main.tf

locals {
  enabled             = module.this.enabled
  aws_account_id      = join("", data.aws_caller_identity.current[*].account_id)
  aws_partition       = join("", data.aws_partition.current[*].partition)
  datadog_external_id = join("", datadog_integration_aws.integration[*].external_id)
  policies = distinct(concat(
    var.integrations != null ? var.integrations : [],
    var.policies
  ))
}

data "aws_partition" "current" {
  count = local.enabled ? 1 : 0
}

data "aws_caller_identity" "current" {
  count = local.enabled ? 1 : 0
}

# https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws
# https://docs.datadoghq.com/api/v1/aws-integration/
resource "datadog_integration_aws" "integration" {
  count                                = local.enabled ? 1 : 0
  account_id                           = local.aws_account_id
  role_name                            = module.this.id
  filter_tags                          = var.filter_tags
  host_tags                            = var.host_tags
  excluded_regions                     = var.excluded_regions
  account_specific_namespace_rules     = var.account_specific_namespace_rules
  cspm_resource_collection_enabled     = var.cspm_resource_collection_enabled
  metrics_collection_enabled           = var.metrics_collection_enabled
  resource_collection_enabled          = var.resource_collection_enabled
  extended_resource_collection_enabled = var.extended_resource_collection_enabled
}

data "aws_iam_policy_document" "assume_role" {
  count = local.enabled ? 1 : 0

  statement {
    sid    = "DatadogAWSTrustRelationship"
    effect = "Allow"

    actions = [
      "sts:AssumeRole"
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:${local.aws_partition}:iam::${var.datadog_aws_account_id}:root"
      ]
    }

    condition {
      test = "StringEquals"
      values = [
        local.datadog_external_id
      ]
      variable = "sts:ExternalId"
    }
  }
}

resource "aws_iam_role" "default" {
  count              = local.enabled ? 1 : 0
  name               = module.this.id
  assume_role_policy = join("", data.aws_iam_policy_document.assume_role[*].json)
  tags               = module.this.tags
}