Terraform Module Datadog Agentless Scanner Module

This Terraform module provides a simple and reusable configuration for installing a Datadog agentless scanner.

Prerequisites

Before using this module, make sure you have the following:

1. Terraform installed on your local machine.
2. AWS credentials configured with the necessary permissions.

Usage

To use this module in your Terraform configuration, add the following code in your existing Terraform code:

module "scanner_role" {
  source = "git::https://github.com/DataDog/terraform-module-datadog-agentless-scanner//modules/agentless-scanner-role"

  account_roles       = [module.delegate_role.role.arn]
  api_key_secret_arns = [module.agentless_scanner.api_key_secret_arn]
}

module "delegate_role" {
  source = "git::https://github.com/DataDog/terraform-module-datadog-agentless-scanner//modules/scanning-delegate-role"

  scanner_roles = [module.scanner_role.role.arn]
}

module "agentless_scanner" {
  source = "git::https://github.com/DataDog/terraform-module-datadog-agentless-scanner"

  api_key               = var.datadog-api-key
  instance_profile_name = module.scanner_role.instance_profile.name
}

variable "datadog-api-key" {

}

And run:

terraform init
terraform apply -var="datadog-api-key=$DD_API_KEY"

Important

Datadog strongly recommends pinning the version of the module to keep repeatable deployment and to avoid unexpected changes.

Uninstall

To uninstall, remove the Agentless scanner module from your Terraform code. Removing this module deletes all resources associated with the Agentless scanner. Alternatively, if you used a separate Terraform state for this setup, you can uninstall the Agentless scanner by executing terraform destroy.

Warning

Exercise caution when deleting Terraform resources. Review the plan carefully to ensure everything is in order.

Examples

For complete examples, refer to the examples directory in this repository.

Development

Install pre-commit checks:

pre-commit install

Automatically generate documentation for the Terraform modules:

pre-commit run terraform-docs-go -a

Lint Terraform code:

pre-commit run terraform_fmt -a
pre-commit run terraform_tflint -a

Run all checks:

pre-commit run -a

Changelog

See changelog.

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.0

Providers

No providers.

Modules

Name	Source	Version
instance	./modules/instance	n/a
user_data	./modules/user_data	n/a
vpc	./modules/vpc	n/a

Resources

No resources.

Inputs

Name	Description	Type	Default	Required
agent_configuration	Specifies a custom configuration for the Datadog Agent. The specified object is passed directly as a configuration input for the Datadog Agent.	any	{}	no
api_key	Specifies the API keys required by the Datadog Agent to submit vulnerabilities to Datadog	string	null	no
api_key_secret_arn	ARN of the secret holding the Datadog API key. Takes precedence over api_key variable	string	null	no
enable_ssm	Whether to enable AWS SSM to facilitate executing troubleshooting commands on the instance	bool	false	no
enable_ssm_vpc_endpoint	Whether to enable AWS SSM VPC endpoint (only applicable if enable_ssm is true)	bool	true	no
instance_profile_name	Name of the instance profile to attach to the instance	string	n/a	yes
scanner_channel	Channel of the scanner to install from (stable or beta)	string	"stable"	no
scanner_configuration	Specifies a custom configuration for the scanner. The specified object is passed directly as a configuration input for the scanner.	any	{}	no
scanner_version	Version of the scanner to install	string	"0.11"	no
site	By default the Agent sends its data to Datadog US site. If your organization is on another site, you must update it. See https://docs.datadoghq.com/getting_started/site/	string	null	no
tags	A map of additional tags to add to the IAM role/profile created	map(string)	{}	no

Outputs

Name	Description
api_key_secret_arn	The ARN of the secret containing the Datadog API key
vpc	The VPC created for the Datadog agentless scanner