[datadog_api_key] Implement ephemeral datadog_api_key resource #3227

LiuVII · 2025-09-12T15:52:24Z

This is the initial PR to start implementation of ephemeral resources requested by Github Issue.

Add core infrastructure for ephemeral resources in Terraform Plugin Framework

Framework wrapper with schema enrichment
Private data utilities for state management between Open/Renew/Close
Test coverage for wrapper functionality

This enables secure, stateless access to sensitive resources without
storing secrets in Terraform state files.

Implement ephemeral API key resource using Terraform Plugin Framework

New ephemeral.datadog_api_key resource for stateless key access
Secure retrieval without storing sensitive values in state
Framework provider integration with EphemeralResources registry
Test coverage and validation for ephemeral operations

Enables secure patterns where API keys are fetched at runtime
without persistence in Terraform state files.

Add provider-level control over sensitive data storage in state

New store_sensitive_state provider configuration (defaults true)
API key resources respect flag to conditionally store key values
When false, key field is set to null in state for security
Updated documentation with ephemeral resource usage patterns
Examples demonstrating secure ephemeral resource patterns

Enables users to prevent sensitive API keys from being stored
in Terraform state while maintaining resource functionality
through ephemeral resource access patterns.

datadog/docs/ephemeral-resources/ephemeral_security_guidelines.md

Add core infrastructure for ephemeral resources in Terraform Plugin Framework: - Framework wrapper with schema enrichment and secure logging - Private data utilities for state management between Open/Renew/Close - Security guidelines and patterns for handling sensitive data - Test coverage for wrapper functionality This enables secure, stateless access to sensitive resources without storing secrets in Terraform state files.

Implements ephemeral API key resource using Terraform Plugin Framework: - New ephemeral.datadog_api_key resource for stateless key access - Secure retrieval without storing sensitive values in state - Framework provider integration with EphemeralResources registry - Test coverage and validation for ephemeral operations Enables secure patterns where API keys are fetched at runtime without persistence in Terraform state files.

Add provider-level control over sensitive data storage in state: - New store_sensitive_state provider configuration (defaults true) - API key resources respect flag to conditionally store key values - When false, key field is set to null in state for security - Updated documentation with ephemeral resource usage patterns - Examples demonstrating secure ephemeral resource patterns Enables users to prevent sensitive API keys from being stored in Terraform state while maintaining resource functionality through ephemeral resource access patterns.

Supam

LGTM 👍

domalessi

Left a few suggestions but approving so you're not blocked on me!

domalessi · 2025-09-25T15:50:12Z

docs/data-sources/api_key.md

 subcategory: ""
 description: |-
-  Use this data source to retrieve information about an existing api key. Deprecated. This will be removed in a future release with prior notice. Securely store your API keys using a secret management system or use the datadog_api_key resource to manage API keys in your Datadog account.
+  Use this data source to retrieve information about an existing API key. Deprecated: This will be removed in a future release with prior notice. For secure access to API key values without storing them in Terraform state, use the ephemeral datadog_api_key resource instead. See the ephemeral resource documentation for examples of secure API key access patterns.


Suggested change

Use this data source to retrieve information about an existing API key. Deprecated: This will be removed in a future release with prior notice. For secure access to API key values without storing them in Terraform state, use the ephemeral datadog_api_key resource instead. See the ephemeral resource documentation for examples of secure API key access patterns.

Use this data source to retrieve information about an existing API key. Deprecated: This data source will be removed in a future release with prior notice. To access API key values without storing them in Terraform state, use the ephemeral datadog_api_key resource. See the ephemeral resource documentation for examples of secure API key access patterns.

domalessi · 2025-09-25T15:51:41Z

docs/data-sources/api_key.md

 # datadog_api_key (Data Source)

-Use this data source to retrieve information about an existing api key. Deprecated. This will be removed in a future release with prior notice. Securely store your API keys using a secret management system or use the datadog_api_key resource to manage API keys in your Datadog account.
+Use this data source to retrieve information about an existing API key. **Deprecated**: This will be removed in a future release with prior notice. For secure access to API key values without storing them in Terraform state, use the ephemeral `datadog_api_key` resource instead. See the ephemeral resource documentation for examples of secure API key access patterns.


Suggested change

Use this data source to retrieve information about an existing API key. **Deprecated**: This will be removed in a future release with prior notice. For secure access to API key values without storing them in Terraform state, use the ephemeral `datadog_api_key` resource instead. See the ephemeral resource documentation for examples of secure API key access patterns.

Use this data source to retrieve information about an existing API key. **Deprecated**: This data source will be removed in a future release with prior notice. To access API key values without storing them in Terraform state, use the ephemeral `datadog_api_key` resource. See the ephemeral resource documentation for examples of secure API key access patterns.

domalessi · 2025-09-25T15:53:24Z

docs/data-sources/api_key.md

 ### Read-Only

- `key` (String, Sensitive) The value of the API Key.
+- `key` (String, Sensitive) The value of the API Key. **Security Note**: This field exposes sensitive data in Terraform state. For secure access without state storage, use the ephemeral `datadog_api_key` resource instead.


Suggested change

- `key` (String, Sensitive) The value of the API Key. **Security Note**: This field exposes sensitive data in Terraform state. For secure access without state storage, use the ephemeral `datadog_api_key` resource instead.

- `key` (String, Sensitive) The value of the API Key. **Security note**: This field exposes sensitive data in Terraform state. For secure access without state storage, use the ephemeral `datadog_api_key` resource.

domalessi · 2025-09-25T16:00:07Z

docs/index.md

 - `http_client_retry_max_retries` (Number) The HTTP request maximum retry number. Defaults to 3.
 - `http_client_retry_timeout` (Number) The HTTP request retry timeout period. Defaults to 60 seconds.
 - `org_uuid` (String) The organization UUID; used for cloud-provider-based authentication. See the [Datadog API documentation](https://docs.datadoghq.com/api/v1/organizations/) for more information.
+- `store_sensitive_state` (String) Whether to expose API key values in Terraform state. Valid values are [`true`, `false`]. Defaults to `true` for backwards compatibility. When false, API key resources will not include the key value, requiring the use of ephemeral datadog_api_key resources instead.


Suggested change

- `store_sensitive_state` (String) Whether to expose API key values in Terraform state. Valid values are [`true`, `false`]. Defaults to `true` for backwards compatibility. When false, API key resources will not include the key value, requiring the use of ephemeral datadog_api_key resources instead.

- `store_sensitive_state` (String) Whether to expose API key values in Terraform state. Valid values are [`true`, `false`]. Defaults to `true` for backwards compatibility. When `false`, API key resources do not include the key value; use the ephemeral `datadog_api_key` resource instead.

tyjet · 2025-09-29T14:23:06Z

datadog/fwprovider/ephemeral_resource_datadog_api_key.go

+	}
+
+	// 2. Fetch API key from Datadog API
+	apiKey, httpResp, err := r.Api.GetAPIKey(r.Auth, config.ID.ValueString())


question (blocking) - Is there a way to make this configurable such that someone could retrieve their API key from their own Secret Manager instead of relying on the Datadog API?

@tyjet do you mean using some external (non-Datadog) API/provider?
If so, yes, if someone wants to configure their infra to use a secret manager instead of using this ephemeral resource they 💯 can do that, most known secret managers have terraform providers and resources devs can use.

That would mean, that devs won't be using this resource, as this is specifically to make a state-secure way to fetch this data via Datadog API.

I believe this leads to an important question: do we want to allow a way to get API key via our provider or do we want to just cut this API path from our provider entirely and force devs to use external secret managers?
And if we believe restricting this in our Terraform provider (despite still having API support because of reasons) is "the way" to lead devs to better/proper patterns then we don't need an ephemeral resource for datadog_api_key at all.

Thanks for the explanation, I think I understand much better now.

do we want to allow a way to get API key via our provider or do we want to just cut this API path from our provider entirely and force devs to use external secret managers?
^^ -- At this point, yes, we want to allow API key access via the provider (and public API). Restricting the terraform provider would be too onerous.

LiuVII commented Sep 19, 2025

View reviewed changes

datadog/docs/ephemeral-resources/ephemeral_security_guidelines.md Outdated Show resolved Hide resolved

LiuVII force-pushed the mf/ephemerals-poc branch from ed1a604 to ae52c9c Compare September 25, 2025 11:27

LiuVII added 2 commits September 25, 2025 13:51

LiuVII force-pushed the mf/ephemerals-poc branch from ae52c9c to 5e961e1 Compare September 25, 2025 12:51

LiuVII changed the title ~~POC: add datadog_api_key ephemeral~~ [APIR-2186] POC - Implement ephemeral datadog_api_key resource Sep 25, 2025

LiuVII changed the title ~~[APIR-2186] POC - Implement ephemeral datadog_api_key resource~~ [APIR-2185] Create ephemeral resource base utilities and helpers Sep 25, 2025

LiuVII changed the title ~~[APIR-2185] Create ephemeral resource base utilities and helpers~~ [APIR-2186] POC - Implement ephemeral datadog_api_key resource Sep 25, 2025

LiuVII changed the title ~~[APIR-2186] POC - Implement ephemeral datadog_api_key resource~~ [datadog_api_key] Implement ephemeral datadog_api_key resource Sep 25, 2025

LiuVII added changelog/feature changelog/documentation labels Sep 25, 2025

LiuVII marked this pull request as ready for review September 25, 2025 13:20

LiuVII requested review from a team as code owners September 25, 2025 13:20

LiuVII requested review from emubello and tyjet September 25, 2025 13:20

Supam approved these changes Sep 25, 2025

View reviewed changes

domalessi approved these changes Sep 25, 2025

View reviewed changes

tyjet reviewed Sep 29, 2025

View reviewed changes

tyjet approved these changes Oct 1, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[datadog_api_key] Implement ephemeral datadog_api_key resource #3227

[datadog_api_key] Implement ephemeral datadog_api_key resource #3227

Uh oh!

LiuVII commented Sep 12, 2025 •

edited

Loading

Uh oh!

Uh oh!

Supam left a comment

Uh oh!

domalessi left a comment

Uh oh!

domalessi Sep 25, 2025

Uh oh!

domalessi Sep 25, 2025

Uh oh!

domalessi Sep 25, 2025

Uh oh!

domalessi Sep 25, 2025

Uh oh!

tyjet Sep 29, 2025

Uh oh!

LiuVII Oct 1, 2025

Uh oh!

tyjet Oct 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	Use this data source to retrieve information about an existing API key. Deprecated: This will be removed in a future release with prior notice. For secure access to API key values without storing them in Terraform state, use the ephemeral datadog_api_key resource instead. See the ephemeral resource documentation for examples of secure API key access patterns.
	Use this data source to retrieve information about an existing API key. Deprecated: This data source will be removed in a future release with prior notice. To access API key values without storing them in Terraform state, use the ephemeral datadog_api_key resource. See the ephemeral resource documentation for examples of secure API key access patterns.

	- `key` (String, Sensitive) The value of the API Key. Security Note: This field exposes sensitive data in Terraform state. For secure access without state storage, use the ephemeral `datadog_api_key` resource instead.
	- `key` (String, Sensitive) The value of the API Key. Security note: This field exposes sensitive data in Terraform state. For secure access without state storage, use the ephemeral `datadog_api_key` resource.

	- `store_sensitive_state` (String) Whether to expose API key values in Terraform state. Valid values are [`true`, `false`]. Defaults to `true` for backwards compatibility. When false, API key resources will not include the key value, requiring the use of ephemeral datadog_api_key resources instead.
	- `store_sensitive_state` (String) Whether to expose API key values in Terraform state. Valid values are [`true`, `false`]. Defaults to `true` for backwards compatibility. When `false`, API key resources do not include the key value; use the ephemeral `datadog_api_key` resource instead.

[datadog_api_key] Implement ephemeral datadog_api_key resource #3227

Are you sure you want to change the base?

[datadog_api_key] Implement ephemeral datadog_api_key resource #3227

Uh oh!

Conversation

LiuVII commented Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Supam left a comment

Choose a reason for hiding this comment

Uh oh!

domalessi left a comment

Choose a reason for hiding this comment

Uh oh!

domalessi Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

domalessi Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

domalessi Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

domalessi Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

tyjet Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

LiuVII Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

tyjet Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

LiuVII commented Sep 12, 2025 •

edited

Loading