Datadog

Create read-only Datadog credentials for Tero

Connect Datadog by creating read-only credentials and sharing them with Tero. This lets Tero review log telemetry, build service and log-event context, and analyze ingestion without changing anything in Datadog.

What to create

Tero needs two Datadog credentials:

• An API key named Tero
• An application key owned by a service account with Datadog’s Read-Only role

Use the Datadog UI or pup CLI to create both credentials.

Create credentials

Datadog UI

1. Create an API key

   In Datadog, go to Organization Settings > API Keys. Create a new key named Tero.

2. Create a service account

   Go to Organization Settings > Service Accounts. Create a service account named Tero and assign it the Read-Only role.

3. Create an application key

   Open the Tero service account. Under Application Keys, create an application key and copy it. Datadog shows the application key secret once.

Pup

Use the same Datadog site your account normally uses. Replace <DATADOG_SITE> with your Datadog site, such as datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, or ddog-gov.com.

1. Install Pup and authenticate

   brew tap datadog-labs/pack
   brew install datadog-labs/pack/pup
   
   pup auth login --site <DATADOG_SITE>
   pup users roles --output table
   
2. Create an API key

   pup api-keys create --name Tero --output json
   

   Copy the API key value from the output.

3. Create the service account request

   Create tero-service-account.json with the role ID for Datadog’s Read-Only role.

   {
     "data": {
       "type": "users",
       "attributes": {
         "name": "Tero",
         "email": "[e-mail]",
         "service_account": true
       },
       "relationships": {
         "roles": {
           "data": [
             {
               "id": "<READ_ONLY_ROLE_ID>",
               "type": "roles"
             }
           ]
         }
       }
     }
   }
   
4. Create the service account

   pup users service-accounts create --file tero-service-account.json --output json
   

   Copy the service account ID from the output.

5. Create the application key request

   Create tero-application-key.json.

   {
     "data": {
       "type": "application_keys",
       "attributes": {
         "name": "Tero"
       }
     }
   }
   
6. Create the application key

   pup users service-accounts app-keys create <SERVICE_ACCOUNT_ID> --file tero-application-key.json --output json
   

   Datadog shows the application key secret once. Copy it before closing the output.

Share the credentials with Tero

Send your Tero contact the Datadog API key, application key, and Datadog site. Tero uses those read-only credentials to start analysis.

Related pages

• Issues
• Policies
• Log events