition: IncludeEKS + - Condition: IncludeLambda """ for filename in ( diff --git a/aws_quickstart/datadog_agent_resource_update_forwarding.yaml b/aws_quickstart/datadog_agent_resource_update_forwarding.yaml index 189e2217..603ce696 100644 --- a/aws_quickstart/datadog_agent_resource_update_forwarding.yaml +++ b/aws_quickstart/datadog_agent_resource_update_forwarding.yaml @@ -24,8 +24,8 @@ Parameters: Default: "" Description: >- Comma-separated list of AWS resource types (UDM form, e.g. aws:ec2:instance, - aws:eks:cluster) to forward CloudTrail events for. Only rules for the listed - types are deployed. + aws:eks:cluster, aws:lambda:function) to forward CloudTrail events for. Only + rules for the listed types are deployed. Conditions: IncludeEC2: Fn::Not: @@ -37,14 +37,14 @@ Conditions: - Fn::Equals: - !Join ["", !Split [",aws:eks:cluster,", !Sub ",${InstrumentationResourceTypes},"]] - !Sub ",${InstrumentationResourceTypes}," - ShouldForwardEvents: - Fn::Or: - - Condition: IncludeEC2 - - Condition: IncludeEKS + IncludeLAMBDA: + Fn::Not: + - Fn::Equals: + - !Join ["", !Split [",aws:lambda:function,", !Sub ",${InstrumentationResourceTypes},"]] + - !Sub ",${InstrumentationResourceTypes}," Resources: DDIntakeConnection: Type: AWS::Events::Connection - Condition: ShouldForwardEvents Properties: Name: datadog-agent-resource-update-intake-connection Description: Credentials for the Datadog resource update intake @@ -60,7 +60,6 @@ Resources: IsValueSecret: true DDIntakeApiDestination: Type: AWS::Events::ApiDestination - Condition: ShouldForwardEvents Properties: Name: datadog-agent-resource-update-intake-destination ConnectionArn: !GetAtt DDIntakeConnection.Arn @@ -69,7 +68,6 @@ Resources: InvocationRateLimitPerSecond: 10 DDEventBridgeInvocationRole: Type: AWS::IAM::Role - Condition: ShouldForwardEvents Properties: AssumeRolePolicyDocument: Version: 2012-10-17 @@ -91,7 +89,6 @@ Resources: Resource: !Sub "arn:${AWS::Partition}:events:*:${AWS::AccountId}:api-destination/*" DDEventBridgeCrossRegionRole: Type: AWS::IAM::Role - Condition: ShouldForwardEvents Properties: RoleName: datadog-eventbridge-cross-region-role AssumeRolePolicyDocument: @@ -173,3 +170,32 @@ Resources: - Id: datadog-intake Arn: !GetAtt DDIntakeApiDestination.Arn RoleArn: !GetAtt DDEventBridgeInvocationRole.Arn + DDEventForwardingRuleLAMBDA: + Type: AWS::Events::Rule + Condition: IncludeLAMBDA + Properties: + Name: datadog-agent-resource-update-rule-lambda + Description: Forward LAMBDA CloudTrail events to the Datadog resource update intake + State: ENABLED + EventPattern: + source: + - aws.lambda + detail-type: + - "AWS API Call via CloudTrail" + detail: + errorCode: + - exists: false + $or: + - eventName: + - CreateFunction20150331 + - UpdateFunctionConfiguration20150331v2 + - eventName: + - TagResource20170331v2 + - UntagResource20170331v2 + requestParameters: + resource: + - wildcard: "*:function:*" + Targets: + - Id: datadog-intake + Arn: !GetAtt DDIntakeApiDestination.Arn + RoleArn: !GetAtt DDEventBridgeInvocationRole.Arn diff --git a/aws_quickstart/main_agent_installation.yaml b/aws_quickstart/main_agent_installation.yaml index 6bf0ba30..c84faa9b 100644 --- a/aws_quickstart/main_agent_installation.yaml +++ b/aws_quickstart/main_agent_installation.yaml @@ -32,7 +32,7 @@ Parameters: Comma-separated list of AWS resource types (UDM form, e.g. aws:ec2:instance, aws:eks:cluster, aws:lambda:function) to enable Datadog instrumentation for. The integration role is granted the IAM permissions required to instrument these resources. CloudTrail update events are forwarded to Datadog - for aws:ec2:instance and aws:eks:cluster; other types receive IAM permissions but no event forwarding. + for supported resource types; other types receive IAM permissions but no event forwarding. Rules: ValidateAccountId: Assertions: @@ -65,10 +65,24 @@ Conditions: - !Sub - ",${NormalizedResourceTypes}," - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + IncludeLambda: + Fn::Not: + - Fn::Equals: + - !Join + - "" + - !Split + - ",aws:lambda:function," + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] ShouldForwardEvents: Fn::Or: - Condition: IncludeEC2 - Condition: IncludeEKS + - Condition: IncludeLambda Resources: # Attaches only the instrumentation IAM policies to the existing integration role. ManageBasePermissions # is false so the standard and resource-collection policies owned by the role stack are left untouched. diff --git a/aws_quickstart/main_extended_workflow.yaml b/aws_quickstart/main_extended_workflow.yaml index ef6f1ca1..968f5764 100644 --- a/aws_quickstart/main_extended_workflow.yaml +++ b/aws_quickstart/main_extended_workflow.yaml @@ -248,10 +248,24 @@ Conditions: - !Sub - ",${NormalizedResourceTypes}," - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + IncludeLambda: + Fn::Not: + - Fn::Equals: + - !Join + - "" + - !Split + - ",aws:lambda:function," + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] ShouldForwardEvents: Fn::Or: - Condition: IncludeEC2 - Condition: IncludeEKS + - Condition: IncludeLambda EnableAgentlessScanning: Fn::And: - Fn::Not: diff --git a/aws_quickstart/main_workflow.yaml b/aws_quickstart/main_workflow.yaml index c136fb3b..63249b4d 100644 --- a/aws_quickstart/main_workflow.yaml +++ b/aws_quickstart/main_workflow.yaml @@ -148,10 +148,24 @@ Conditions: - !Sub - ",${NormalizedResourceTypes}," - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + IncludeLambda: + Fn::Not: + - Fn::Equals: + - !Join + - "" + - !Split + - ",aws:lambda:function," + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] + - !Sub + - ",${NormalizedResourceTypes}," + - NormalizedResourceTypes: !Join [",", !Ref InstrumentationResourceTypes] ShouldForwardEvents: Fn::Or: - Condition: IncludeEC2 - Condition: IncludeEKS + - Condition: IncludeLambda IsGov: Fn::Or: - Fn::Equals: