Terraform Statefile Integration

Integration version1.0.0

To find out if this integration is available in your organization, see your Datadog Integrations page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email support@ddog-gov.com.

Overview

Connect the Terraform Statefile integration to Datadog to:

  • Automatically map cloud resources back to the Terraform modules, repositories, and teams that created them.
  • Attribute cost, security findings, and other telemetry to the code that owns the underlying resources.
  • Surface infrastructure-as-code context on pull requests that change resources Datadog is already monitoring.

A Terraform state file is the record Terraform keeps of the infrastructure it manages, including the identifiers, attributes, and module structure that tie each resource back to your code. Datadog reads your state files from cloud storage and uses them to build this cloud-to-code mapping, with no changes required to your Terraform workflow.

Datadog processes your state files to build the mapping and deletes them shortly after ingestion. State files are not retained.

Setup

Configuration

  1. From the Terraform Statefile integration tile, click Install.

  2. Connect an AWS account: choose one already connected to Datadog, or connect a new one using CloudFormation, Terraform, or manual IAM setup.

  3. Connect a source code provider (GitHub, GitLab, Azure DevOps, or Bitbucket), if you haven’t already. This is required to build the cloud-to-code mapping.

  4. Select the S3 buckets that hold your Terraform state files.

  5. Grant Datadog scoped read access to those buckets, using whichever method fits your workflow:

    • CloudFormation: Apply a one-click stack that grants access to your existing Datadog AWS integration role.
    • Terraform: Apply a generated aws_iam_role_policy resource as code.
    • Manual: Attach the generated IAM policy yourself.

    Access is scoped to s3:GetObject and s3:ListBucket on the buckets you selected. Nothing else in your AWS account is touched.

Validation

Return to the integration tile’s Configure tab at any time to view ingestion status per AWS account and region, or to remove a tracked bucket. Removing a bucket stops ingestion and deregisters the sync; it does not change anything in your AWS account.

Data Collected

Metrics

The Terraform Statefile integration does not include any metrics.

Service Checks

The Terraform Statefile integration does not include any service checks.

Events

The Terraform Statefile integration does not include any events.

Support

Need help? Contact Datadog support.