feat: Support periodic reload for api key secret by lym953 · Pull Request #893 · DataDog/datadog-lambda-extension

added 7 commits

October 14, 2025 10:17

@lym953 lym953 marked this pull request as ready for review

October 14, 2025 15:59

litianningdatadog

@lym953

litianningdatadog

@lym953 lym953 changed the title feat: Support periodic reload for api key feat: Support periodic reload for api key secret

Oct 15, 2025

@lym953 lym953 deleted the yiming.luo/api-key-reload branch

October 15, 2025 19:01

@lym953 lym953 linked an issue

Oct 17, 2025

that may be closed by this pull request

duncanpharvey pushed a commit that referenced this pull request

Mar 10, 2026
# This PR
Supports the env var `DD_API_KEY_SECRET_RELOAD_INTERVAL`, in seconds. It
applies when Datadog API Key is set using `DD_API_KEY_SECRET_ARN`. For
example:
- if it's `120`, then api key will be reloaded about every 120 seconds.
Note that reload can only be triggered when api key is used, usually
when data is being flushed. If there is no invocation and no data needs
to be flushed, then reload won't happen.
- If it's not set or set to `0`, then api key will only be loaded once
the first time it is used, and won't be reloaded.

# Motivation
Some customers regularly rotate their api key in a secret. We need to
provide a way for them to update our cached key.
#834

# Testing
## Steps
1. Set the env var `DD_API_KEY_SECRET_RELOAD_INTERVAL` to `120`

2. Invoke the Lambda every minute

## Result
The reload interval is passed to the `ApiKeyFactory`
<img width="711" height="25" alt="image"
src="https://github.com/user-attachments/assets/6fcc5081-accb-4928-8fa7-094d36aa2fa1"
/>

Reload happens roughly every 120 seconds. It's sometimes longer than 120
seconds due to the reason explained above.
<img width="554" height="252" alt="image"
src="https://github.com/user-attachments/assets/3fa78249-ff98-47d2-a953-f090630bbeb1"
/>

# Notes to Users
When you use this env var, please also keep a grace period for the old
api key after you update the secret to the new key, and make the grace
period longer than the reload interval to give the extension sufficient
time to reload the secret.

# Internal Notes
Jira: https://datadoghq.atlassian.net/browse/SVLS-7572