template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Pushes logs, metrics and traces from AWS to Datadog.
Mappings:
  Constants:
    DdForwarder:
      Version: 3.130.0
      LayerVersion: "68"
Parameters:
  DdApiKey:
    Type: String
    NoEcho: true
    Default: ""
    Description: The Datadog API key, which can be found from the APIs page (/account/settings#api). It will be stored in AWS Secrets Manager securely. If DdApiKeySecretArn is also set, this value is ignored.
  DdApiKeySecretArn:
    Type: String
    AllowedPattern: "arn:.*:secretsmanager:.*"
    Default: "arn:aws:secretsmanager:DEFAULT"
    Description: The ARN of the secret storing the Datadog API key, if you already have it stored in Secrets Manager. You must store the secret as a plaintext, rather than a key-value pair.
  DdSite:
    Type: String
    Default: datadoghq.com
    Description: Define your Datadog Site to send data to. Possible values are `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`, `us5.datadoghq.com` and `ddog-gov.com`.
    AllowedPattern: .+
    ConstraintDescription: DdSite is required
  FunctionName:
    Type: String
    Default: DatadogForwarder
    Description: The Datadog Forwarder Lambda function name. DO NOT change when updating an existing CloudFormation stack, otherwise the current forwarder function will be replaced and all the triggers will be lost.
  MemorySize:
    Type: Number
    Default: 1024
    MinValue: 128
    MaxValue: 3008
    Description: Memory size for the Datadog Forwarder Lambda function
  Timeout:
    Type: Number
    Default: 120
    Description: Timeout for the Datadog Forwarder Lambda function
  TagsCacheTTLSeconds:
    Type: Number
    Default: 300
    Description: TTL (in seconds) for the Datadog tags cache
  ReservedConcurrency:
    Type: String
    AllowedPattern: "[0-9]*"
    ConstraintDescription: ReservedConcurrency must be an integer number
    Default: ""
    Description: >-
      Reserved concurrency for the Datadog Forwarder Lambda function. If empty, use unreserved account concurrency. We recommend using at least 10 reserved concurrency, but default to 0 as you may need to increase your limits for this. If using unreserved account concurrency you may limit other lambda functions in your environment.
  LogRetentionInDays:
    Type: Number
    Default: 90
    Description: CloudWatch log retention for logs generated by the Datadog Forwarder Lambda function
  SourceZipUrl:
    Type: String
    Default: ""
    Description: DO NOT CHANGE unless you know what you are doing. Override the default location of the function source code.
  InstallAsLayer:
    Type: String
    Default: true
    Description: Whether to use the layer-based installation flow. Set to false to use our legacy installation flow, which installs a second function that copies the forwarder code from Github to an S3 bucket. Defaults to true.
    AllowedValues:
      - true
      - false
  LayerARN:
    Type: String
    Default: ""
    Description: ARN for the layer containing the forwarder code. If empty, the script will use the version of the layer the forwarder was published with.
  DdTags:
    Type: String
    Default: ""
    Description: Add custom tags to forwarded logs, comma-delimited string, no trailing comma, e.g., env:prod,stack:classic
  DdFetchLambdaTags:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    Description: Let the forwarder fetch Lambda tags using GetResources API calls and apply them to logs, metrics and traces. If set to true, permission tag:GetResources will be automatically added to the Lambda execution IAM role. The tags are cached in memory and S3 so that they'll only be fetched when the function cold starts or when the TTL (1 hour) expires. The forwarder increments the aws.lambda.enhanced.get_resources_api_calls metric for each API call made.
  DdFetchLogGroupTags:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    Description: Let the forwarder fetch Log Group tags using ListTagsLogGroup and apply them to logs, metrics and traces. If set to true, permission logs:ListTagsLogGroup will be automatically added to the Lambda execution IAM role. The tags are cached in memory and S3 so that they'll only be fetched when the function cold starts or when the TTL (1 hour) expires. The forwarder increments the aws.lambda.enhanced.list_tags_log_group_api_call metric for each API call made.
  DdFetchStepFunctionsTags:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    Description: Let the forwarder fetch Step Functions tags using GetResources API calls and apply them to logs, metrics and traces. If set to true, permission tag:GetResources will be automatically added to the Lambda execution IAM role. The tags are cached in memory and S3 so that they'll only be fetched when the function cold starts or when the TTL (1 hour) expires. The forwarder increments the aws.lambda.enhanced.get_resources_api_calls metric for each API call made.
  DdUseTcp:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: By default, the forwarder sends logs using HTTPS through the port 443. To send logs over an SSL encrypted TCP connection, set this parameter to true.
  DdNoSsl:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Disable SSL when forwarding logs, set to true when forwarding logs through a proxy.
  DdUrl:
    Type: String
    Default: ""
    Description: The endpoint URL to forward the logs to, useful for forwarding logs through a proxy
  DdPort:
    Type: String
    Default: ""
    Description: The endpoint port to forward the logs to, useful for forwarding logs through a proxy
  DdSkipSslValidation:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Send logs over HTTPS, while NOT validating the certificate provided by the endpoint. This will still encrypt the traffic between the forwarder and the log intake endpoint, but will not verify if the destination SSL certificate is valid.
  RedactIp:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Replace text matching \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with xxx.xxx.xxx.xxx
  RedactEmail:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Replace text matching [a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+ with xxxxx@xxxxx.com
  DdScrubbingRule:
    Type: String
    Default: ""
    Description: Replace text matching the supplied regular expression with xxxxx (default) or DdScrubbingRuleReplacement (if supplied). Log scrubbing rule is applied to the full JSON-formatted log, including any metadata that is automatically added by the Lambda function. Each instance of a pattern match is replaced until no more matches are found in each log. Note, using inefficient regular expression, such as `.*`, may slow down the Lambda function.
  DdScrubbingRuleReplacement:
    Type: String
    Default: ""
    Description: Replace text matching DdScrubbingRule with the supplied text
  ExcludeAtMatch:
    Type: String
    Default: ""
    Description: DO NOT send logs matching the supplied regular expression. If a log matches both the ExcludeAtMatch and IncludeAtMatch, it is excluded. Filtering rules are applied to the full JSON-formatted log, including any metadata that is automatically added by the function. Note, using inefficient regular expression, such as `.*`, may slow down the Lambda function.
  IncludeAtMatch:
    Type: String
    Default: ""
    Description: Only send logs matching the supplied regular expression and not excluded by ExcludeAtMatch. Note, using inefficient regular expression, such as `.*`, may slow down the Lambda function.
  DdMultilineLogRegexPattern:
    Type: String
    Default: ""
    Description: Use the supplied regular expression to detect for a new log line for multiline logs from S3, e.g., use expression "\d{2}\/\d{2}\/\d{4}" for multiline logs beginning with pattern "11/10/2014".
  DdForwardLog:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    Description: Set to false to disable log forwarding, while continuing to forward other observability data, such as metrics and traces from Lambda functions.
  DdStepFunctionsTraceEnabled:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Set to true to enable tracing for all Step Functions.
  DdUseCompression:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    Description: Set to false to disable log compression. Only valid when sending logs over HTTP.
  DdUsePrivateLink:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: DEPRECATED, DO NOT CHANGE. See README.md for details. Set to true to deploy the Forwarder to a VPC and send logs, metrics, and traces via AWS PrivateLink. When set to true, must also set VPCSecurityGroupIds and VPCSubnetIds.
  DdUseVPC:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Set to true to deploy the Forwarder to a VPC and send logs, metrics, and traces via a proxy. When set to true, must also set VPCSecurityGroupIds and VPCSubnetIds.
  DdHttpProxyURL:
    Type: String
    Default: ""
    Description: "Sets the standard web proxy environment variables HTTP_PROXY and HTTPS_PROXY. These are the url endpoints your proxy server exposes. Don't use this in combination with AWS Private Link. Make sure to also set DdSkipSslValidation to true."
  DdNoProxy:
    Type: String
    Default: ""
    Description: "Sets the standard web proxy environment variable NO_PROXY. It is a comma-separated list of domain names that should be excluded from the web proxy."
  VPCSecurityGroupIds:
    Type: CommaDelimitedList
    Default: ""
    Description: Comma separated list of VPC Security Group Ids. Used when DdUsePrivateLink or DdUseVPC is enabled.
  VPCSubnetIds:
    Type: CommaDelimitedList
    Default: ""
    Description: Comma separated list of VPC Subnet Ids. Used when DdUsePrivateLink or DdUseVPC is enabled.
  DdCompressionLevel:
    Type: Number
    Default: 6
    AllowedValues: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
    Description: Set the compression level from 0 (no compression) to 9 (best compression) when sending logs.
  DdMaxWorkers:
    Type: Number
    Default: 20
    Description: Set the max number of workers sending logs concurrently.
  PermissionsBoundaryArn:
    Type: String
    Default: ""
    Description: ARN for the Permissions Boundary Policy
  AdditionalTargetLambdaArns:
    Type: CommaDelimitedList
    Default: ""
    Description: Comma separated list of lambda ARNs that get invoked asynchronously with the same input event
  DdApiUrl:
    Type: String
    Default: ""
    Description: The endpoint URL to forward the metrics to, useful for forwarding metrics through a proxy
  DdTraceIntakeUrl:
    Type: String
    Default: ""
    Description: The endpoint URL to forward the traces to, useful for forwarding traces through a proxy
  DdForwarderBucketName:
    Type: String
    Default: ""
    Description: The name of the forwarder bucket to create. If not provided, AWS will generate a unique name.
  DdForwarderBucketsAccessLogsTarget:
    Type: String
    Default: ""
    Description: (Optional) The name of the S3 bucket to store access logs. Leave empty if access logging is not needed.
  DdStoreFailedEvents:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Set to true to enable the forwarder to store events that failed to send to Datadog.
  DdForwarderExistingBucketName:
    Type: String
    Default: ""
    Description: The name of an existing s3 bucket to use. If not provided, a new bucket will be created.
Conditions:
  IsAWSChina: !Equals [!Ref 'AWS::Partition', aws-cn]
  IsGovCloud: !Equals [!Ref 'AWS::Partition', aws-us-gov]
  UseZipCopier: !Or
    - !Condition IsAWSChina
    - !And
      - !Equals [!Ref InstallAsLayer, "false"]
      - !Not
        - !Condition SetLayerARN
  CreateDdApiKeySecret: !Equals [!Ref DdApiKeySecretArn, 'arn:aws:secretsmanager:DEFAULT']
  SetFunctionName: !Not
    - !Equals [!Ref FunctionName, DatadogForwarder]
  SetSourceZipUrl: !Not
    - !Equals [!Ref SourceZipUrl, ""]
  SetS3SourceZip: !Equals [!Select [0, !Split [/, !Ref SourceZipUrl]], "s3:"]
  SetDdTags: !Not
    - !Equals [!Ref DdTags, ""]
  SetDdUseTcp: !Equals [!Ref DdUseTcp, true]
  SetDdNoSsl: !Equals [!Ref DdNoSsl, true]
  SetDdUrl: !Not
    - !Equals [!Ref DdUrl, ""]
  SetDdPort: !Not
    - !Equals [!Ref DdPort, ""]
  SetRedactIp: !Equals [!Ref RedactIp, true]
  SetRedactEmail: !Equals [!Ref RedactEmail, true]
  SetDdScrubbingRule: !Not
    - !Equals [!Ref DdScrubbingRule, ""]
  SetDdScrubbingRuleReplacement: !Not
    - !Equals [!Ref DdScrubbingRuleReplacement, ""]
  SetExcludeAtMatch: !Not
    - !Equals [!Ref ExcludeAtMatch, ""]
  SetIncludeAtMatch: !Not
    - !Equals [!Ref IncludeAtMatch, ""]
  SetDdMultilineLogRegexPattern: !Not
    - !Equals [!Ref DdMultilineLogRegexPattern, ""]
  SetDdSkipSslValidation: !Equals [!Ref DdSkipSslValidation, true]
  SetDdFetchLambdaTags: !Equals [!Ref DdFetchLambdaTags, true]
  SetDdFetchLogGroupTags: !Equals [!Ref DdFetchLogGroupTags, true]
  SetDdFetchStepFunctionsTags: !Equals [!Ref DdFetchStepFunctionsTags, true]
  CreateS3Bucket: !And
    - !Or
      - !Equals [!Ref DdFetchLogGroupTags, true]
      - !Equals [!Ref DdFetchLambdaTags, true]
    - !Equals [!Ref DdForwarderExistingBucketName, ""]
  SetDdUsePrivateLink: !Equals [!Ref DdUsePrivateLink, true]
  SetDdUseVPC: !Equals [!Ref DdUseVPC, true]
  SetDdHttpProxyURL: !Not
    - !Equals [!Ref DdHttpProxyURL, ""]
  SetDdNoProxy: !Not
    - !Equals [!Ref DdNoProxy, ""]
  SetLayerARN: !Not
    - !Equals [!Ref LayerARN, ""]
  UseVPC: !Or
    - !Condition SetDdUsePrivateLink
    - !Condition SetDdUseVPC
  SetDdForwardLog: !Equals [!Ref DdForwardLog, false]
  SetDdStepFunctionsTraceEnabled: !Equals [!Ref DdStepFunctionsTraceEnabled, true]
  SetDdUseCompression: !Equals [!Ref DdUseCompression, false]
  SetDdCompressionLevel: !Not
    - !Equals [!Ref DdCompressionLevel, 6]
  SetDdMaxWorkers: !Not
    - !Equals [!Ref DdMaxWorkers, 20]
  SetPermissionsBoundary: !Not
    - !Equals [!Ref PermissionsBoundaryArn, ""]
  SetAdditionalTargetLambdas: !Not
    - !Equals [!Join ["", !Ref AdditionalTargetLambdaArns], ""]
  SetDdApiUrl: !Not
    - !Equals [!Ref DdApiUrl, ""]
  SetDdTraceIntakeUrl: !Not
    - !Equals [!Ref DdTraceIntakeUrl, ""]
  SetDdForwarderBucketName: !Not
    - !Equals [!Ref DdForwarderBucketName, ""]
  SetReservedConcurrentExecutions: !Not
    - !Equals [!Ref ReservedConcurrency, ""]
  ShouldUseAccessLogBucket: !Not
    - !Equals [!Ref DdForwarderBucketsAccessLogsTarget, ""]
  ShouldDdFetchTags: !Or
    - !Equals [!Ref DdFetchLambdaTags, true]
    - !Equals [!Ref DdFetchStepFunctionsTags, true]
  SetForwarderBucket: !Or
    - !Condition CreateS3Bucket
    - !Not
      - !Equals [!Ref DdForwarderExistingBucketName, ""]
  SetVpcSecurityGroupIds: !Not
    - !Equals [!Join ["", !Ref VPCSecurityGroupIds], ""]
  SetVpcSubnetIds: !Not
    - !Equals [!Join ["", !Ref VPCSubnetIds], ""]
Rules:
  MustSetDdApiKey:
    Assertions:
      - Assert: !Or
          - !Not
            - !Equals [!Ref DdApiKey, ""]
          - !Not
            - !Equals [!Ref DdApiKeySecretArn, "arn:aws:secretsmanager:DEFAULT"]
        AssertDescription: DdApiKey or DdApiKeySecretArn must be set
Resources:
  Forwarder:
    Type: AWS::Lambda::Function
    DependsOn: ForwarderZipReady
    Properties:
      FunctionName: !If
        - SetFunctionName
        - !Ref FunctionName
        - !Ref AWS::NoValue
      Description: Pushes logs, metrics and traces from AWS to Datadog.
      Role: !GetAtt "ForwarderRole.Arn"
      Handler: lambda_function.lambda_handler
      Layers: !If
        - UseZipCopier
        - []
        - - !If
            - SetLayerARN
            - !Ref LayerARN
            - !Join
              - ":"
              - - arn
                - !Ref AWS::Partition
                - lambda
                - !Ref AWS::Region
                - !If [IsGovCloud, "002406178527", "464622532012"]
                - layer
                - Datadog-Forwarder
                - !FindInMap [Constants, DdForwarder, LayerVersion]
      Code: !If
        - UseZipCopier
        - S3Bucket: !If
            - CreateS3Bucket
            - !Ref ForwarderBucket
            - !Ref DdForwarderExistingBucketName
          S3Key: !Sub
            - "aws-dd-forwarder-${DdForwarderVersion}.zip"
            - {DdForwarderVersion: !FindInMap [Constants, DdForwarder, Version]}
        - ZipFile: " "
      MemorySize: !Ref MemorySize
      Runtime: python3.11
      Timeout: !Ref Timeout
      Tags:
        - Key: "dd_forwarder_version"
          Value: !FindInMap [Constants, DdForwarder, Version]
      Environment:
        Variables:
          DD_ENHANCED_METRICS: "false"
          DD_API_KEY_SECRET_ARN: !If
            - CreateDdApiKeySecret
            - !Ref DdApiKeySecret
            - !Ref DdApiKeySecretArn
          DD_S3_BUCKET_NAME: !If
            - CreateS3Bucket
            - !Ref ForwarderBucket
            - !Ref DdForwarderExistingBucketName
          DD_SITE: !Ref DdSite
          DD_TAGS: !If
            - SetDdTags
            - !Ref DdTags
            - !Ref AWS::NoValue
          DD_TAGS_CACHE_TTL_SECONDS: !Ref TagsCacheTTLSeconds
          DD_FETCH_LAMBDA_TAGS: !If
            - SetDdFetchLambdaTags
            - !Ref DdFetchLambdaTags
            - !Ref AWS::NoValue
          DD_FETCH_LOG_GROUP_TAGS: !If
            - SetDdFetchLogGroupTags
            - !Ref DdFetchLogGroupTags
            - !Ref AWS::NoValue
          DD_FETCH_STEP_FUNCTIONS_TAGS: !If
            - SetDdFetchStepFunctionsTags
            - !Ref DdFetchStepFunctionsTags
            - !Ref AWS::NoValue
          DD_USE_TCP: !If
            - SetDdUseTcp
            - !Ref DdUseTcp
            - !Ref AWS::NoValue
          DD_NO_SSL: !If
            - SetDdNoSsl
            - !Ref DdNoSsl
            - !Ref AWS::NoValue
          DD_URL: !If
            - SetDdUrl
            - !Ref DdUrl
            - !Ref AWS::NoValue
          DD_PORT: !If
            - SetDdPort
            - !Ref DdPort
            - !Ref AWS::NoValue
          DD_STORE_FAILED_EVENTS: !If
            - SetForwarderBucket
            - !Ref DdStoreFailedEvents
            - !Ref AWS::NoValue
          REDACT_IP: !If
            - SetRedactIp
            - !Ref RedactIp
            - !Ref AWS::NoValue
          REDACT_EMAIL: !If
            - SetRedactEmail
            - !Ref RedactEmail
            - !Ref AWS::NoValue
          DD_SCRUBBING_RULE: !If
            - SetDdScrubbingRule
            - !Ref DdScrubbingRule
            - !Ref AWS::NoValue
          DD_SCRUBBING_RULE_REPLACEMENT: !If
            - SetDdScrubbingRuleReplacement
            - !Ref DdScrubbingRuleReplacement
            - !Ref AWS::NoValue
          EXCLUDE_AT_MATCH: !If
            - SetExcludeAtMatch
            - !Ref ExcludeAtMatch
            - !Ref AWS::NoValue
          INCLUDE_AT_MATCH: !If
            - SetIncludeAtMatch
            - !Ref IncludeAtMatch
            - !Ref AWS::NoValue
          DD_MULTILINE_LOG_REGEX_PATTERN: !If
            - SetDdMultilineLogRegexPattern
            - !Ref DdMultilineLogRegexPattern
            - !Ref AWS::NoValue
          DD_SKIP_SSL_VALIDATION: !If
            - SetDdSkipSslValidation
            - !Ref DdSkipSslValidation
            - !Ref AWS::NoValue
          DD_FORWARD_LOG: !If
            - SetDdForwardLog
            - !Ref DdForwardLog
            - !Ref AWS::NoValue
          DD_STEP_FUNCTIONS_TRACE_ENABLED: !If
            - SetDdStepFunctionsTraceEnabled
            - !Ref DdStepFunctionsTraceEnabled
            - !Ref AWS::NoValue
          DD_USE_COMPRESSION: !If
            - SetDdUseCompression
            - !Ref DdUseCompression
            - !Ref AWS::NoValue
          DD_COMPRESSION_LEVEL: !If
            - SetDdCompressionLevel
            - !Ref DdCompressionLevel
            - !Ref AWS::NoValue
          DD_MAX_WORKERS: !If
            - SetDdMaxWorkers
            - !Ref DdMaxWorkers
            - !Ref AWS::NoValue
          DD_USE_PRIVATE_LINK: !If
            - SetDdUsePrivateLink
            - true
            - false
          DD_USE_VPC: !If
            - UseVPC
            - true
            - false
          HTTP_PROXY: !If
            - SetDdHttpProxyURL
            - !Ref DdHttpProxyURL
            - !Ref AWS::NoValue
          HTTPS_PROXY: !If
            - SetDdHttpProxyURL
            - !Ref DdHttpProxyURL
            - !Ref AWS::NoValue
          NO_PROXY: !If
            - SetDdNoProxy
            - !Ref DdNoProxy
            - !Ref AWS::NoValue
          DD_ADDITIONAL_TARGET_LAMBDAS: !If
            - SetAdditionalTargetLambdas
            - !Join
              - ","
              - !Ref AdditionalTargetLambdaArns
            - !Ref AWS::NoValue
          DD_API_URL: !If
            - SetDdApiUrl
            - !Ref DdApiUrl
            - !Ref AWS::NoValue
          DD_TRACE_INTAKE_URL: !If
            - SetDdTraceIntakeUrl
            - !Ref DdTraceIntakeUrl
            - !Ref AWS::NoValue
      ReservedConcurrentExecutions: !If
        - SetReservedConcurrentExecutions
        - !Ref ReservedConcurrency
        - !Ref AWS::NoValue
      VpcConfig: !If
        - UseVPC
        - SecurityGroupIds: !If
            - SetVpcSecurityGroupIds
            - !Ref VPCSecurityGroupIds
            - !Ref AWS::NoValue
          SubnetIds: !If
            - SetVpcSubnetIds
            - !Ref VPCSubnetIds
            - !Ref AWS::NoValue
        - !Ref AWS::NoValue
  ForwarderRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
      PermissionsBoundary: !If
        - SetPermissionsBoundary
        - !Ref PermissionsBoundaryArn
        - !Ref AWS::NoValue
      Policies:
        - PolicyName: ForwarderRolePolicy0
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - !If
                # Access the s3 bucket that is used by the forwarder as a datastore
                - SetForwarderBucket
                - Action:
                    - s3:GetObject
                    - s3:PutObject
                    - s3:DeleteObject
                  Resource:
                    - !If
                      - CreateS3Bucket
                      - !Sub "${ForwarderBucket.Arn}/*"
                      - !Sub "arn:${AWS::Partition}:s3:::${DdForwarderExistingBucketName}/*"
                  Effect: Allow
                - !Ref AWS::NoValue
              - !If
                # Get the actual log content from the s3 bucket based on the received s3 event.
                # Use PermissionsBoundaryArn to limit (allow/deny) access if needed.
                - SetForwarderBucket
                - Action:
                    - s3:ListBucket
                  Resource:
                    - !If
                      - CreateS3Bucket
                      - !GetAtt ForwarderBucket.Arn
                      - !Sub "arn:${AWS::Partition}:s3:::${DdForwarderExistingBucketName}"
                  Condition:
                    StringLike:
                      s3:prefix:
                        - "failed_events/*"
                        - "cache/*"
                  Effect: Allow
                - !Ref AWS::NoValue
              - Action:
                  - s3:GetObject
                Resource: "*"
                Effect: Allow
              # To get object from encrypted s3 buckets. Use PermissionsBoundaryArn to limit access if needed.
              # https://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-403/#AWS_KMS_encryption
              - Action:
                  - kms:Decrypt
                Resource: "*"
                Effect: Allow
              # Access the Datadog API key from Secrets Manager
              - Action:
                  - secretsmanager:GetSecretValue
                Resource: !If
                  - CreateDdApiKeySecret
                  - !Ref DdApiKeySecret
                  - !Sub "${DdApiKeySecretArn}*"
                Effect: Allow
              - !If
                # Fetch Lambda resource tags for data enrichment
                # Fetch Step Functions resource tags for data enrichment
                - ShouldDdFetchTags
                - Action:
                    - tag:GetResources
                  Resource: "*"
                  Effect: Allow
                - !Ref AWS::NoValue
              - !If
                # Get tags for log groups and attach them to the logs sent to Datadog
                - SetDdFetchLogGroupTags
                - Action:
                    - logs:ListTagsForResource
                  Resource: "*"
                  Effect: Allow
                - !Ref AWS::NoValue
              - !If
                # Required for Lambda deployed in VPC
                - UseVPC
                - Action:
                    - ec2:CreateNetworkInterface
                    - ec2:DescribeNetworkInterfaces
                    - ec2:DeleteNetworkInterface
                  Resource: "*"
                  Effect: Allow
                - !Ref AWS::NoValue
              - !If
                # To invoke a follower Lambda with the same event received by the forwarder for dual-shipping
                - SetAdditionalTargetLambdas
                - Action:
                    - lambda:InvokeFunction
                  Resource: !Ref AdditionalTargetLambdaArns
                  Effect: Allow
                - !Ref AWS::NoValue
      Tags:
        - Value: !FindInMap [Constants, DdForwarder, Version]
          Key: dd_forwarder_version
  CloudWatchLogsInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt "Forwarder.Arn"
      Action: lambda:InvokeFunction
      Principal: !If
        - IsAWSChina
        - "logs.amazonaws.com.cn"
        - "logs.amazonaws.com"
      SourceAccount: !Ref "AWS::AccountId"
      SourceArn: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:*"
  S3Permission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref "Forwarder"
      Action: lambda:InvokeFunction
      Principal: "s3.amazonaws.com"
      SourceAccount: !Ref "AWS::AccountId"
  SNSPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref "Forwarder"
      Action: lambda:InvokeFunction
      Principal: "sns.amazonaws.com"
      SourceAccount: !Ref "AWS::AccountId"
  CloudWatchEventsPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref "Forwarder"
      Action: lambda:InvokeFunction
      Principal: !If
        - IsAWSChina
        - "events.amazonaws.com.cn"
        - "events.amazonaws.com"
      SourceAccount: !Ref "AWS::AccountId"
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${Forwarder}
      RetentionInDays: !Ref LogRetentionInDays
  DdApiKeySecret:
    Type: AWS::SecretsManager::Secret
    Condition: CreateDdApiKeySecret
    Properties:
      Description: Datadog API Key
      SecretString: !Ref DdApiKey
  # A s3 bucket used by the Forwarder as a datastore
  ForwarderBucket:
    Type: AWS::S3::Bucket
    Condition: CreateS3Bucket
    Properties:
      BucketName: !If
        - SetDdForwarderBucketName
        - !Ref DdForwarderBucketName
        - !Ref AWS::NoValue
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: "aws:kms"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LoggingConfiguration: !If
        - ShouldUseAccessLogBucket
        - DestinationBucketName: !Ref DdForwarderBucketsAccessLogsTarget
          LogFilePrefix: "datadog-forwarder/"
        - !Ref "AWS::NoValue"
      LifecycleConfiguration:
        Rules:
          - Id: delete-incomplete-mpu-7days
            Prefix: ""
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            Status: Enabled
  ForwarderBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Condition: CreateS3Bucket
    Properties:
      Bucket: !Ref ForwarderBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowSSLRequestsOnly
            Action:
              - s3:*
            Effect: Deny
            Resource:
              - !Sub "${ForwarderBucket.Arn}"
              - !Sub "${ForwarderBucket.Arn}/*"
            Condition:
              Bool:
                "aws:SecureTransport": "false"
            Principal: "*"
  ForwarderZip:
    Type: Custom::ForwarderZip
    Condition: UseZipCopier
    Properties:
      ServiceToken: !GetAtt "ForwarderZipCopier.Arn"
      DestZipsBucket: !If
        - CreateS3Bucket
        - !Ref ForwarderBucket
        - !Ref DdForwarderExistingBucketName
      SourceZipUrl: !If
        - SetSourceZipUrl
        - !Ref SourceZipUrl
        - !Sub
          - "https://github.com/DataDog/datadog-serverless-functions/releases/download/aws-dd-forwarder-${DdForwarderVersion}/aws-dd-forwarder-${DdForwarderVersion}.zip"
          - {DdForwarderVersion: !FindInMap [Constants, DdForwarder, Version]}
  # The Forwarder's source code is too big to fit the inline code size limit for CloudFormation. In most of AWS
  # partitions and regions, the Forwarder is able to load its source code from a Lambda layer attached to it.
  # In places where Datadog can't/doesn't yet publish Lambda layers, use another Lambda to copy the source code
  # from github to a s3 bucket in the partition & region where the forwarder is deployed to.
  ForwarderZipCopier:
    Type: AWS::Lambda::Function
    Condition: UseZipCopier
    Properties:
      Description: Copies Datadog Forwarder zip to the destination S3 bucket
      Handler: index.handler
      Runtime: python3.11
      Timeout: 600
      Code:
        ZipFile: |
          import json
          import logging
          import threading
          import boto3
          import urllib.request
          import os

          def send_cfn_resp(event, context, response_status):
              resp_body = json.dumps({
                  'Status': response_status,
                  'Reason': f'See reasons in CloudWatch Logs - group: {context.log_group_name}, stream:{context.log_stream_name}',
                  'PhysicalResourceId': context.log_stream_name,
                  'StackId': event['StackId'],
                  'RequestId': event['RequestId'],
                  'LogicalResourceId': event['LogicalResourceId'],
                  'Data': {}
              }).encode('utf-8')
              req = urllib.request.Request(url=event['ResponseURL'], data=resp_body, method='PUT')
              with urllib.request.urlopen(req) as f:
                  logging.info(f'Sent response to CloudFormation: {f.status}, {f.reason}')
          def delete_zips(bucket):
              s3 = boto3.resource('s3')
              bucket = s3.Bucket(bucket)
              bucket.objects.all().delete()
          def copy_zip(source_zip_url, dest_zips_bucket):
              s3 = boto3.client('s3')
              s3_prelude = "s3://"
              filename = "aws-dd-forwarder-{}.zip".format(os.environ.get("DD_FORWARDER_VERSION"))
              if source_zip_url.startswith(s3_prelude):
                  parts = source_zip_url[len(s3_prelude):].split('/')
                  bucket = parts[0]
                  key = '/'.join(parts[1:])
                  response = s3.get_object(Bucket=bucket, Key=key)
                  data = response["Body"]
                  s3.upload_fileobj(data, dest_zips_bucket, filename)
              else:
                  with urllib.request.urlopen(source_zip_url) as data:
                      s3.upload_fileobj(data, dest_zips_bucket, filename)
          def timeout(event, context):
              logging.error('Execution is about to time out, sending failure response to CloudFormation')
              send_cfn_resp(event, context, 'FAILED')
          def handler(event, context):
              # make sure we send a failure to CloudFormation if the function
              # is going to timeout
              timer = threading.Timer((context.get_remaining_time_in_millis()
                        / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()
              logging.info(f'Received event: {json.dumps(event)}')
              try:
                  source_zip_url = event['ResourceProperties']['SourceZipUrl']
                  dest_zips_bucket = event['ResourceProperties']['DestZipsBucket']
                  if event['RequestType'] == 'Delete':
                      delete_zips(dest_zips_bucket)
                  else:
                      copy_zip(source_zip_url, dest_zips_bucket)
              except Exception as e:
                  logging.exception(f'Exception when copying zip from {source_zip_url} to {dest_zips_bucket}')
                  send_cfn_resp(event, context, 'FAILED')
              else:
                  send_cfn_resp(event, context, 'SUCCESS')
              finally:
                  timer.cancel()
      Environment:
        Variables:
          DD_FORWARDER_VERSION: !FindInMap [Constants, DdForwarder, Version]
      Role: !GetAtt "ForwarderZipCopierRole.Arn"
  ForwarderZipReady:
    Type: AWS::CloudFormation::WaitConditionHandle
    Metadata:
      ForwarderZipCopierReady: !If [UseZipCopier, !Ref ForwarderZip, ""]
  ForwarderZipCopierRole:
    Type: AWS::IAM::Role
    Condition: UseZipCopier
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
      PermissionsBoundary: !If
        - SetPermissionsBoundary
        - !Ref PermissionsBoundaryArn
        - !Ref AWS::NoValue
      Policies:
        - PolicyName: ForwarderZipCopierRolePolicy0
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !If
                    - CreateS3Bucket
                    - !Sub "${ForwarderBucket.Arn}/*"
                    - !Sub "arn:${AWS::Partition}:s3:::${DdForwarderExistingBucketName}/*"
              - Effect: Allow
                Action:
                  - s3:ListBucket
                Resource:
                  - !If
                    - CreateS3Bucket
                    - !GetAtt "ForwarderBucket.Arn"
                    - !Sub "arn:${AWS::Partition}:s3:::${DdForwarderExistingBucketName}"
              - !If
                - SetS3SourceZip
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource:
                    - !Join
                      - ""
                      - - "arn:*:s3:::"
                        - !Select [1, !Split ["s3://", !Ref SourceZipUrl]]
                - !Ref AWS::NoValue
Outputs:
  DatadogForwarderArn:
    Description: Datadog Forwarder Lambda Function ARN
    Value: !GetAtt
      - Forwarder
      - Arn
    Export:
      Name: !Sub ${AWS::StackName}-ForwarderArn
  DdApiKeySecretArn:
    Description: ARN of SecretsManager Secret with Datadog API Key
    Value: !Ref DdApiKeySecret
    Export:
      Name: !Sub ${AWS::StackName}-ApiKeySecretArn
    Condition: CreateDdApiKeySecret
  ForwarderBucketName:
    Condition: SetForwarderBucket
    Description: Name of the S3 bucket used by the Forwarder
    Value: !If
      - CreateS3Bucket
      - !Ref ForwarderBucket
      - !Ref DdForwarderExistingBucketName
    Export:
      Name: !Sub ${AWS::StackName}-ForwarderBucketName
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Required
        Parameters:
          - DdApiKey
          - DdApiKeySecretArn
          - DdSite
      - Label:
          default: Lambda Function (Optional)
        Parameters:
          - FunctionName
          - MemorySize
          - Timeout
          - ReservedConcurrency
          - LogRetentionInDays
      - Label:
          default: Log Forwarding (Optional)
        Parameters:
          - DdTags
          - DdMultilineLogRegexPattern
          - DdUseTcp
          - DdNoSsl
          - DdUrl
          - DdPort
          - DdSkipSslValidation
          - DdUseCompression
          - DdCompressionLevel
          - DdMaxWorkers
          - DdForwardLog
      - Label:
          default: Log Scrubbing (Optional)
        Parameters:
          - RedactIp
          - RedactEmail
          - DdScrubbingRule
          - DdScrubbingRuleReplacement
      - Label:
          default: Log Filtering (Optional)
        Parameters:
          - ExcludeAtMatch
          - IncludeAtMatch
      - Label:
          default: Advanced (Optional)
        Parameters:
          - DdFetchLambdaTags
          - DdFetchLogGroupTags
          - DdFetchStepFunctionsTags
          - DdStepFunctionsTraceEnabled
          - TagsCacheTTLSeconds
          - SourceZipUrl
          - InstallAsLayer
          - LayerARN
          - PermissionsBoundaryArn
          - DdUsePrivateLink
          - DdUseVPC
          - DdHttpProxyURL
          - DdNoProxy
          - VPCSecurityGroupIds
          - VPCSubnetIds
          - DdApiUrl
          - DdTraceIntakeUrl
          - AdditionalTargetLambdaArns
          - DdForwarderExistingBucketName
          - DdForwarderBucketName
          - DdStoreFailedEvents
    ParameterLabels:
      DdApiKey:
        default: "DdApiKey *"
      DdApiKeySecretArn:
        default: "DdApiKeySecretArn *"
      DdSite:
        default: "DdSite *"