Terraform Module Datadog Agentless Scanner

Terraform Module Datadog Agentless Scanner

This Terraform module provides a simple and reusable configuration for installing a Datadog Agentless Scanner.

This document covers installation on AWS. For [Azure](./azure) and [GCP](./gcp) instructions, please see their respective directories.

For more information about Agentless Scanning, see the [Datadog Agentless Scanning documentation](https://docs.datadoghq.com/security/cloud_security_management/agentless_scanning/).

Prerequisites

Before using this module, make sure you have the following:

1. Terraform v1.2.0 or later installed on your local machine.
2. AWS credentials configured with the necessary permissions.
3. A Datadog API key with Remote Configuration enabled.

Usage

To use this module in your Terraform configuration, add the following code in your existing Terraform code:

# First we need to define the proper roles for our scanners. It consists of two different modules.

# 1. The "scanning delegate role" defines all the policies and IAM roles necessary for the scanner to interact and scan some specific account resources.
# It shall be created for every account that the agentless scanner will be able scan. These roles are meant to be assumed by the "agentless scanner role".
module "delegate_role" {
  source = "git::https://github.com/DataDog/terraform-module-datadog-agentless-scanner//modules/scanning-delegate-role"

  scanner_roles = [module.scanner_role.role.arn]
}

# 2. The "agentless scanner role" creates an EC2 instance profile along with an IAM role allowing the EC2 instance scanner to assume the scanning delegate role(s).
# It shall be created in the same account as the agentless scanner instance.
module "scanner_role" {
  source = "git::https://github.com/DataDog/terraform-module-datadog-agentless-scanner//modules/agentless-scanner-role"

  api_key_secret_arns = [module.agentless_scanner.api