Skip to content

Reference AWS Secrets Manager rotation for API keys and SATs #38116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anthony-dgx wants to merge 2 commits into
base: master
Choose a base branch
from
+9 −0
Open

Reference AWS Secrets Manager rotation for API keys and SATs #38116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c92c54
Reference AWS Secrets Manager rotation support for API keys, applicat…
anthony-dgx Jul 13, 2026
819a335
Merge branch 'master' into adagneaux/aws-secrets-manager-reference
jeff-morgan-dd Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions content/en/account_management/api-app-keys.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,8 @@ To add a Datadog application key, navigate to [**Organization Settings** > **App
<div class="alert alert-info">If your organization has One-Time Read (OTR) mode enabled, make sure to securely store your application key immediately after creation, as the key secret cannot be retrieved later.</div>
{{< /site-region >}}

Because API keys and application keys are long-lived and have no built-in expiration, store them in a secrets manager, such as AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault, instead of in source code or environment files. AWS Secrets Manager supports [managed rotation for Datadog API keys and application keys][24].

**Notes:**

- Application key names cannot be blank.
Expand Down Expand Up @@ -200,3 +202,4 @@ Need help? Contact [Datadog support][19].
[21]: /api/latest/action-connection/#register-a-new-app-key
[22]: /account_management/audit_trail/#setup
[23]: /account_management/rbac/permissions/#compliance
[24]: https://aws.amazon.com/about-aws/whats-new/2026/05/secrets-manager-managed-external-secrets-datadog-snowflake/
6 changes: 6 additions & 0 deletions content/en/account_management/service-access-tokens.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,11 @@ Copy and store it securely. You cannot retrieve it later.</div>
After you save, a details panel displays the token secret, name, Token ID, owner, owner roles,
expiration date, and scopes.

If you configure a SAT with a long expiration or select **Never**, store the secret in a secrets
manager, such as AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault, instead of in source
code or environment files. AWS Secrets Manager supports [managed rotation for Datadog service
account credentials][8].

## Use a Service Access Token

SATs support two authentication methods.
Expand Down Expand Up @@ -161,3 +166,4 @@ GET /api/v2/personal_access_tokens
[5]: /account_management/rbac/permissions/
[6]: /account_management/audit_trail/
[7]: https://app.datadoghq.com/audit-trail
[8]: https://aws.amazon.com/about-aws/whats-new/2026/05/secrets-manager-managed-external-secrets-datadog-snowflake/
Loading