1. Datadog App and API Protection Service Extensions Docker image を使って、Compute Engine の VM インスタンスを作成します。

   VM インスタンス作成時に指定できる環境変数は、Configuration を参照してください。

   Note: Be sure to update your Firewall rules to allow the Load Balancer and Datadog agent to communicate with the Callout VM instance.

2. VM を unmanaged instance group に追加します。

   instance group のポート マッピングに http:80 と grpc:443 (または設定値) を指定します。

3. 次の設定で backend service を作成します:

   • Protocol: HTTP2
   • Port name: grpc
   • Region: 対象のリージョンを選択
   • Health check port number: 80 (または設定値)

4. Service Extension の VM を含む instance group を、この backend service の backend として追加します。

5. Traffic Service Extension の callout を構成する:

   1. Google Cloud コンソールで Service Extensions に移動し、新しい Service Extension を作成します。
   2. ロード バランサーのタイプを選択します。
   3. type として Traffic extensions を選択します。
   4. forwarding rules を選択します。
      
      

6. Extension Chain を作成する

   1. すべてのトラフィックを extension に送るには、Match condition に true を入れます。
   2. Programability type は Callouts を選択します。
   3. 前の手順で作成した backend service を選択します。
   4. App and API Protection の検知を実行したい箇所について、一覧から Events をすべて選択します (Request Headers と Response Headers は required です)。

After this configuration is complete, the library collects security data from your application and sends it to the Agent. The Agent sends the data to Datadog, where out-of-the-box detection rules flag attacker techniques and potential misconfigurations so you can take steps to remediate.

1. To see App and API Protection threat detection in action, send known attack patterns to your application. For example, trigger the Security Scanner Detected rule by running a file that contains the following curl script:

   for ((i=1;i<=250;i++)); 
   do
   # Target existing service's routes
   curl https://your-application-url/existing-route -A dd-test-scanner-log;
   # Target non existing service's routes
   curl https://your-application-url/non-existing-route -A dd-test-scanner-log;
   done

   Note: The dd-test-scanner-log value is supported in the most recent releases.

   A few minutes after you enable your application and send known attack patterns to it, threat information appears in the Application Signals Explorer and vulnerability information appears in the Vulnerabilities explorer.

Terraform を使うと、App and API Protection の GCP Service Extension デプロイを自動化できます。既存のロード バランサーと連携する Service Extension のセットアップを、よりシンプルに進められます。

Terraform デプロイの前提条件

• ローカル マシンに Terraform がインストールされていること (バージョン 1.0.0 以降)。
• 適切な権限を持つ GCP の認証情報。
• Datadog API key (Datadog Agent の設定に使用)。
• アプリケーション用に既存の GCP Cloud Load Balancer があること。

インフラの概要

Terraform デプロイでは、次のコンポーネントが作成されます:

• セキュリティ イベントを含むトレースを収集する Datadog Agent VM
• コンテナ内で Datadog Service Extension Callout を実行する VM
• extension と Agent 間の通信を許可するファイアウォール ルール
• Service Extension VM を含む unmanaged instance group
• HTTP/2 用に構成され、ヘルス チェックを備えた backend service
• 既存のロード バランサーに接続された service extension

デプロイ手順

App and API Protection Service Extension のデプロイは、複数のコンポーネントが連携して動作します。ここでは、それらをまとめた Terraform モジュールを作成し、繰り返し実行できて保守しやすい形でデプロイできるようにします。

1. 新しいディレクトリを作成し、必要な Terraform ファイルを用意します:

   mkdir gcp-aap-service-extension && cd gcp-aap-service-extension
   touch main.tf variables.tf
   

2. main.tf に次のコードを追加します。このファイルでは、ネットワーク ルール、VM インスタンス、ロード バランサー設定など、App and API Protection Service Extension に必要なインフラ コンポーネントを定義します:

   # main.tf
   
   #----------------------------------------------------------
   # Network Configuration
   #----------------------------------------------------------
   
   # Firewall rule to allow the Service Extension to communicate with the Datadog Agent
   resource "google_compute_firewall" "aap_se_firewall" {
     name    = "${var.project_prefix}-dd-agent-firewall"
     network = "default"
   
     allow {
       protocol = "tcp"
       ports    = ["8126"]
     }
   
     source_tags = ["http-server"]
     target_tags = ["datadog-agent"]
   }
   
   #----------------------------------------------------------
   # Datadog Agent Configuration
   #----------------------------------------------------------
   
   # Datadog Agent container configuration
   module "gce-container-datadog-agent" {
     source = "terraform-google-modules/container-vm/google"
   
     container = {
       image = "public.ecr.aws/datadog/agent:latest"
       env = [
         {
           name = "DD_API_KEY",
           value = var.datadog_agent_api_key,
         },
         {
           name = "DD_ENV",
           value = "dev",
         },
       ]
     }
   }
   
   # Datadog Agent VM instance that collects traces from the Service Extension
   resource "google_compute_instance" "datadog_agent" {
     name         = "${var.project_prefix}-datadog-agent"
     machine_type = "e2-medium"
     zone         = var.zone
   
     boot_disk {
       auto_delete = true
   
       initialize_params {
         image = module.gce-container-datadog-agent.source_image
       }
   
     }
   
     network_interface {
       network    = "default"
       subnetwork = var.application_vpc_subnetwork
     }
   
     metadata = {
       gce-container-declaration = module.gce-container-datadog-agent.metadata_value
       google-logging-enabled    = "true"
     }
   
     lifecycle {
       create_before_destroy = true
     }
   
     tags = ["datadog-agent"]
   }
   
   #----------------------------------------------------------
   # Service Extension Callout Container Configuration
   #----------------------------------------------------------
   
   # Datadog App and API Protection GCP Service Extension container configuration
   module "gce-container-aap-service-extension" {
     source = "terraform-google-modules/container-vm/google"
   
     container = {
       image = "ghcr.io/datadog/dd-trace-go/service-extensions-callout:v1.72.1" # Replace with the latest version
       env = [
         {
           name = "DD_AGENT_HOST",
           value = google_compute_instance.datadog_agent.network_interface.0.network_ip,
         }
       ]
     }
   }
   
   # Service Extension VM instance (callout instance)
   resource "google_compute_instance" "default" {
     name         = "${var.project_prefix}-instance"
     machine_type = "e2-medium"
     zone         = var.zone
   
     boot_disk {
       auto_delete = true
   
       initialize_params {
         image = module.gce-container-aap-service-extension.source_image
       }
   
     }
   
     network_interface {
       network    = var.application_vpc_network
       subnetwork = var.application_vpc_subnetwork
     }
   
     metadata = {
       gce-container-declaration = module.gce-container-aap-service-extension.metadata_value
       google-logging-enabled    = "true"
     }
   
     lifecycle {
       create_before_destroy = true
     }
   
     # http-server: Allow access on the http server for health checks
     # https-server: Allow access on the 443 port for the AAP Service Extension
     tags = ["http-server", "https-server", "lb-health-check"]
   }
   
   #----------------------------------------------------------
   # Load Balancer Integration
   #----------------------------------------------------------
   
   # Unmanaged Instance Group including the App and API Protection Service Extension instance
   resource "google_compute_instance_group" "aap_se_instance_group" {
     name        = "${var.project_prefix}-instance-group"
     description = "Unmanaged instance group for the App and API Protection Service Extension"
     zone        = var.zone
   
     named_port {
       name = "http"
       port = 80
     }
   
     named_port {
       name = "grpc"
       port = "443"
     }
   
     instances = [
       google_compute_instance.default.self_link
     ]
   }
   
   # Health Check for the Backend Service
   resource "google_compute_health_check" "aap_se_health_check" {
     name                = "${var.project_prefix}-health-check"
     check_interval_sec  = 5
     timeout_sec         = 5
     healthy_threshold   = 2
     unhealthy_threshold = 2
   
     http_health_check {
       port         = 80
       request_path = "/"
     }
   }
   
   # Backend Service that points to the Service Extension instance group
   resource "google_compute_backend_service" "se_backend_service" {
     name                  = "${var.project_prefix}-backend-service"
     port_name             = "grpc"
     protocol              = "HTTP2"
     timeout_sec           = 10
     health_checks         = [google_compute_health_check.aap_se_health_check.self_link]
     load_balancing_scheme = "EXTERNAL_MANAGED"
   
     backend {
       group = google_compute_instance_group.aap_se_instance_group.self_link
     }
   }
   
   #----------------------------------------------------------
   # GCP Service Extension
   #----------------------------------------------------------
   
   # GCP Service Extension configuration for traffic interception
   resource "google_network_services_lb_traffic_extension" "default" {
     name        = "${var.project_prefix}-service-extension"
     description = "Datadog App and API Protection Service Extension"
     location    = "global"
   
     load_balancing_scheme = "EXTERNAL_MANAGED"
     forwarding_rules      = [var.load_balancer_forwarding_rule]
   
     extension_chains {
       name = "${var.project_prefix}-service-extension-chain"
   
       match_condition {
         cel_expression = "true" # Match all traffic
       }
   
       extensions {
         name      = "${var.project_prefix}-service-extension-chain-ext"
         authority = "datadoghq.com"
         service   = google_compute_backend_service.se_backend_service.self_link
         timeout   = "0.5s"
         fail_open = false # If the extension fails, the request is dropped
   
         # Supported events for the App and API Protection Service Extension
         supported_events = ["REQUEST_HEADERS", "REQUEST_BODY", "RESPONSE_HEADERS", "RESPONSE_BODY"]
       }
     }
   }
   

3. variables.tf に次の内容を追加します。このファイルでは、Terraform 設定に必要な入力変数を定義します:

   # variables.tf
   
   variable "region" {
     description = "The GCP region where resources will be created (e.g., us-central1)"
     type        = string
     validation {
       condition     = length(var.region) > 0
       error_message = "Region cannot be empty."
     }
   }
   
   variable "zone" {
     description = "The GCP zone where zonal resources will be created (e.g., us-central1-a)"
     type        = string
     validation {
       condition     = length(var.zone) > 0
       error_message = "Zone cannot be empty."
     }
   }
   
   # Project configuration
   variable "project_prefix" {
     description = "Prefix for the project. All resource names will be prefixed with this value"
     type        = string
     validation {
       condition     = length(var.project_prefix) > 0
       error_message = "Project prefix cannot be empty."
     }
   }
   
   # Network configuration
   variable "application_vpc_network" {
   
     description = "Name of the VPC network for the application"
     type        = string
     validation {
       condition     = length(var.application_vpc_network) > 0
       error_message = "VPC network name cannot be empty."
     }
   }
   
   variable "application_vpc_subnetwork" {
   
     description = "Name of the VPC subnetwork for the application"
     type        = string
     validation {
       condition     = length(var.application_vpc_subnetwork) > 0
       error_message = "VPC subnetwork name cannot be empty."
     }
   }
   
   # Authentication and API keys
   variable "datadog_agent_api_key" {
     description = "Datadog API key"
     type        = string
     sensitive   = true
     validation {
       condition     = length(var.datadog_agent_api_key) > 0
       error_message = "Datadog API key cannot be empty."
     }
   }
   
   # Load balancer configuration
   variable "load_balancer_forwarding_rule" {
     description = "Self link to the forwarding rule for the load balancer"
   }
   

4. メインの Terraform プロジェクトにモジュールを組み込みます。この例は、上で作成したモジュールの参照方法を示しています:

   # main.tf
   
   module "service_extension" {
     source                        = "./gcp-aap-service-extension"
     zone                          = "us-central1-a"
     region                        = "us-central1"
     project_prefix                = "datadog-aap"
     application_vpc_subnetwork    = "your-subnet-name"
     datadog_agent_api_key         = "your-datadog-api-key"
     load_balancer_forwarding_rule = "projects/your-project/regions/us-central1/forwardingRules/your-lb-rule" # or with a self link on your resource
   }
   

5. Terraform ファイルがあるディレクトリで、次のコマンドを実行してインフラをデプロイします:

   terraform init
   terraform plan
   terraform apply
   

デプロイ後の検証

service extension は、ロード バランサーを通過するすべてのトラフィックを自動的に検査し、セキュリティ上の脅威を検知します。

After this configuration is complete, the library collects security data from your application and sends it to the Agent. The Agent sends the data to Datadog, where out-of-the-box detection rules flag attacker techniques and potential misconfigurations so you can take steps to remediate.

1. To see App and API Protection threat detection in action, send known attack patterns to your application. For example, trigger the Security Scanner Detected rule by running a file that contains the following curl script:

   for ((i=1;i<=250;i++)); 
   do
   # Target existing service's routes
   curl https://your-application-url/existing-route -A dd-test-scanner-log;
   # Target non existing service's routes
   curl https://your-application-url/non-existing-route -A dd-test-scanner-log;
   done

   Note: The dd-test-scanner-log value is supported in the most recent releases.

   A few minutes after you enable your application and send known attack patterns to it, threat information appears in the Application Signals Explorer and vulnerability information appears in the Vulnerabilities explorer.