Creating a Datadog Service Account for API automation

Question

Pulumi · Accepted Answer

To create a Datadog Service Account for API automation using Pulumi, you will need to utilize the Datadog provider. With the Datadog provider for Pulumi, you can programmatically create resources like service accounts, API keys, application keys, and much more, within your Datadog organization. In this guide, I will walk you through setting up a service account and an API key which are essential for automating interactions with the Datadog API.

Firstly, the `datadog.ServiceAccount` resource allows you to create a service account in Datadog. A service account is an account used by an application or a service rather than a person. It is used to automate interactions with the Datadog API. To use the `datadog.ServiceAccount` resource, you must specify a name and an email address. Optionally, you can also specify roles and whether the account is disabled.

Secondly, the `datadog.ApiKey` resource will allow you to create an API key associated with that service account. API keys are used to authenticate with the Datadog API and are necessary for automation tasks.

Below is a Pulumi program written in TypeScript that demonstrates how to create a Datadog service account and an API key:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Create a new service account in Datadog
const serviceAccount = new datadog.ServiceAccount("my-service-account", {
    name: "My Automation Service Account",
    email: "service-account@example.com",
    roles: ["Standard"], // Specify the roles for the service account as needed
    disabled: false,  // Set to 'true' to disable the service account
});

// Export the service account ID
export const serviceAccountId = serviceAccount.id;

// Create an API key associated with the service account
const apiKey = new datadog.ApiKey("my-api-key", {
    name: "My API Key",
    // It's assumed that you're associating this key with the service account manually or through some Datadog settings
});

// Export the API key's actual key
export const apiActualKey = apiKey.key;

// After running `pulumi up` with this program, you'll have a new service account and an API key created in Datadog.
```

The `serviceAccount` object uses the `datadog.ServiceAccount` resource to create a new service account in Datadog with the specified name, email, and role. Let's break down the properties we used:

- `name`: A human-readable name for the service account.
- `email`: A valid email address associated with this account, which can be used for notifications and recovery purposes.
- `roles`: An array of role names that define permissions for the service account.
- `disabled`: A boolean flag to deactivate or activate the service account. A value of `false` means the account is active.

After creating the service account, we create an API key associated with it using the `datadog.ApiKey` resource. The `apiKey` object requires a name for the key, and you can later use the value of the key (retrieved via `apiKey.key`) for API interactions.

The `export` statements make the resulting service account ID and API key available once the Pulumi program is successfully executed. With these exported values, you can access the ID of the service account and the API key, which you will use when automating your interactions with the Datadog API.

Please note that in a real-world scenario, you should handle secrets like API keys with more care, using Pulumi's secret management or a secret store of your choice to prevent accidental exposure.