datadog-secret-backend

Important

This repository has been archived and is now read-only.

The datadog-secret-backend project has been migrated into the Datadog Agent monorepo as secret-generic-connector. See the Datadog Agent Secrets Management documentation.

• Agent 7.70+: The secret backend binary was first bundled inside the Agent. Separate installation of datadog-secret-backend is no longer needed -- configure using secret_backend_type and secret_backend_config in your datadog.yaml.
• Agent 7.77.0+: The source code now lives in the Agent repo and includes FIPS compliance support.

For existing users: Existing installations of this standalone binary will continue to work with newer Agent. But we strongly recommend upgrading to Agent 7.77.0+ and migrating to secret_backend_type configuration to benefit from the latest improvements (new features and CVE fixes from the cloud providers SDK used by this project).

For contributors and developers:

• Source code: cmd/secret-generic-connector
• Issues: Datadog Agent Issues

---

datadog-secret-backend is an implementation of the Datadog Agent Secrets Management executable supporting multiple backend secret providers.

This standalone project is not FIPS compliant. For FIPS compliance, upgrade to Agent 7.77.0+ which includes the bundled secret-generic-connector with FIPS support.

IMPORTANT NOTE: If you're using an Agent version 7.70 or newer, setup is significantly simplified as the datadog-secret-backend binary is now bundled inside the Agent itself. In that case, you don’t need to install or manage the binary separately--please use the secret_backend_type and secret_backend_config config options in your datadog.yaml file instead. Agent 7.77.0+ additionally includes FIPS compliance support.

Quick Start (Agent Version < 7.70)

1. For agents before < 7.70.0, you need to install the secret backend manually: Follow the manual installation instructions below.
2. Configure the backend type and its settings: Refer to the supported backends section for more information.
   1. You should reference secrets in your datadog.yaml file using the ENC[backend_id:secret_id] format. Here is more information on how this works.
   2. Any necessary configuration will be specified in a file named datadog-secret-backend.yaml which should be located in the same directory as the installed datadog-secret-backend executable.

Supported Backends

Backend	Provider	Description
aws.secrets	aws	Datadog secrets in AWS Secrets Manager
aws.ssm	aws	Datadog secrets in AWS Systems Manager Parameter Store
azure.keyvault	azure	Datadog secrets in Azure Key Vault
hashicorp.vault	hashicorp	Datadog secrets in Hashicorp Vault
file.json	file	Datadog secrets in local JSON files
file.yaml	file	Datadog secrets in local YAML files

Manual Installation

1. Make a new folder to hold all the files required for this module in one place (in this example will use datadog-secret-backend:

   ## Linux
   mkdir -p /etc/datadog-secret-backend
   
   ## Windows
   mkdir 'C:\Program Files\datadog-secret-backend\'
   

2. Download the most recent version of the secret backend module by hitting the latest release endpoint from this repo by running one of the commands below:

   ## Linux (amd64)
   curl -L https://github.com/DataDog/datadog-secret-backend/releases/download/v0.3.0/datadog-secret-backend-linux-amd64.tar.gz \ 
   -o /tmp/datadog-secret-backend-linux-amd64.tar.gz
   
   ## Linux (386)
   curl -L https://github.com/DataDog/datadog-secret-backend/releases/download/v0.3.0/datadog-secret-backend-linux-386.tar.gz \ 
   -o /tmp/datadog-secret-backend-linux-386.tar.gz
   
   ## Windows (amd64)
   Invoke-WebRequest https://github.com/DataDog/datadog-secret-backend/releases/download/v0.3.0/datadog-secret-backend-windows-amd64.zip -OutFile 'C:\Program Files\datadog-secret-backend\datadog-secret-backend-windows-amd64.zip'
   
   ## Windows (386)
   Invoke-WebRequest https://github.com/DataDog/datadog-secret-backend/releases/download/v0.3.0/datadog-secret-backend-windows-386.zip -OutFile 'C:\Program Files\datadog-secret-backend\datadog-secret-backend-windows-386.zip'
   

3. Once you have the file from the github repo, you'll need to unzip it to get the executable:

   ## Linux (amd64, change end of filename to "386" if needed)
   tar -xvzf /tmp/datadog-secret-backend-linux-amd64.tar.gz \
   -C /etc/datadog-secret-backend
   
   ## Windows (amd64, change end of filename to "386" if needed)
   Expand-Archive -LiteralPath 'C:\Program Files\datadog-secret-backend\datadog-secret-backend-windows-amd64.zip' -DestinationPath 'C:\Program Files\datadog-secret-backend\'
   

4. (Optional) Remove the old tar'd file:

   ## Linux
   rm /tmp/datadog-secret-backend-linux-amd64.tar.gz
   
   ## Windows
   Remove-Item 'C:\Program Files\datadog-secret-backend\datadog-secret-backend-windows-amd64.zip'
   

5. Update the executable to have the required Agent security permissions.

6. Provide an executable path to the datadog agent via the main datadog.yaml file using the secret_backend_command variable:

   ## datadog.yaml ##
   
   secret_backend_command: /etc/datadog-secret-backend/datadog-secret-backend
   

7. Provide a configuration for the secrets executable. Documentation for each supported provider can be found here.

Usage

Reference each supported backend type's documentation on specific usage examples and configuration options.

License

BSD-3-Clause License