|
8 | 8 |
|
9 | 9 | import org.jetbrains.annotations.NotNull; |
10 | 10 | import software.amazon.awscdk.Duration; |
| 11 | +import software.amazon.awscdk.services.iam.Effect; |
| 12 | +import software.amazon.awscdk.services.iam.PolicyStatement; |
| 13 | +import software.amazon.awscdk.services.iam.PolicyStatementProps; |
11 | 14 | import software.amazon.awscdk.services.lambda.*; |
12 | 15 | import software.amazon.awscdk.services.lambda.Runtime; |
13 | 16 | import software.amazon.awscdk.services.lambda.VersionProps; |
|
16 | 19 | import software.amazon.awscdk.services.s3.assets.Asset; |
17 | 20 | import software.constructs.Construct; |
18 | 21 |
|
19 | | -import java.util.ArrayList; |
20 | | -import java.util.HashMap; |
21 | | -import java.util.List; |
22 | | -import java.util.Map; |
| 22 | +import java.util.*; |
23 | 23 |
|
24 | 24 | public class InstrumentedFunction extends Construct { |
25 | 25 | private final IFunction function; |
@@ -51,7 +51,7 @@ public InstrumentedFunction(@NotNull Construct scope, @NotNull String id, @NotNu |
51 | 51 |
|
52 | 52 | List<ILayerVersion> layers = new ArrayList<>(2); |
53 | 53 | layers.add(LayerVersion.fromLayerVersionArn(this, "DatadogJavaLayer", String.format("arn:aws:lambda:%s:464622532012:layer:dd-trace-java:21",System.getenv("AWS_REGION")))); |
54 | | - layers.add(LayerVersion.fromLayerVersionArn(this, "DatadogLambdaExtension", String.format("arn:aws:lambda:%s:464622532012:layer:Datadog-Extension:80", System.getenv("AWS_REGION")))); |
| 54 | + layers.add(LayerVersion.fromLayerVersionArn(this, "DatadogLambdaExtension", String.format("arn:aws:lambda:%s:464622532012:layer:Datadog-Extension:83", System.getenv("AWS_REGION")))); |
55 | 55 |
|
56 | 56 |
|
57 | 57 | Asset fileAsset = Asset.Builder.create(this, String.format("%sS3Asset", props.routingExpression())) |
@@ -91,15 +91,15 @@ public InstrumentedFunction(@NotNull Construct scope, @NotNull String id, @NotNu |
91 | 91 | } |
92 | 92 |
|
93 | 93 | // The Datadog extension sends log data to Datadog using the telemetry API, disabling CloudWatch prevents 'double paying' for logs |
94 | | -// if (System.getenv("ENABLE_CLOUDWATCH_LOGS") != "Y") { |
95 | | -// this.function.addToRolePolicy(new PolicyStatement(PolicyStatementProps.builder() |
96 | | -// .actions(List.of("logs:CreateLogGroup", |
97 | | -// "logs:CreateLogStream", |
98 | | -// "logs:PutLogEvents")) |
99 | | -// .resources(List.of("arn:aws:logs:*:*:*")) |
100 | | -// .effect(Effect.DENY) |
101 | | -// .build())); |
102 | | -// } |
| 94 | + if (!Objects.equals(System.getenv("ENABLE_CLOUDWATCH_LOGS"), "Y")) { |
| 95 | + this.function.addToRolePolicy(new PolicyStatement(PolicyStatementProps.builder() |
| 96 | + .actions(List.of("logs:CreateLogGroup", |
| 97 | + "logs:CreateLogStream", |
| 98 | + "logs:PutLogEvents")) |
| 99 | + .resources(List.of("arn:aws:logs:*:*:*")) |
| 100 | + .effect(Effect.DENY) |
| 101 | + .build())); |
| 102 | + } |
103 | 103 |
|
104 | 104 | props.sharedProps().ddApiKeySecret().grantRead(this.function); |
105 | 105 | } |
|
0 commit comments