published on Wednesday, Nov 11, 2026 by Pulumi
published on Wednesday, Nov 11, 2026 by Pulumi
Provides an AWS Workload Identity Federation (WIF) intake mapping. The mapping allows Datadog Agents with an AWS identity matching arnPattern to authenticate for telemetry submission using a Datadog-managed, automatically rotated API key. The AWS account in the ARN must already be integrated with Datadog, and managed API key rotation must be enabled for the organization. Creating the mapping requires the Workload Identity Federation write permission. Configure the Agent separately to use WIF with the target organization UUID. The API rejects ARN patterns that conflict with existing intake or identity mappings. Mapping changes may take several minutes to affect authentication. This resource uses a public beta API and is subject to change.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";
const config = new pulumi.Config();
// The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
const agentAwsAccountId = config.require("agentAwsAccountId");
// If this configuration also manages the AWS integration, replace
// var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
// (using your integration resource's name) to establish creation order.
const agent = new datadog.AwsWifIntakeMapping("agent", {arnPattern: `arn:aws:sts::${agentAwsAccountId}:assumed-role/DatadogAgentRole/*`});
import pulumi
import pulumi_datadog as datadog
config = pulumi.Config()
# The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
agent_aws_account_id = config.require("agentAwsAccountId")
# If this configuration also manages the AWS integration, replace
# var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
# (using your integration resource's name) to establish creation order.
agent = datadog.AwsWifIntakeMapping("agent", arn_pattern=f"arn:aws:sts::{agent_aws_account_id}:assumed-role/DatadogAgentRole/*")
package main
import (
"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
cfg := config.New(ctx, "")
// The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
agentAwsAccountId := cfg.Require("agentAwsAccountId")
// If this configuration also manages the AWS integration, replace
// var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
// (using your integration resource's name) to establish creation order.
_, err := datadog.NewAwsWifIntakeMapping(ctx, "agent", &datadog.AwsWifIntakeMappingArgs{
ArnPattern: pulumi.Sprintf("arn:aws:sts::%v:assumed-role/DatadogAgentRole/*", agentAwsAccountId),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;
return await Deployment.RunAsync(() =>
{
var config = new Config();
// The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform.
var agentAwsAccountId = config.Require("agentAwsAccountId");
// If this configuration also manages the AWS integration, replace
// var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
// (using your integration resource's name) to establish creation order.
var agent = new Datadog.AwsWifIntakeMapping("agent", new()
{
ArnPattern = $"arn:aws:sts::{agentAwsAccountId}:assumed-role/DatadogAgentRole/*",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.AwsWifIntakeMapping;
import com.pulumi.datadog.AwsWifIntakeMappingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var config = ctx.config();
final var agentAwsAccountId = config.require("agentAwsAccountId");
// If this configuration also manages the AWS integration, replace
// var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
// (using your integration resource's name) to establish creation order.
var agent = new AwsWifIntakeMapping("agent", AwsWifIntakeMappingArgs.builder()
.arnPattern(String.format("arn:aws:sts::%s:assumed-role/DatadogAgentRole/*", agentAwsAccountId))
.build());
}
}
configuration:
agentAwsAccountId:
type: string
resources:
# If this configuration also manages the AWS integration, replace
# var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
# (using your integration resource's name) to establish creation order.
agent:
type: datadog:AwsWifIntakeMapping
properties:
arnPattern: arn:aws:sts::${agentAwsAccountId}:assumed-role/DatadogAgentRole/*
terraform {
required_providers {
datadog = {
source = "pulumi/datadog"
}
}
}
# If this configuration also manages the AWS integration, replace
# var.agent_aws_account_id below with datadog_integration_aws_account.agent.aws_account_id
# (using your integration resource's name) to establish creation order.
resource "datadog_aws_wif_intake_mapping" "agent" {
lifecycle {
create_before_destroy = true
}
arn_pattern ="arn:aws:sts::${var.agentAwsAccountId}:assumed-role/DatadogAgentRole/*"
}
variable "agentAwsAccountId" {
type = string
description = "The AWS account where the Agent runs. It must be integrated with Datadog and may differ from the account running Terraform."
}
Create AwsWifIntakeMapping Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new AwsWifIntakeMapping(name: string, args: AwsWifIntakeMappingArgs, opts?: CustomResourceOptions);@overload
def AwsWifIntakeMapping(resource_name: str,
args: AwsWifIntakeMappingArgs,
opts: Optional[ResourceOptions] = None)
@overload
def AwsWifIntakeMapping(resource_name: str,
opts: Optional[ResourceOptions] = None,
arn_pattern: Optional[str] = None)func NewAwsWifIntakeMapping(ctx *Context, name string, args AwsWifIntakeMappingArgs, opts ...ResourceOption) (*AwsWifIntakeMapping, error)public AwsWifIntakeMapping(string name, AwsWifIntakeMappingArgs args, CustomResourceOptions? opts = null)
public AwsWifIntakeMapping(String name, AwsWifIntakeMappingArgs args)
public AwsWifIntakeMapping(String name, AwsWifIntakeMappingArgs args, CustomResourceOptions options)
type: datadog:AwsWifIntakeMapping
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "datadog_aws_wif_intake_mapping" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args AwsWifIntakeMappingArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AwsWifIntakeMappingArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AwsWifIntakeMappingArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AwsWifIntakeMappingArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AwsWifIntakeMappingArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var awsWifIntakeMappingResource = new Datadog.AwsWifIntakeMapping("awsWifIntakeMappingResource", new()
{
ArnPattern = "string",
});
example, err := datadog.NewAwsWifIntakeMapping(ctx, "awsWifIntakeMappingResource", &datadog.AwsWifIntakeMappingArgs{
ArnPattern: pulumi.String("string"),
})
resource "datadog_aws_wif_intake_mapping" "awsWifIntakeMappingResource" {
lifecycle {
create_before_destroy = true
}
arn_pattern = "string"
}
var awsWifIntakeMappingResource = new AwsWifIntakeMapping("awsWifIntakeMappingResource", AwsWifIntakeMappingArgs.builder()
.arnPattern("string")
.build());
aws_wif_intake_mapping_resource = datadog.AwsWifIntakeMapping("awsWifIntakeMappingResource", arn_pattern="string")
const awsWifIntakeMappingResource = new datadog.AwsWifIntakeMapping("awsWifIntakeMappingResource", {arnPattern: "string"});
type: datadog:AwsWifIntakeMapping
properties:
arnPattern: string
AwsWifIntakeMapping Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The AwsWifIntakeMapping resource accepts the following input properties:
- Arn
Pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
- Arn
Pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
- arn_
pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
- arn
Pattern String - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
- arn
Pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
- arn_
pattern str - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
- arn
Pattern String - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1.
Outputs
All input properties are implicitly available as output properties. Additionally, the AwsWifIntakeMapping resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Par
Enrollment boolEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- Id string
- The provider-assigned unique ID for this managed resource.
- Par
Enrollment boolEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- id string
- The provider-assigned unique ID for this managed resource.
- par_
enrollment_ boolenabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- id String
- The provider-assigned unique ID for this managed resource.
- par
Enrollment BooleanEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- id string
- The provider-assigned unique ID for this managed resource.
- par
Enrollment booleanEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- id str
- The provider-assigned unique ID for this managed resource.
- par_
enrollment_ boolenabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- id String
- The provider-assigned unique ID for this managed resource.
- par
Enrollment BooleanEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
Look up Existing AwsWifIntakeMapping Resource
Get an existing AwsWifIntakeMapping resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AwsWifIntakeMappingState, opts?: CustomResourceOptions): AwsWifIntakeMapping@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
arn_pattern: Optional[str] = None,
par_enrollment_enabled: Optional[bool] = None) -> AwsWifIntakeMappingfunc GetAwsWifIntakeMapping(ctx *Context, name string, id IDInput, state *AwsWifIntakeMappingState, opts ...ResourceOption) (*AwsWifIntakeMapping, error)public static AwsWifIntakeMapping Get(string name, Input<string> id, AwsWifIntakeMappingState? state, CustomResourceOptions? opts = null)public static AwsWifIntakeMapping get(String name, Output<String> id, AwsWifIntakeMappingState state, CustomResourceOptions options)resources: _: type: datadog:AwsWifIntakeMapping get: id: ${id}import {
to = datadog_aws_wif_intake_mapping.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Arn
Pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - Par
Enrollment boolEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- Arn
Pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - Par
Enrollment boolEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- arn_
pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - par_
enrollment_ boolenabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- arn
Pattern String - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - par
Enrollment BooleanEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- arn
Pattern string - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - par
Enrollment booleanEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- arn_
pattern str - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - par_
enrollment_ boolenabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
- arn
Pattern String - The AWS caller ARN pattern allowed to authenticate. Changing this value replaces the mapping. Currently, only the
awspartition is supported. For role-based authentication, use the STS assumed-role ARN returned byaws sts get-caller-identity, not the IAM role ARN shown in the AWS console. A pattern may contain one wildcard only, as a trailing/*after a specific resource; for example,arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*. String length must be at least 1. - par
Enrollment BooleanEnabled - Whether the mapping allows Private Action Runner enrollment. This permission is managed separately from the ARN pattern and cannot be changed with this resource. Changing
arnPatternreplaces the mapping and resets this permission to false; re-enable Private Action Runner enrollment separately after replacement if needed. Defaults to false when omitted by the API.
Import
The pulumi import command can be used, for example:
$ pulumi import datadog:index/awsWifIntakeMapping:AwsWifIntakeMapping agent "00000000-0000-0000-0000-000000000000"
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Datadog pulumi/pulumi-datadog
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
datadogTerraform Provider.
published on Wednesday, Nov 11, 2026 by Pulumi