[datadog_logs_archives] Handle encryption field for S3 destinations for Logs Archives

datadog/resource_datadog_logs_archive.go

@@ -44,6 +44,8 @@
 								ValidateDiagFunc: validators.ValidateAWSAccountID,
 							},
 							"role_name": {Description: "Your AWS role name", Type: schema.TypeString, Required: true},
+							"encryption_type": {Description: "The type of encryption on your archive.", Type: schema.TypeString, Required: false},
+							"encryption_key": {Description: "The AWS KMS encryption key.", Type: schema.TypeString, Required: false},
 						},
 					},
 				},
@@ -253,10 +255,13 @@
 func buildS3Map(destination datadogV2.LogsArchiveDestinationS3) map[string]interface{} {
 	result := make(map[string]interface{})
 	integration := destination.GetIntegration()
+	encryption := destination.GetEncryption()
 	result["account_id"] = integration.GetAccountId()
 	result["role_name"] = integration.GetRoleName()
 	result["bucket"] = destination.GetBucket()
 	result["path"] = destination.GetPath()
+	result["encryption_type"] = encryption.GetType();
+	result["encryption_key"] = encryption.GetKey();
 	return result
 }
 
@@ -421,9 +426,32 @@
 	if !ok {
 		path = ""
 	}
+
+	var datadogV2.LogsArchiveEncryptionS3 encryption
+
+	encryptionType, ok := d["encryption_type"]
+	if !ok {
+		encryption = datadogV2.NewLogsArchiveEncryptionS3(
+			"NO_OVERRIDE",
+		)
+	} else {
+		encryptionKey, ok := d["encryption_key"]
+		if !ok {
+			encryption = datadogV2.NewLogsArchiveEncryptionS3(
+				encryptionType.(string),
+			)
+		} else {
+			encryption = datadogV2.NewLogsArchiveEncryptionS3(
+				encryptionType.(string),
+				encryptionKey.(string),
+			)
+		}
+	}
+
 	destination := datadogV2.NewLogsArchiveDestinationS3(
 		bucket.(string),
 		*integration,
+		*encryption,
 		datadogV2.LOGSARCHIVEDESTINATIONS3TYPE_S3,
 	)
 	destination.Path = datadog.PtrString(path.(string))

docs/resources/logs_archive.md

@@ -21,6 +21,7 @@ resource "datadog_logs_archive" "my_s3_archive" {
     path       = "/path/foo"
     account_id = "001234567888"
     role_name  = "my-role-name"
+    encryption_type = "SSE_S3"
   }
 }
 ```
@@ -87,6 +88,8 @@ Required:
 Optional:
 
 - `path` (String) Path where the archive is stored.
+- `encryption_type` (String) The type of server-side encryption to use when uploading data to your S3 bucket. `NO_OVERRIDE`, `SSE_S3`, and `SSE_KMS` are the possible types. `NO_OVERRIDE` is used most commonly, because users can rely on default encryption on their S3 buckets instead of specifically uploading objects with encryption information.
+- `encryption_key` (String) The key ARN used to identify your customer managed key for AWS KMS encryption. Only set this value if the `encryption_type` is set to `SSE_KMS`. 
 
 ## Import