1. Packages
  2. Datadog Provider
  3. API Docs
  4. ServiceAccountApplicationKey
Datadog v4.58.0 published on Thursday, Oct 16, 2025 by Pulumi
pulumi/pulumi-datadog

datadog.ServiceAccountApplicationKey

Deploy with Pulumi
datadog logo
Datadog v4.58.0 published on Thursday, Oct 16, 2025 by Pulumi
pulumi/pulumi-datadog

    Provides a Datadog service_account_application_key resource. This can be used to create and manage Datadog service account application keys.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Source the permissions for scoped keys
const ddPerms = datadog.getPermissions({});
// Create an unrestricted Service Account Application Key
// This key inherits all permissions of the service account that owns the key
const unrestrictedKey = new datadog.ServiceAccountApplicationKey("unrestricted_key", {
    serviceAccountId: "00000000-0000-1234-0000-000000000000",
    name: "Unrestricted Service Account Key",
});
// Create a scoped Service Account Application Key for monitor management
const monitorManagementKey = new datadog.ServiceAccountApplicationKey("monitor_management_key", {
    serviceAccountId: "00000000-0000-1234-0000-000000000000",
    name: "Monitor Management Service Account Key",
    scopes: [
        ddPerms.then(ddPerms => ddPerms.permissions?.monitorsRead),
        ddPerms.then(ddPerms => ddPerms.permissions?.monitorsWrite),
    ],
});

    import pulumi
import pulumi_datadog as datadog

# Source the permissions for scoped keys
dd_perms = datadog.get_permissions()
# Create an unrestricted Service Account Application Key
# This key inherits all permissions of the service account that owns the key
unrestricted_key = datadog.ServiceAccountApplicationKey("unrestricted_key",
    service_account_id="00000000-0000-1234-0000-000000000000",
    name="Unrestricted Service Account Key")
# Create a scoped Service Account Application Key for monitor management
monitor_management_key = datadog.ServiceAccountApplicationKey("monitor_management_key",
    service_account_id="00000000-0000-1234-0000-000000000000",
    name="Monitor Management Service Account Key",
    scopes=[
        dd_perms.permissions["monitorsRead"],
        dd_perms.permissions["monitorsWrite"],
    ])

    package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Source the permissions for scoped keys
		ddPerms, err := datadog.GetPermissions(ctx, &datadog.GetPermissionsArgs{}, nil)
		if err != nil {
			return err
		}
		// Create an unrestricted Service Account Application Key
		// This key inherits all permissions of the service account that owns the key
		_, err = datadog.NewServiceAccountApplicationKey(ctx, "unrestricted_key", &datadog.ServiceAccountApplicationKeyArgs{
			ServiceAccountId: pulumi.String("00000000-0000-1234-0000-000000000000"),
			Name:             pulumi.String("Unrestricted Service Account Key"),
		})
		if err != nil {
			return err
		}
		// Create a scoped Service Account Application Key for monitor management
		_, err = datadog.NewServiceAccountApplicationKey(ctx, "monitor_management_key", &datadog.ServiceAccountApplicationKeyArgs{
			ServiceAccountId: pulumi.String("00000000-0000-1234-0000-000000000000"),
			Name:             pulumi.String("Monitor Management Service Account Key"),
			Scopes: pulumi.StringArray{
				pulumi.String(ddPerms.Permissions.MonitorsRead),
				pulumi.String(ddPerms.Permissions.MonitorsWrite),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    // Source the permissions for scoped keys
    var ddPerms = Datadog.GetPermissions.Invoke();

    // Create an unrestricted Service Account Application Key
    // This key inherits all permissions of the service account that owns the key
    var unrestrictedKey = new Datadog.ServiceAccountApplicationKey("unrestricted_key", new()
    {
        ServiceAccountId = "00000000-0000-1234-0000-000000000000",
        Name = "Unrestricted Service Account Key",
    });

    // Create a scoped Service Account Application Key for monitor management
    var monitorManagementKey = new Datadog.ServiceAccountApplicationKey("monitor_management_key", new()
    {
        ServiceAccountId = "00000000-0000-1234-0000-000000000000",
        Name = "Monitor Management Service Account Key",
        Scopes = new[]
        {
            ddPerms.Apply(getPermissionsResult => getPermissionsResult.Permissions?.MonitorsRead),
            ddPerms.Apply(getPermissionsResult => getPermissionsResult.Permissions?.MonitorsWrite),
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.DatadogFunctions;
import com.pulumi.datadog.inputs.GetPermissionsArgs;
import com.pulumi.datadog.ServiceAccountApplicationKey;
import com.pulumi.datadog.ServiceAccountApplicationKeyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Source the permissions for scoped keys
        final var ddPerms = DatadogFunctions.getPermissions(GetPermissionsArgs.builder()
            .build());

        // Create an unrestricted Service Account Application Key
        // This key inherits all permissions of the service account that owns the key
        var unrestrictedKey = new ServiceAccountApplicationKey("unrestrictedKey", ServiceAccountApplicationKeyArgs.builder()
            .serviceAccountId("00000000-0000-1234-0000-000000000000")
            .name("Unrestricted Service Account Key")
            .build());

        // Create a scoped Service Account Application Key for monitor management
        var monitorManagementKey = new ServiceAccountApplicationKey("monitorManagementKey", ServiceAccountApplicationKeyArgs.builder()
            .serviceAccountId("00000000-0000-1234-0000-000000000000")
            .name("Monitor Management Service Account Key")
            .scopes(            
                ddPerms.permissions().monitorsRead(),
                ddPerms.permissions().monitorsWrite())
            .build());

    }
}

    resources:
  # Create an unrestricted Service Account Application Key
  # This key inherits all permissions of the service account that owns the key
  unrestrictedKey:
    type: datadog:ServiceAccountApplicationKey
    name: unrestricted_key
    properties:
      serviceAccountId: 00000000-0000-1234-0000-000000000000
      name: Unrestricted Service Account Key
  # Create a scoped Service Account Application Key for monitor management
  monitorManagementKey:
    type: datadog:ServiceAccountApplicationKey
    name: monitor_management_key
    properties:
      serviceAccountId: 00000000-0000-1234-0000-000000000000
      name: Monitor Management Service Account Key
      scopes:
        - ${ddPerms.permissions.monitorsRead}
        - ${ddPerms.permissions.monitorsWrite}
variables:
  # Source the permissions for scoped keys
  ddPerms:
    fn::invoke:
      function: datadog:getPermissions
      arguments: {}

    Create ServiceAccountApplicationKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ServiceAccountApplicationKey(name: string, args: ServiceAccountApplicationKeyArgs, opts?: CustomResourceOptions);
    @overload
def ServiceAccountApplicationKey(resource_name: str,
                                 args: ServiceAccountApplicationKeyArgs,
                                 opts: Optional[ResourceOptions] = None)

@overload
def ServiceAccountApplicationKey(resource_name: str,
                                 opts: Optional[ResourceOptions] = None,
                                 name: Optional[str] = None,
                                 service_account_id: Optional[str] = None,
                                 scopes: Optional[Sequence[str]] = None)
    func NewServiceAccountApplicationKey(ctx *Context, name string, args ServiceAccountApplicationKeyArgs, opts ...ResourceOption) (*ServiceAccountApplicationKey, error)
    public ServiceAccountApplicationKey(string name, ServiceAccountApplicationKeyArgs args, CustomResourceOptions? opts = null)
    public ServiceAccountApplicationKey(String name, ServiceAccountApplicationKeyArgs args)
public ServiceAccountApplicationKey(String name, ServiceAccountApplicationKeyArgs args, CustomResourceOptions options)

    type: datadog:ServiceAccountApplicationKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args ServiceAccountApplicationKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ServiceAccountApplicationKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ServiceAccountApplicationKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ServiceAccountApplicationKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ServiceAccountApplicationKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var serviceAccountApplicationKeyResource = new Datadog.ServiceAccountApplicationKey("serviceAccountApplicationKeyResource", new()
{
    Name = "string",
    ServiceAccountId = "string",
    Scopes = new[]
    {
        "string",
    },
});

    example, err := datadog.NewServiceAccountApplicationKey(ctx, "serviceAccountApplicationKeyResource", &datadog.ServiceAccountApplicationKeyArgs{
	Name:             pulumi.String("string"),
	ServiceAccountId: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    var serviceAccountApplicationKeyResource = new ServiceAccountApplicationKey("serviceAccountApplicationKeyResource", ServiceAccountApplicationKeyArgs.builder()
    .name("string")
    .serviceAccountId("string")
    .scopes("string")
    .build());

    service_account_application_key_resource = datadog.ServiceAccountApplicationKey("serviceAccountApplicationKeyResource",
    name="string",
    service_account_id="string",
    scopes=["string"])

    const serviceAccountApplicationKeyResource = new datadog.ServiceAccountApplicationKey("serviceAccountApplicationKeyResource", {
    name: "string",
    serviceAccountId: "string",
    scopes: ["string"],
});

    type: datadog:ServiceAccountApplicationKey
properties:
    name: string
    scopes:
        - string
    serviceAccountId: string

    ServiceAccountApplicationKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ServiceAccountApplicationKey resource accepts the following input properties:

    Name string
    Name of the application key.
    ServiceAccountId string
    ID of the service account that owns this key.
    Scopes List<string>
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    Name string
    Name of the application key.
    ServiceAccountId string
    ID of the service account that owns this key.
    Scopes []string
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    name String
    Name of the application key.
    serviceAccountId String
    ID of the service account that owns this key.
    scopes List<String>
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    name string
    Name of the application key.
    serviceAccountId string
    ID of the service account that owns this key.
    scopes string[]
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    name str
    Name of the application key.
    service_account_id str
    ID of the service account that owns this key.
    scopes Sequence[str]
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    name String
    Name of the application key.
    serviceAccountId String
    ID of the service account that owns this key.
    scopes List<String>
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ServiceAccountApplicationKey resource produces the following output properties:

    CreatedAt string
    Creation date of the application key.
    Id string
    The provider-assigned unique ID for this managed resource.
    Key string
    The value of the service account application key. This value cannot be imported.
    Last4 string
    The last four characters of the application key.
    CreatedAt string
    Creation date of the application key.
    Id string
    The provider-assigned unique ID for this managed resource.
    Key string
    The value of the service account application key. This value cannot be imported.
    Last4 string
    The last four characters of the application key.
    createdAt String
    Creation date of the application key.
    id String
    The provider-assigned unique ID for this managed resource.
    key String
    The value of the service account application key. This value cannot be imported.
    last4 String
    The last four characters of the application key.
    createdAt string
    Creation date of the application key.
    id string
    The provider-assigned unique ID for this managed resource.
    key string
    The value of the service account application key. This value cannot be imported.
    last4 string
    The last four characters of the application key.
    created_at str
    Creation date of the application key.
    id str
    The provider-assigned unique ID for this managed resource.
    key str
    The value of the service account application key. This value cannot be imported.
    last4 str
    The last four characters of the application key.
    createdAt String
    Creation date of the application key.
    id String
    The provider-assigned unique ID for this managed resource.
    key String
    The value of the service account application key. This value cannot be imported.
    last4 String
    The last four characters of the application key.

    Look up Existing ServiceAccountApplicationKey Resource

    Get an existing ServiceAccountApplicationKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ServiceAccountApplicationKeyState, opts?: CustomResourceOptions): ServiceAccountApplicationKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        created_at: Optional[str] = None,
        key: Optional[str] = None,
        last4: Optional[str] = None,
        name: Optional[str] = None,
        scopes: Optional[Sequence[str]] = None,
        service_account_id: Optional[str] = None) -> ServiceAccountApplicationKey
    func GetServiceAccountApplicationKey(ctx *Context, name string, id IDInput, state *ServiceAccountApplicationKeyState, opts ...ResourceOption) (*ServiceAccountApplicationKey, error)
    public static ServiceAccountApplicationKey Get(string name, Input<string> id, ServiceAccountApplicationKeyState? state, CustomResourceOptions? opts = null)
    public static ServiceAccountApplicationKey get(String name, Output<String> id, ServiceAccountApplicationKeyState state, CustomResourceOptions options)
    resources:  _:    type: datadog:ServiceAccountApplicationKey    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreatedAt string
    Creation date of the application key.
    Key string
    The value of the service account application key. This value cannot be imported.
    Last4 string
    The last four characters of the application key.
    Name string
    Name of the application key.
    Scopes List<string>
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    ServiceAccountId string
    ID of the service account that owns this key.
    CreatedAt string
    Creation date of the application key.
    Key string
    The value of the service account application key. This value cannot be imported.
    Last4 string
    The last four characters of the application key.
    Name string
    Name of the application key.
    Scopes []string
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    ServiceAccountId string
    ID of the service account that owns this key.
    createdAt String
    Creation date of the application key.
    key String
    The value of the service account application key. This value cannot be imported.
    last4 String
    The last four characters of the application key.
    name String
    Name of the application key.
    scopes List<String>
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    serviceAccountId String
    ID of the service account that owns this key.
    createdAt string
    Creation date of the application key.
    key string
    The value of the service account application key. This value cannot be imported.
    last4 string
    The last four characters of the application key.
    name string
    Name of the application key.
    scopes string[]
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    serviceAccountId string
    ID of the service account that owns this key.
    created_at str
    Creation date of the application key.
    key str
    The value of the service account application key. This value cannot be imported.
    last4 str
    The last four characters of the application key.
    name str
    Name of the application key.
    scopes Sequence[str]
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    service_account_id str
    ID of the service account that owns this key.
    createdAt String
    Creation date of the application key.
    key String
    The value of the service account application key. This value cannot be imported.
    last4 String
    The last four characters of the application key.
    name String
    Name of the application key.
    scopes List<String>
    Authorization scopes for the Application Key. Application Keys configured with no scopes have full access.
    serviceAccountId String
    ID of the service account that owns this key.

    Import

    The pulumi import command can be used, for example:

    Importing a service account’s application key cannot import the value of the key.

    $ pulumi import datadog:index/serviceAccountApplicationKey:ServiceAccountApplicationKey this "<service_account_id>:<application_key_id>"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Datadog v4.58.0 published on Thursday, Oct 16, 2025 by Pulumi
    pulumi/pulumi-datadog
      Meet Neo: Your AI Platform Teammate