Skip to content

Enhance Datadog API key configuration instructions #36520

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
litianningdatadog wants to merge 1 commit into
base: master
Choose a base branch
from
+10 −1
Open

Enhance Datadog API key configuration instructions #36520

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion content/en/serverless/aws_lambda/instrumentation/python.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@

5. Configure the Datadog API key

Datadog recommends saving the Datadog API key in AWS Secrets Manager for security and easy rotation. The key needs to be stored as a plaintext string (not a JSON blob). Ensure your Lambda functions have the required `secretsmanager:GetSecretValue` IAM permission.
Datadog recommends saving the Datadog API key in AWS Secrets Manager for security and easy rotation. Ensure your Lambda functions have the required `secretsmanager:GetSecretValue` IAM permission.

Check warning on line 66 in content/en/serverless/aws_lambda/instrumentation/python.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.words_case_insensitive 

Use 'helps' or 'helps ensure' instead of 'Ensure'.

Check warning on line 66 in content/en/serverless/aws_lambda/instrumentation/python.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.words_case_insensitive 

Use '' instead of 'easy'.

```sh
export DATADOG_API_KEY_SECRET_ARN="<DATADOG_API_KEY_SECRET_ARN>"
Expand All @@ -74,6 +74,15 @@
```sh
export DATADOG_API_KEY="<DATADOG_API_KEY>"
```
The Datadog Lambda Extension supports two formats for the secret value:
- Plain string — the secret value is used directly as the API key.

Check warning on line 78 in content/en/serverless/aws_lambda/instrumentation/python.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.dashes 

Don't put a space before or after a dash.
- JSON object — if the secret value is a JSON object, the extension extracts the `dd_api_key` field and uses its value as the API key. This is useful if you store the Datadog API key alongside other credentials in a single

Check warning on line 79 in content/en/serverless/aws_lambda/instrumentation/python.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.dashes 

Don't put a space before or after a dash.
Comment on lines +78 to +79
Copy link
Copy Markdown
Contributor

@estherk15 estherk15 May 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- Plain string — the secret value is used directly as the API key.
- JSON object — if the secret value is a JSON object, the extension extracts the `dd_api_key` field and uses its value as the API key. This is useful if you store the Datadog API key alongside other credentials in a single
- **Plain string**: the secret value is used directly as the API key.
- J**SON object**: if the secret value is a JSON object, the extension extracts the `dd_api_key` field and uses its value as the API key. This is useful if you store the Datadog API key alongside other credentials in a single

secret:
```sh
{ "dd_api_key": "<YOUR_DATADOG_API_KEY>" }
```
The field name `dd_api_key` is fixed and cannot be customized. If the secret is not valid JSON or does not contain `dd_api_key`, the extension falls back to using the raw secret string, so existing plain-string secrets continue to work unchanged.

Check notice on line 84 in content/en/serverless/aws_lambda/instrumentation/python.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.
Note: JSON-formatted secrets require Datadog Lambda Extension v96 or later.
Comment on lines +84 to +85
Copy link
Copy Markdown
Contributor

@estherk15 estherk15 May 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The field name `dd_api_key` is fixed and cannot be customized. If the secret is not valid JSON or does not contain `dd_api_key`, the extension falls back to using the raw secret string, so existing plain-string secrets continue to work unchanged.
Note: JSON-formatted secrets require Datadog Lambda Extension v96 or later.
The field name `dd_api_key` is fixed and cannot be customized. If the secret is not valid JSON or does not contain `dd_api_key`, the extension falls back to using the raw secret string. Existing plain-string secrets continue to work unchanged.
**Note**: JSON-formatted secrets require Datadog Lambda Extension v96 or later.


6. Instrument your Lambda functions

Expand Down
Loading