1. Registry
  2. Packages
  3. Datadog Provider
  4. API Docs
  5. AwsWifIntakeMapping
Viewing docs for Datadog v5.20.0
published on Wednesday, Nov 11, 2026 by Pulumi
datadog logo
Viewing docs for Datadog v5.20.0
published on Wednesday, Nov 11, 2026 by Pulumi

    Provides an AWS Workload Identity Federation (WIF) intake mapping. The mapping allows Datadog Agents with an AWS identity matching arnPattern to authenticate for telemetry submission using a Datadog-managed, automatically rotated API key. The AWS account in the ARN must already be integrated with Datadog, and managed API key rotation must be enabled for the organization. Creating the mapping requires the Workload Identity Federation write permission. Configure the Agent separately to use WIF with the target organization UUID. The API rejects ARN patterns that conflict with existing intake or identity mappings. Mapping changes may take several minutes to affect authentication. This resource uses a public beta API and is subject to change.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as datadog from "@pulumi/datadog";
    
    const config = new pulumi.Config();
    // The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
    const agentAwsAccountId = config.require("agentAwsAccountId");
    // If this configuration also manages the AWS integration, replace
    // var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
    // (using your integration resource's name) to establish creation order.
    const agent = new datadog.AwsWifIntakeMapping("agent", {arnPattern: `arn:aws:sts::${agentAwsAccountId}:assumed-role/DatadogAgentRole/*`});
    
    import pulumi
    import pulumi_datadog as datadog
    
    config = pulumi.Config()
    # The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
    agent_aws_account_id = config.require("agentAwsAccountId")
    # If this configuration also manages the AWS integration, replace
    # var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
    # (using your integration resource's name) to establish creation order.
    agent = datadog.AwsWifIntakeMapping("agent", arn_pattern=f"arn:aws:sts::{agent_aws_account_id}:assumed-role/DatadogAgentRole/*")
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		cfg := config.New(ctx, "")
    		// The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
    		agentAwsAccountId := cfg.Require("agentAwsAccountId")
    		// If this configuration also manages the AWS integration, replace
    		// var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
    		// (using your integration resource's name) to establish creation order.
    		_, err := datadog.NewAwsWifIntakeMapping(ctx, "agent", &datadog.AwsWifIntakeMappingArgs{
    			ArnPattern: pulumi.Sprintf("arn:aws:sts::%v:assumed-role/DatadogAgentRole/*", agentAwsAccountId),
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Datadog = Pulumi.Datadog;
    
    return await Deployment.RunAsync(() => 
    {
        var config = new Config();
        // The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
        var agentAwsAccountId = config.Require("agentAwsAccountId");
        // If this configuration also manages the AWS integration, replace
        // var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
        // (using your integration resource's name) to establish creation order.
        var agent = new Datadog.AwsWifIntakeMapping("agent", new()
        {
            ArnPattern = $"arn:aws:sts::{agentAwsAccountId}:assumed-role/DatadogAgentRole/*",
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.datadog.AwsWifIntakeMapping;
    import com.pulumi.datadog.AwsWifIntakeMappingArgs;
    import java.util.ArrayList;
    import java.util.Arrays;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            final var config = ctx.config();
            final var agentAwsAccountId = config.require("agentAwsAccountId");
            // If this configuration also manages the AWS integration, replace
            // var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
            // (using your integration resource's name) to establish creation order.
            var agent = new AwsWifIntakeMapping("agent", AwsWifIntakeMappingArgs.builder()
                .arnPattern(String.format("arn:aws:sts::%s:assumed-role/DatadogAgentRole/*", agentAwsAccountId))
                .build());
    
        }
    }
    
    configuration:
      agentAwsAccountId:
        type: string
    resources:
      # If this configuration also manages the AWS integration, replace
      # var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
      # (using your integration resource's name) to establish creation order.
      agent:
        type: datadog:AwsWifIntakeMapping
        properties:
          arnPattern: arn:aws:sts::${agentAwsAccountId}:assumed-role/DatadogAgentRole/*
    
    terraform {
      required_providers {
        datadog = {
          source = "pulumi/datadog"
        }
      }
    }
    
    # If this configuration also manages the AWS integration, replace
    # var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
    # (using your integration resource's name) to establish creation order.
    resource "datadog_aws_wif_intake_mapping" "agent" {
      lifecycle {
        create_before_destroy = true
      }
      arn_pattern ="arn:aws:sts::${var.agentAwsAccountId}:assumed-role/DatadogAgentRole/*"
    }
    variable "agentAwsAccountId" {
      type        = string
      description = "The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform."
    }
    

    Create AwsWifIntakeMapping Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AwsWifIntakeMapping(name: string, args: AwsWifIntakeMappingArgs, opts?: CustomResourceOptions);
    @overload
    def AwsWifIntakeMapping(resource_name: str,
                            args: AwsWifIntakeMappingArgs,
                            opts: Optional[ResourceOptions] = None)
    
    @overload
    def AwsWifIntakeMapping(resource_name: str,
                            opts: Optional[ResourceOptions] = None,
                            arn_pattern: Optional[str] = None)
    func NewAwsWifIntakeMapping(ctx *Context, name string, args AwsWifIntakeMappingArgs, opts ...ResourceOption) (*AwsWifIntakeMapping, error)
    public AwsWifIntakeMapping(string name, AwsWifIntakeMappingArgs args, CustomResourceOptions? opts = null)
    public AwsWifIntakeMapping(String name, AwsWifIntakeMappingArgs args)
    public AwsWifIntakeMapping(String name, AwsWifIntakeMappingArgs args, CustomResourceOptions options)
    
    type: datadog:AwsWifIntakeMapping
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    
    resource "datadog_aws_wif_intake_mapping" "name" {
        # resource properties
    }

    Parameters

    name string
    The unique name of the resource.
    args AwsWifIntakeMappingArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AwsWifIntakeMappingArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AwsWifIntakeMappingArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AwsWifIntakeMappingArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AwsWifIntakeMappingArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var awsWifIntakeMappingResource = new Datadog.AwsWifIntakeMapping("awsWifIntakeMappingResource", new()
    {
        ArnPattern = "string",
    });
    
    example, err := datadog.NewAwsWifIntakeMapping(ctx, "awsWifIntakeMappingResource", &datadog.AwsWifIntakeMappingArgs{
    	ArnPattern: pulumi.String("string"),
    })
    
    resource "datadog_aws_wif_intake_mapping" "awsWifIntakeMappingResource" {
      lifecycle {
        create_before_destroy = true
      }
      arn_pattern = "string"
    }
    
    var awsWifIntakeMappingResource = new AwsWifIntakeMapping("awsWifIntakeMappingResource", AwsWifIntakeMappingArgs.builder()
        .arnPattern("string")
        .build());
    
    aws_wif_intake_mapping_resource = datadog.AwsWifIntakeMapping("awsWifIntakeMappingResource", arn_pattern="string")
    
    const awsWifIntakeMappingResource = new datadog.AwsWifIntakeMapping("awsWifIntakeMappingResource", {arnPattern: "string"});
    
    type: datadog:AwsWifIntakeMapping
    properties:
        arnPattern: string
    

    AwsWifIntakeMapping Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AwsWifIntakeMapping resource accepts the following input properties:

    ArnPattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    ArnPattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    arn_pattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    arnPattern String
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    arnPattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    arn_pattern str
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    arnPattern String
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AwsWifIntakeMapping resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    ParEnrollmentEnabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    Id string
    The provider-assigned unique ID for this managed resource.
    ParEnrollmentEnabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    id string
    The provider-assigned unique ID for this managed resource.
    par_enrollment_enabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    id String
    The provider-assigned unique ID for this managed resource.
    parEnrollmentEnabled Boolean
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    id string
    The provider-assigned unique ID for this managed resource.
    parEnrollmentEnabled boolean
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    id str
    The provider-assigned unique ID for this managed resource.
    par_enrollment_enabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    id String
    The provider-assigned unique ID for this managed resource.
    parEnrollmentEnabled Boolean
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.

    Look up Existing AwsWifIntakeMapping Resource

    Get an existing AwsWifIntakeMapping resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AwsWifIntakeMappingState, opts?: CustomResourceOptions): AwsWifIntakeMapping
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            arn_pattern: Optional[str] = None,
            par_enrollment_enabled: Optional[bool] = None) -> AwsWifIntakeMapping
    func GetAwsWifIntakeMapping(ctx *Context, name string, id IDInput, state *AwsWifIntakeMappingState, opts ...ResourceOption) (*AwsWifIntakeMapping, error)
    public static AwsWifIntakeMapping Get(string name, Input<string> id, AwsWifIntakeMappingState? state, CustomResourceOptions? opts = null)
    public static AwsWifIntakeMapping get(String name, Output<String> id, AwsWifIntakeMappingState state, CustomResourceOptions options)
    resources:  _:    type: datadog:AwsWifIntakeMapping    get:      id: ${id}
    import {
      to = datadog_aws_wif_intake_mapping.example
      id = "${id}"
    }
    
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ArnPattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    ParEnrollmentEnabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    ArnPattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    ParEnrollmentEnabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    arn_pattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    par_enrollment_enabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    arnPattern String
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    parEnrollmentEnabled Boolean
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    arnPattern string
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    parEnrollmentEnabled boolean
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    arn_pattern str
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    par_enrollment_enabled bool
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
    arnPattern String
    The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the aws partition is supported. For role-based authentication, use the STS assumed-role ARN returned by aws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing /* after a specific resource; for example, arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
    parEnrollmentEnabled Boolean
    Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing arnPattern replaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import datadog:index/awsWifIntakeMapping:AwsWifIntakeMapping agent "00000000-0000-0000-0000-000000000000"
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Viewing docs for Datadog v5.20.0
    published on Wednesday, Nov 11, 2026 by Pulumi

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial