README
¶
Datadog API client AWS authentication
This optional module adds AWS Workload Identity Federation authentication to
datadog-api-client-go without adding the AWS SDK to the core client's module
graph.
It uses the AWS SDK for Go v2 default configuration and credential chain, including environment credentials, shared configuration and credential files, web identity, ECS/EKS container credentials, EC2 instance metadata, SSO, assume role profiles, and process credentials supported by the SDK.
import (
awsauth "github.com/DataDog/datadog-api-client-go/auth/aws"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
)
provider, err := awsauth.New(awsauth.WithRegion("us-east-1"))
if err != nil {
return err
}
configuration := datadog.NewConfiguration()
configuration.DelegatedTokenConfig = &datadog.DelegatedTokenConfig{
OrgUUID: orgUUID,
Provider: datadog.ProviderAWS,
ProviderAuth: provider,
}
The default chain honors standard AWS settings such as AWS_PROFILE,
AWS_CONFIG_FILE, and AWS_SHARED_CREDENTIALS_FILE. Library callers that do
not want to use environment selection can pass AWS SDK load options through
awsauth.WithConfigOptions. Explicit credentials remain available through
awsauth.WithStaticCredentials.
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*providerOptions) error
Option configures a Provider.
func WithConfigOptions ¶
func WithConfigOptions(options ...func(*awsconfig.LoadOptions) error) Option
WithConfigOptions adds options passed to awsconfig.LoadDefaultConfig. This is an escape hatch for AWS SDK settings not covered by the convenience options in this package.
func WithHTTPClient ¶
WithHTTPClient sets the client used for AWS credential retrieval and the Datadog delegated-token exchange. This allows callers to preserve custom proxy, TLS, and timeout configuration across the entire authentication flow.
func WithRegion ¶
WithRegion sets the AWS region used for STS endpoint resolution and request signing. When omitted, the AWS SDK configuration is used, falling back to us-east-1 when the credential source does not specify a region.
func WithStaticCredentials ¶
WithStaticCredentials uses explicitly supplied AWS credentials instead of the default credential chain. A session token is optional.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements datadog.DelegatedTokenProvider using the AWS SDK default credential chain. Configuration and credential retrieval are lazy so clients that disable validation do not contact AWS during construction.
func (*Provider) Authenticate ¶
func (provider *Provider) Authenticate(ctx context.Context, config *datadog.DelegatedTokenConfig) (*datadog.DelegatedTokenCredentials, error)
Authenticate exchanges an AWS-signed GetCallerIdentity proof for a Datadog delegated token.
Source Files