From 62a5e2d3f8c2d5851d1d402fc9ee4a2135a0d602 Mon Sep 17 00:00:00 2001 From: Georgi Date: Wed, 4 Feb 2026 13:32:37 +0100 Subject: [PATCH] [AWSX] feat(logs forwarder): Remove StepFunctions tag enrichment from logs forwarder template --- README.md | 1 - main.tf | 2 -- modules/iam/main.tf | 4 ++-- modules/iam/variables.tf | 5 ----- tests/enhanced_features.tftest.hcl | 28 +++++++++++----------------- variables.tf | 6 ------ 6 files changed, 13 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index d54c2eb..0097235 100644 --- a/README.md +++ b/README.md @@ -88,7 +88,6 @@ For complete usage examples demonstrating different configuration scenarios, see | dd_enrich_cloudwatch_tags | Enrich logs from CloudWatch with log group tags via Datadog backend (requires Resource Collection enabled). Mutually exclusive with `dd_fetch_log_group_tags` | `bool` | `null` | | dd_fetch_lambda_tags | Fetch Lambda tags | `bool` | `null` | | dd_fetch_log_group_tags | **(Deprecated in favor of dd_enrich_cloudwatch_tags)** Fetch Log Group tags | `bool` | `null` | -| dd_fetch_step_functions_tags | Fetch Step Functions tags | `bool` | `null` | | dd_fetch_s3_tags | **(Deprecated in favor of dd_enrich_s3_tags)** Fetch S3 bucket tags | `bool` | `null` | ### Log Processing diff --git a/main.tf b/main.tf index 21e8ccb..ffff6f4 100644 --- a/main.tf +++ b/main.tf @@ -18,7 +18,6 @@ module "iam" { dd_api_key_secret_arn = var.dd_api_key_secret_arn == null ? try(aws_secretsmanager_secret.dd_api_key_secret[0].arn, null) : "${var.dd_api_key_secret_arn}*" dd_allowed_kms_keys = var.dd_allowed_kms_keys dd_fetch_lambda_tags = var.dd_fetch_lambda_tags - dd_fetch_step_functions_tags = var.dd_fetch_step_functions_tags dd_fetch_log_group_tags = var.dd_fetch_log_group_tags dd_fetch_s3_tags = var.dd_fetch_s3_tags dd_use_vpc = var.dd_use_vpc @@ -209,7 +208,6 @@ resource "aws_lambda_function" "forwarder" { DD_FETCH_LAMBDA_TAGS = var.dd_fetch_lambda_tags != null ? tostring(var.dd_fetch_lambda_tags) : null DD_FETCH_LOG_GROUP_TAGS = var.dd_fetch_log_group_tags != null ? tostring(var.dd_fetch_log_group_tags) : null DD_FETCH_S3_TAGS = var.dd_fetch_s3_tags != null ? tostring(var.dd_fetch_s3_tags) : null - DD_FETCH_STEP_FUNCTIONS_TAGS = var.dd_fetch_step_functions_tags != null ? tostring(var.dd_fetch_step_functions_tags) : null DD_NO_SSL = var.dd_no_ssl DD_URL = var.dd_url DD_PORT = var.dd_port diff --git a/modules/iam/main.tf b/modules/iam/main.tf index eb22cfd..5994357 100644 --- a/modules/iam/main.tf +++ b/modules/iam/main.tf @@ -109,8 +109,8 @@ resource "aws_iam_role_policy" "forwarder_policy" { } ] : [], - # Tag fetching permissions (Lambda and Step Functions) - coalesce(var.dd_fetch_lambda_tags, false) || coalesce(var.dd_fetch_step_functions_tags, false) || coalesce(var.dd_fetch_s3_tags, false) ? [ + # Tag fetching permissions (Lambda and S3) + coalesce(var.dd_fetch_lambda_tags, false) || coalesce(var.dd_fetch_s3_tags, false) ? [ { Effect = "Allow" Action = ["tag:GetResources"] diff --git a/modules/iam/variables.tf b/modules/iam/variables.tf index 60897b2..4d9ad5e 100644 --- a/modules/iam/variables.tf +++ b/modules/iam/variables.tf @@ -67,11 +67,6 @@ variable "dd_fetch_lambda_tags" { description = "Whether to fetch Lambda tags" } -variable "dd_fetch_step_functions_tags" { - type = bool - default = null - description = "Whether to fetch Step Functions tags" -} variable "dd_fetch_s3_tags" { type = bool default = null diff --git a/tests/enhanced_features.tftest.hcl b/tests/enhanced_features.tftest.hcl index e0eb1c4..e8af7cf 100644 --- a/tests/enhanced_features.tftest.hcl +++ b/tests/enhanced_features.tftest.hcl @@ -4,18 +4,17 @@ provider "aws" { } variables { - dd_api_key = "test-api-key-value" - dd_site = "datadoghq.com" - dd_fetch_lambda_tags = true - dd_fetch_log_group_tags = true - dd_fetch_step_functions_tags = true - dd_fetch_s3_tags = true - dd_store_failed_events = true - dd_forward_log = false - dd_trace_enabled = false - memory_size = 2048 - timeout = 300 - layer_version = "80" + dd_api_key = "test-api-key-value" + dd_site = "datadoghq.com" + dd_fetch_lambda_tags = true + dd_fetch_log_group_tags = true + dd_fetch_s3_tags = true + dd_store_failed_events = true + dd_forward_log = false + dd_trace_enabled = false + memory_size = 2048 + timeout = 300 + layer_version = "80" } run "enhanced_features_test" { @@ -57,11 +56,6 @@ run "enhanced_features_env_vars_test" { error_message = "DD_FETCH_LOG_GROUP_TAGS should be true when enabled" } - assert { - condition = aws_lambda_function.forwarder.environment[0].variables.DD_FETCH_STEP_FUNCTIONS_TAGS == "true" - error_message = "DD_FETCH_STEP_FUNCTIONS_TAGS should be true when enabled" - } - # Test trace and log forwarding configuration assert { condition = aws_lambda_function.forwarder.environment[0].variables.DD_TRACE_ENABLED == "false" diff --git a/variables.tf b/variables.tf index 555351b..7750d29 100644 --- a/variables.tf +++ b/variables.tf @@ -176,12 +176,6 @@ variable "dd_fetch_log_group_tags" { description = "(deprecated in favor of dd_enrich_cloudwatch_tags) Let the forwarder fetch Log Group tags using ListTagsForResource and apply them to logs, metrics and traces. If set to true, permission logs:ListTagsForResource will be automatically added to the Lambda execution IAM role." } -variable "dd_fetch_step_functions_tags" { - type = bool - default = null - description = "Let the forwarder fetch Step Functions tags using GetResources API calls and apply them to logs, metrics and traces. If set to true, permission tag:GetResources will be automatically added to the Lambda execution IAM role." -} - variable "dd_fetch_s3_tags" { type = bool default = null