Datadog

Connect Datadog by creating read-only credentials and sharing them with Tero. This lets Tero review log telemetry, build service and log-event context, and analyze ingestion without changing anything in Datadog.

What to create

Tero needs two Datadog credentials:

An API key named Tero
An application key owned by a service account with the permissions below

Use the Datadog UI or pup CLI to create both credentials.

Permissions

Every permission Tero asks for is read-only. Tero reads log data out of your indexes and pulls summary statistics for metrics. Log analysis needs four:

Permission	What Tero does with it
`logs_read_data`	Reads indexed log data
`logs_read_config`	Reads index, pipeline, and archive configuration
`logs_read_index_data`	Reads data in restricted indexes
`metrics_read`	Reads metric names, tags, and summary statistics

If your account includes metrics analysis, add five more:

Permission	What Tero does with it
`timeseries_query`	Queries metric time series
`dashboards_read`	Finds which dashboards use a metric
`monitors_read`	Finds which monitors alert on a metric
`slos_read`	Finds which SLOs depend on a metric
`events_read`	Reads event data

Datadog’s Read-Only role covers all nine. Grant it, or build a custom role with only the permissions you need. Nothing here lets Tero change your Datadog configuration. If you later want Tero to enforce policies in Datadog, that takes write access you grant separately.

Create credentials

Datadog UI
Pup

Create an API key

In Datadog, go to Organization Settings > API Keys. Create a new key named Tero.

Create a service account

Go to Organization Settings > Service Accounts. Create a service account named Tero and assign it the Read-Only role, or a custom role holding the permissions above.

Create an application key

Open the Tero service account. Under Application Keys, create an application key and copy it. Datadog shows the application key secret once.

Use the same Datadog site your account normally uses. Replace <DATADOG_SITE> with your Datadog site, such as datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, or ddog-gov.com.

Install Pup and authenticate

brew tap datadog-labs/pack
brew install datadog-labs/pack/pup

pup auth login --site <DATADOG_SITE>
pup users roles --output table

Create an API key

pup api-keys create --name Tero --output json

Copy the API key value from the output.

Create the service account request

Create tero-service-account.json with the role ID for Datadog’s Read-Only role, or for a custom role holding the permissions above. The pup users roles output lists role IDs.

{
  "data": {
    "type": "users",
    "attributes": {
      "name": "Tero",
      "email": "tero@datadoghq.com",
      "service_account": true
    },
    "relationships": {
      "roles": {
        "data": [
          {
            "id": "<READ_ONLY_ROLE_ID>",
            "type": "roles"
          }
        ]
      }
    }
  }
}

Create the service account

pup users service-accounts create --file tero-service-account.json --output json

Copy the service account ID from the output.

Create the application key request

Create tero-application-key.json.

{
  "data": {
    "type": "application_keys",
    "attributes": {
      "name": "Tero"
    }
  }
}

Create the application key

pup users service-accounts app-keys create <SERVICE_ACCOUNT_ID> --file tero-application-key.json --output json

Datadog shows the application key secret once. Copy it before closing the output.

Send your Tero contact the Datadog API key, application key, and Datadog site. Tero uses those read-only credentials to start analysis.

Introduction

Issues

Master Catalog

Policies

Integrations

Reference

What to create

Permissions

Create credentials

​What to create

​Permissions

​Create credentials

​Share the credentials with Tero

​Related pages

What to create

Permissions

Create credentials

Share the credentials with Tero

Related pages