If not already configured, set up the AWS integration for the AWS account that holds your S3 bucket.

• In the general case, this involves creating a role that Datadog can use to integrate with AWS S3.
• Specifically for AWS GovCloud or China accounts, use access keys as an alternative to role delegation.

Set up the Azure integration within the subscription that holds your new storage account, if you haven’t already. This involves creating an app registration that Datadog can use to integrate with.

Note: Archiving to Azure ChinaCloud, GermanyCloud, and GovCloud is not supported.

Set up the Google Cloud integration for the project that holds your GCS storage bucket, if you haven’t already. This involves creating a Google Cloud service account that Datadog can use to integrate with.

Go into your AWS console and create an S3 bucket to send your archives to.

Notes:

• Do not make your bucket publicly readable.
• For US1, US3, and US5 sites, see AWS Pricing for inter-region data transfer fees and how cloud storage costs may be impacted. Consider creating your storage bucket in us-east-1 to manage your inter-region data transfer fees.

• Go to your Azure Portal and create a storage account to send your archives to. Give your storage account a name, select either standard performance or Block blobs premium account type, and select the hot or cool access tier.
• Create a container service into that storage account. Take note of the container name as you will need to add this in the Datadog Archive Page.

Note: Do not set immutability policies because the last data needs to be rewritten in some rare cases (typically a timeout).

Go to your Google Cloud account and create a GCS bucket to send your archives to. Under Choose how to control access to objects, select Set object-level and bucket-level permissions.

Note: Do not add retention policy because the last data needs to be rewritten in some rare cases (typically a timeout).

1. Create a policy with the following permission statements:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "DatadogUploadAndRehydrateLogArchives",
         "Effect": "Allow",
         "Action": ["s3:PutObject", "s3:GetObject"],
         "Resource": [
           "arn:aws:s3:::<MY_BUCKET_NAME_1_/_MY_OPTIONAL_BUCKET_PATH_1>/*",
           "arn:aws:s3:::<MY_BUCKET_NAME_2_/_MY_OPTIONAL_BUCKET_PATH_2>/*"
         ]
       },
       {
         "Sid": "DatadogRehydrateLogArchivesListBucket",
         "Effect": "Allow",
         "Action": "s3:ListBucket",
         "Resource": [
           "arn:aws:s3:::<MY_BUCKET_NAME_1>",
           "arn:aws:s3:::<MY_BUCKET_NAME_2>"
         ]
       }
     ]
   }
   

   • The GetObject and ListBucket permissions allow for rehydrating from archives.
   • The PutObject permission is sufficient for uploading archives.
   • Ensure that the resource value under the s3:PutObject and s3:GetObject actions ends with /* because these permissions are applied to objects within the buckets.

2. Edit the bucket names.

3. Optionally, specify the paths that contain your log archives.

4. Attach the new policy to the Datadog integration role.

   • Navigate to Roles in the AWS IAM console.
   • Locate the role used by the Datadog integration. By default it is named DatadogIntegrationRole, but the name may vary if your organization has renamed it. Click the role name to open the role summary page.
   • Click Add permissions, and then Attach policies.
   • Enter the name of the policy created above.
   • Click Attach policies.

1. Grant the Datadog app permission to write to and rehydrate from your storage account.
2. Select your storage account from the Storage Accounts page, go to Access Control (IAM), and select Add -> Add Role Assignment.
3. Input the Role called Storage Blob Data Contributor, select the Datadog app which you created to integrate with Azure, and save.

1. Grant your Datadog Google Cloud service account permissions to write your archives to your bucket.

2. Select your Datadog Google Cloud service account principal from the Google Cloud IAM Admin page and select Edit principal.

3. Click ADD ANOTHER ROLE, select the Storage Object Admin role, and save.

Select the appropriate AWS account and role combination for your S3 bucket.

Input your bucket name. Optional: Input a prefix directory for all the content of your log archives.

Select the Azure Storage archive type, and the Azure tenant and client for the Datadog App that has the Storage Blob Data Contributor role on your storage account.

Input your storage account name and the container name for your archive. Optional: Input a prefix directory for all the content of your log archives.

Select the GCS archive type, and the GCS Service Account that has permissions to write on your storage bucket.

Input your bucket name. Optional: Input a prefix directory for all the content of your log archives.

You can set a lifecycle configuration on your S3 bucket to automatically transition your log archives to optimal storage classes.

Rehydration only supports the following storage classes:

• S3 Standard
• S3 Standard-IA
• S3 One Zone-IA
• S3 Glacier Instant Retrieval

If you wish to rehydrate from archives in another storage class, you must first move them to one of the supported storage classes above.

Archiving and Rehydration only supports the following access tiers:

• Hot access tier
• Cool access tier

If you wish to rehydrate from archives in another access tier, you must first move them to one of the supported tiers above.

SSE-S3

The default encryption for Amazon S3 buckets is server-side encryption with Amazon S3 management keys (SSE-S3).

To confirm your S3 bucket is encrypted with SSE-S3:

1. Navigate to your S3 bucket.
2. Click the Properties tab.
3. In the Default Encryption section, check that the Encryption key type is Amazon S3 managed keys (SSE-S3).

SSE-KMS

Alternatively, Datadog supports server-side encryption with a CMK from AWS KMS. To enable it, take the following steps:

1. Create your CMK.
2. Attach a CMK policy to your CMK with the following content, replacing the AWS account number and Datadog IAM role name appropriately:

{
    "Id": "key-consolepolicy-3",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<MY_AWS_ACCOUNT_NUMBER>:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<MY_AWS_ACCOUNT_NUMBER>:role/<MY_DATADOG_IAM_ROLE_NAME>"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<MY_AWS_ACCOUNT_NUMBER>:role/<MY_DATADOG_IAM_ROLE_NAME>"
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}

3. Go to the Properties tab in your S3 bucket and select Default Encryption. Choose the “AWS-KMS” option, select your CMK ARN, and save.

For any changes to existing KSM keys, reach out to Datadog support for further assistance.