Add AWS Lambda/ECS/EKS methods to FIPS Compliance documentation #29539

misteriaud · 2025-05-26T14:01:35Z

What does this PR do? What is the motivation?

This PR improves the FIPS Agent documentation and adds specific instructions for the supported installation methods.

Merge instructions

Merge readiness:

Ready for merge

For Datadog employees:
Merge queue is enabled in this repo. Your branch name MUST follow the <name>/<description> convention and include the forward slash (/). Without this format, your pull request will not pass in CI, the GitLab pipeline will not run, and you won't get a branch preview. Getting a branch preview makes it easier for us to check any issues with your PR, such as broken links.

If your branch doesn't follow this format, rename it or create a new branch and PR.

To have your PR automatically merged after it receives the required reviews, add the following PR comment:

/merge

Additional notes

….riaud/update_fips_documentation

github-actions · 2025-05-28T12:44:19Z

📝 Documentation Team Review Required

This pull request requires approval from the @DataDog/documentation team before it can be merged.

Please ensure your changes follow our documentation guidelines and wait for a team member to review and approve your changes.

github-actions · 2025-05-28T12:53:37Z

Preview links (active after the `build_preview` check completes)

Modified Files

drichards-87 · 2025-05-28T15:28:18Z

Created DOCS-11045 for the docs review.

sgnn7

@misteriaud Just a couple of small comments

sgnn7 · 2025-05-28T20:06:07Z

content/en/agent/configuration/fips-compliance.md

@@ -65,6 +68,26 @@ The Datadog FIPS Agent does **not** support the following:

 [1]: https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/fips-140-validation
 {{% /tab %}}
+
+{{% tab "AWS Lambda" %}}
+Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:


The preface This includes, but is not limited to, the following requirements: should be probably be listed for all tabs and may need a bit of nuance. Maybe something like this (in bold):

The following prerequisites are only a rough guideline of the additional controls required for the compliance of the deployed system. Based on the nature of data being processed, the compliance level being targeted, the deployment environments, as well as many other factors, the compliance needs are likely to be unique in most circumstances. Because of this, it is the customer's responsibility to evaluate their needs and ensure overall system compliance.

Should this section be removed since the alert note is listed up above?

sgnn7 · 2025-05-28T20:09:52Z

content/en/data_security/agent.md

@@ -92,7 +92,7 @@ For more information, see the [Secrets Management][14] documentation.

 {{< site-region region="gov" >}}

-Agent on non-government sites collects environmental, performance, and feature usage information about the Datadog Agent. When the Agent detects a government site, or the [Datadog Agent FIPS Proxy][1] is used, the Agent automatically disables this telemetry collection. When such detection is impossible (for example, if a proxy is being used), Agent telemetry is emitted, but immediately dropped at Datadog's intake. To avoid this data from being emitted in the first place, Datadog recommends disabling Agent telemetry explicitly by updating the `agent_telemetry` setting in the Agent configuration file, as shown in the example below.
+Agent on non-government sites collects environmental, performance, and feature usage information about the Datadog Agent. When the Agent detects a government site, or a [FIPS compliant Agent installation][1] is used, the Agent automatically disables this telemetry collection. When such detection is impossible (for example, if a proxy is being used), Agent telemetry is emitted, but immediately dropped at Datadog's intake. To avoid this data from being emitted in the first place, Datadog recommends disabling Agent telemetry explicitly by updating the `agent_telemetry` setting in the Agent configuration file, as shown in the example below.


@misteriaud Can you link where this is the case? I don't remember us explicitly working on this but I could be wrong.

iadjivon

I see that there are changes made to spanish, french, japanese, and korean versions of the document as well. This is not needed as there is a process that translates the English changes. Would you revert these changes? Thanks in advance and let me know if you have any questions!

content/en/agent/configuration/fips-compliance.md

….riaud/update_fips_documentation

iadjivon

Hi Maxime! 👋🏾
Made some quick notes to the content but overall great! Lmk if you have any questions!

iadjivon · 2025-06-27T18:35:26Z

content/en/agent/configuration/fips-compliance.md


 ## Prerequisites
+<div class="alert alert-warning">
+The following prerequisites are only a rough guideline of the additional controls required for the compliance of the deployed system. Based on the nature of data being processed, the compliance level being targeted, the deployment environments, as well as many other factors, the compliance needs are likely to be unique in most circumstances. Because of this, it is the customer's responsibility to evaluate their needs and ensure overall system compliance.


Suggested change

The following prerequisites are only a rough guideline of the additional controls required for the compliance of the deployed system. Based on the nature of data being processed, the compliance level being targeted, the deployment environments, as well as many other factors, the compliance needs are likely to be unique in most circumstances. Because of this, it is the customer's responsibility to evaluate their needs and ensure overall system compliance.

The following prerequisites are a rough guideline of the additional controls required for the compliance of the deployed system. The compliance needs are likely to be unique in most circumstances. It is therefore the customer's responsibility to evaluate their needs and ensure overall system compliance.

iadjivon · 2025-06-27T18:38:53Z

content/en/agent/configuration/fips-compliance.md

@@ -65,6 +68,26 @@ The Datadog FIPS Agent does **not** support the following:

 [1]: https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/fips-140-validation
 {{% /tab %}}
+
+{{% tab "AWS Lambda" %}}
+Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:


Should this section be removed since the alert note is listed up above?

iadjivon · 2025-06-27T18:45:41Z

content/en/agent/configuration/fips-compliance.md


 ## Prerequisites
+<div class="alert alert-warning">
+The following prerequisites are only a rough guideline of the additional controls required for the compliance of the deployed system. Based on the nature of data being processed, the compliance level being targeted, the deployment environments, as well as many other factors, the compliance needs are likely to be unique in most circumstances. Because of this, it is the customer's responsibility to evaluate their needs and ensure overall system compliance.
+</div>



It might be worth it to add a line here, not in the alert div, that reads something like:
The following are generally requirement for each OS, your system may require additional controls:

In case the reader gloss over the alert box, seeing that their system may require additional controls may help.

iadjivon · 2025-06-27T18:46:10Z

content/en/agent/configuration/fips-compliance.md

+{{% /tab %}}
+
+{{% tab "AWS EKS" %}}
+Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:


Suggested change

Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:

Should this section be removed since the alert note is listed up above?

iadjivon · 2025-06-27T18:46:42Z

content/en/agent/configuration/fips-compliance.md

+{{% /tab %}}
+
+{{% tab "AWS ECS" %}}
+Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:


Suggested change

Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:

Should this section be removed since the alert note is listed up above?

iadjivon · 2025-06-27T18:57:20Z

content/en/agent/configuration/fips-compliance.md

+```yaml
+datadog:
+   site: "ddog-gov.com"
+useFIPSAgent: true


Suggested change

useFIPSAgent: true

useFIPSAgent: true

Is the indentation here correct?

iadjivon · 2025-06-27T19:00:41Z

content/en/agent/faq/fips_proxy.md

@@ -188,10 +188,132 @@ The `use_https` option is set to `false` because the Agent uses HTTP to communic
 {{% /tab %}}

 {{% tab "Amazon ECS" %}}
+To install the FIPS proxy on Amazon ECS, follow the [Datadog Agent ECS Integrations guide](/containers/amazon_ecs/#fips-proxy-for-govcloud-environments). 
+
+Ensure you add the `fips-proxy` sidecar container to your ECS task definition. Also, open the required container ports (9803–9818) to enable communication for all [supported features][#supported-platforms-and-limitations].


Suggested change

Ensure you add the `fips-proxy` sidecar container to your ECS task definition. Also, open the required container ports (9803–9818) to enable communication for all [supported features][#supported-platforms-and-limitations].

Ensure you add the `fips-proxy` sidecar container to your ECS task definition. Also, open the required container ports (9803–9818) to enable communication for all [supported features](#supported-platforms-and-limitations).

iadjivon · 2025-06-27T19:02:25Z

content/en/agent/faq/fips_proxy.md

-For instructions on installing the FIPS proxy on Amazon ECS, see [FIPS proxy for GOVCLOUD environments][1].
-
-[1]: /containers/amazon_ecs/#fips-proxy-for-govcloud-environments
+You also need to update the environment variables of the Datadog Agent's container to enable sending traffic through the FIPS proxy:


Suggested change

You also need to update the environment variables of the Datadog Agent's container to enable sending traffic through the FIPS proxy:

You must also update the environment variables of the Datadog Agent's container to enable sending traffic through the FIPS proxy:

iadjivon · 2025-06-27T19:08:49Z

content/en/containers/amazon_ecs/_index.md

+{{% site-region region="gov" %}}
+## FIPS Compliance
+
+Some setup steps are different for FIPS compliance. Please take into account the specific setup instructions in the [FIPS Compliance][32] documentation.


Suggested change

Some setup steps are different for FIPS compliance. Please take into account the specific setup instructions in the [FIPS Compliance][32] documentation.

Some setup steps are different for FIPS compliance. Please take into account the specific setup instructions in the [FIPS Compliance][32] documentation.

[32]: /agent/configuration/fips-compliance/

Just a quick note that links need to be enclosed within the section when it comes to tabs or region-specific content like this one. Otherwise, the link brinks in the UI.

iadjivon · 2025-06-27T19:12:36Z

content/en/data_security/agent.md

@@ -92,7 +92,7 @@ For more information, see the [Secrets Management][14] documentation.

 {{< site-region region="gov" >}}

-Agent on non-government sites collects environmental, performance, and feature usage information about the Datadog Agent. When the Agent detects a government site, or the [Datadog Agent FIPS Proxy][1] is used, the Agent automatically disables this telemetry collection. When such detection is impossible (for example, if a proxy is being used), Agent telemetry is emitted, but immediately dropped at Datadog's intake. To avoid this data from being emitted in the first place, Datadog recommends disabling Agent telemetry explicitly by updating the `agent_telemetry` setting in the Agent configuration file, as shown in the example below.
+Agent on non-government sites collects environmental, performance, and feature usage information about the Datadog Agent. When the Agent detects a government site, or a [FIPS compliant Agent installation][1] is used, the Agent automatically disables this telemetry collection. When such detection is impossible (for example, if a proxy is being used), Agent telemetry is emitted, but immediately dropped at Datadog's intake. To avoid this data from being emitted in the first place, Datadog recommends disabling Agent telemetry explicitly by updating the `agent_telemetry` setting in the Agent configuration file, as shown in the example below.


Suggested change

Agent on non-government sites collects environmental, performance, and feature usage information about the Datadog Agent. When the Agent detects a government site, or a [FIPS compliant Agent installation][1] is used, the Agent automatically disables this telemetry collection. When such detection is impossible (for example, if a proxy is being used), Agent telemetry is emitted, but immediately dropped at Datadog's intake. To avoid this data from being emitted in the first place, Datadog recommends disabling Agent telemetry explicitly by updating the `agent_telemetry` setting in the Agent configuration file, as shown in the example below.

Agent on non-government sites collects environmental, performance, and feature usage information about the Datadog Agent. When the Agent detects a government site, or when a [FIPS compliant Agent installation][1] is used, the Agent automatically disables this telemetry collection. When such detection is impossible (for example, if a proxy is being used), Agent telemetry is emitted, but immediately dropped at Datadog's intake.

To avoid this data from being emitted in the first place, Datadog recommends disabling Agent telemetry explicitly by updating the `agent_telemetry` setting in the Agent configuration file, as shown in the example below.

Just a small suggestion here

misteriaud added 7 commits May 26, 2025 15:59

update ECS documentation to refer to FIPS Compliance page

d7ce40c

mention all FIPS Agent installation in Telemetry collection

ee37331

improve FIPS Compliance page

2925fe4

adding DDOT to not supported feature, and ECS/EKS details

2ed6700

refine and improve consistency

25521db

Merge branch 'master' of github.com:DataDog/documentation into maxime…

8e66b53

….riaud/update_fips_documentation

cleanup links and add pictures description

9dc373d

restore .vscode file

4d03d24

misteriaud force-pushed the maxime.riaud/update_fips_documentation branch from 13c5575 to 4d03d24 Compare May 28, 2025 12:48

misteriaud marked this pull request as ready for review May 28, 2025 12:49

misteriaud requested a review from a team as a code owner May 28, 2025 12:49

misteriaud changed the title ~~update ECS documentation to refer to FIPS Compliance page~~ Add AWS Lambda/ECS/EKS methods to FIPS Compliance documentation May 28, 2025

drichards-87 added the editorial review label May 28, 2025

sgnn7 reviewed May 28, 2025

View reviewed changes

iadjivon requested changes Jun 5, 2025

View reviewed changes

content/en/agent/configuration/fips-compliance.md Outdated Show resolved Hide resolved

misteriaud added 5 commits June 24, 2025 11:55

reset non-english doc

b91320b

improve FIPS compliance disclaimer note

a3c6203

moving ECS FIPS Proxy documentation to fips-proxy page

3eca5cc

Merge branch 'master' of github.com:DataDog/documentation into maxime…

2bde33a

….riaud/update_fips_documentation

update fips-proxy image version

5d46383

github-actions bot added the FAQ label Jun 24, 2025

misteriaud and others added 3 commits June 27, 2025 17:08

Merge branch 'master' into maxime.riaud/update_fips_documentation

efebb5e

fixing wrong tab tag

6e20573

move the callout under prerequisite header

45b72c2

iadjivon reviewed Jun 27, 2025

View reviewed changes

	Ensure you add the `fips-proxy` sidecar container to your ECS task definition. Also, open the required container ports (9803–9818) to enable communication for all [supported features][#supported-platforms-and-limitations].
	Ensure you add the `fips-proxy` sidecar container to your ECS task definition. Also, open the required container ports (9803–9818) to enable communication for all [supported features](#supported-platforms-and-limitations).

	You also need to update the environment variables of the Datadog Agent's container to enable sending traffic through the FIPS proxy:
	You must also update the environment variables of the Datadog Agent's container to enable sending traffic through the FIPS proxy:

Add AWS Lambda/ECS/EKS methods to FIPS Compliance documentation #29539

Are you sure you want to change the base?

Add AWS Lambda/ECS/EKS methods to FIPS Compliance documentation #29539

Uh oh!

Conversation

misteriaud commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do? What is the motivation?

Merge instructions

Additional notes

Uh oh!

github-actions bot commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Documentation Team Review Required

Uh oh!

github-actions bot commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview links (active after the build_preview check completes)

Modified Files

Uh oh!

drichards-87 commented May 28, 2025

Uh oh!

sgnn7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iadjivon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

iadjivon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

misteriaud commented May 26, 2025 •

edited

Loading

github-actions bot commented May 28, 2025 •

edited

Loading

github-actions bot commented May 28, 2025 •

edited

Loading

Preview links (active after the `build_preview` check completes)