Skip to content

config: add additional endpoints secret ARN environment variables - #171

Merged
shreyamalpani merged 2 commits into
mainfrom
shreya.malpani/support-secrets-manager-arn-additional-endpoints
Sep 24, 2026
Merged

shreyamalpani merged 2 commits into
mainfrom
shreya.malpani/support-secrets-manager-arn-additional-endpoints

Conversation

@shreyamalpani

@shreyamalpani shreyamalpani commented Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

What does this PR do?

Adds support for three new environment variables that let the agent config load additional_endpoints-style values from an AWS Secrets Manager secret ARN instead of (or in addition to) inline JSON:

  • DD_ADDITIONAL_ENDPOINTS_SECRET_ARN
  • DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS_SECRET_ARN
  • DD_APM_ADDITIONAL_ENDPOINTS_SECRET_ARN

Each new field mirrors the shape of its corresponding existing *_ADDITIONAL_ENDPOINTS field (additional_endpoints_secret_arn, logs_config_additional_endpoints_secret_arn, apm_additional_endpoints_secret_arn) on Config, defaults to an empty string, and is wired through env parsing and config merging.

Also bumps rustls to 0.23.45 to fix RUSTSEC-2026-0285.

Motivation

Supports sending telemetry to multiple Datadog organizations via AWS Secrets Manager, per the serverless multi-org dual-shipping docs, so credentials for additional endpoints don't need to be set as plaintext env vars. SVLS-9800

Describe how to test/QA your changes

  • Added unit tests in crates/datadog-agent-config/src/sources/env.rs covering: default (empty) values when the new env vars are unset, and correct parsing/merging when they are set.
  • Manually tested with a build of the extension that references this commit, confirming the extension successfully retrieves the key/value from AWS Secrets Manager using the new ARN config.

shreyamalpani and others added 2 commits September 23, 2026 10:31
cargo-audit CI check flagged rustls 0.23.37 for a TLS 1.3 handshake
encryption-level advisory; the patched version is 0.23.45.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@shreyamalpani
shreyamalpani marked this pull request as ready for review September 23, 2026 22:05
@shreyamalpani
shreyamalpani requested review from a team as code owners September 23, 2026 22:05
@shreyamalpani
shreyamalpani requested review from Lewis-E and litianningdatadog and a lite review from Copilot and removed request for a team September 23, 2026 22:05

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Adds AWS Secrets Manager ARN environment-variable support for additional endpoints and updates Rustls dependencies.

Changes:

  • Adds three secret ARN configuration fields with parsing, defaults, merging, and tests.
  • Updates YAML fixtures.
  • Bumps Rustls and related dependencies.
File Description
crates/​datadog-agent-config/​src/​sources/​yaml.rs Updates expected configuration fixtures.
crates/​datadog-agent-config/​src/​sources/​env.rs Parses, merges, and tests new environment variables.
crates/​datadog-agent-config/​src/​lib.rs Adds configuration fields and defaults.
Cargo.lock Updates Rustls and transitive dependencies.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@shreyamalpani
shreyamalpani merged commit 1a80f4d into main Sep 24, 2026
28 checks passed
@shreyamalpani
shreyamalpani deleted the shreya.malpani/support-secrets-manager-arn-additional-endpoints branch September 24, 2026 14:48
shreyamalpani added a commit to DataDog/datadog-lambda-extension that referenced this pull request Sep 25, 2026
…ipping additional endpoints (#1391)

## Summary

Adds support for sourcing dual-shipping to additional endpoints (across
metrics, traces, and logs) from an AWS Secrets Manager secret ARN,
instead of requiring the endpoints/keys to be embedded as plaintext env
vars. This mirrors the existing pattern for resolving the primary
`DD_API_KEY` from Secrets Manager.

Three new env vars are read at startup and, if set, resolved and merged
into the existing plaintext additional-endpoints config:

- `DD_ADDITIONAL_ENDPOINTS_SECRET_ARN` → merges into
`DD_ADDITIONAL_ENDPOINTS` (metrics)
- `DD_APM_ADDITIONAL_ENDPOINTS_SECRET_ARN` → merges into
`DD_APM_ADDITIONAL_ENDPOINTS` (traces)
- `DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS_SECRET_ARN` → merges into
`DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS` (logs)

Secret content uses the same JSON shape as the corresponding plaintext
env var as defined in
[docs](https://docs.datadoghq.com/serverless/aws_lambda/configuration/?tab=awssecretsmanager#send-telemetry-to-multiple-datadog-organizations).

## Motivation

GitHub issue
#1370

## Design

- Resolution is done synchronously at startup, not lazily on first
flush. Since a non-empty ARN means the fetch will happen
unconditionally, there's no benefit to deferring it, and doing it
eagerly avoids adding latency to flush-time paths.
- Resolved secrets overwrite the corresponding plaintext
additional-endpoints config, when the secret's ARN is set and resolves
successfully. If the ARN is unset, the fetch fails, or the secret fails
to parse, the plaintext value is left untouched — it's not merged with
the resolved value.
- No changes to the existing primary `DD_API_KEY` resolution path
(`create_api_key_factory`/`resolve_secrets`) — this is a separate,
additive resolution step.
- Also bumps the pinned `serverless-components` git rev to `8156757` to
pick up the corresponding `datadog-agent-config` schema changes (new
`*_secret_arn` fields) from
DataDog/serverless-components#171

## Testing
- Manually tested and verified dual shipping works for metrics, logs,
and traces to an additional endpoint sourced from a Secrets Manager ARN
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants