Add SSE-KMS encryption fields to ObservabilityPipelineAmazonS3GenericDestination

.generator/schemas/v2/openapi.yaml

@@ -64405,6 +64405,16 @@ components:
         - storage_class
       type: object
       x-pipeline-types: [logs]
+    ObservabilityPipelineAmazonS3DestinationServerSideEncryption:
+      description: Server-side encryption type for Amazon S3.
+      enum:
+        - "aws:kms"
+        - AES256
+      example: "aws:kms"
+      type: string
+      x-enum-varnames:
+        - AWS_KMS
+        - AES256
     ObservabilityPipelineAmazonS3DestinationStorageClass:
       description: S3 storage class.
       enum:
@@ -64559,6 +64569,14 @@ components:
           description: AWS region of the S3 bucket.
           example: "us-east-1"
           type: string
+        server_side_encryption:
+          $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationServerSideEncryption"
+        ssekms_key_id:
+          description: |-
+            The AWS KMS key ID used for SSE-KMS encryption.
+            Only applies when `server_side_encryption` is set to `aws:kms`.
+          example: "arn:aws:kms:us-east-1:123456789012:key/mrk-abc123"
+          type: string
         storage_class:
           $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass"
         type:

examples/v2/observability-pipelines/ValidatePipeline_49555714.java

@@ -0,0 +1,120 @@
+// Validate an observability pipeline with amazon_s3_generic destination SSE-KMS encryption returns
+// "OK" response
+
+import com.datadog.api.client.ApiClient;
+import com.datadog.api.client.ApiException;
+import com.datadog.api.client.v2.api.ObservabilityPipelinesApi;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3DestinationServerSideEncryption;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3DestinationStorageClass;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericCompression;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericCompressionGzip;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericCompressionGzipType;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericDestination;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericDestinationType;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericEncoding;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericEncodingJson;
+import com.datadog.api.client.v2.model.ObservabilityPipelineAmazonS3GenericEncodingJsonType;
+import com.datadog.api.client.v2.model.ObservabilityPipelineConfig;
+import com.datadog.api.client.v2.model.ObservabilityPipelineConfigDestinationItem;
+import com.datadog.api.client.v2.model.ObservabilityPipelineConfigProcessorGroup;
+import com.datadog.api.client.v2.model.ObservabilityPipelineConfigProcessorItem;
+import com.datadog.api.client.v2.model.ObservabilityPipelineConfigSourceItem;
+import com.datadog.api.client.v2.model.ObservabilityPipelineDataAttributes;
+import com.datadog.api.client.v2.model.ObservabilityPipelineDatadogAgentSource;
+import com.datadog.api.client.v2.model.ObservabilityPipelineDatadogAgentSourceType;
+import com.datadog.api.client.v2.model.ObservabilityPipelineFilterProcessor;
+import com.datadog.api.client.v2.model.ObservabilityPipelineFilterProcessorType;
+import com.datadog.api.client.v2.model.ObservabilityPipelineSpec;
+import com.datadog.api.client.v2.model.ObservabilityPipelineSpecData;
+import com.datadog.api.client.v2.model.ValidationResponse;
+import java.util.Collections;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = ApiClient.getDefaultApiClient();
+    ObservabilityPipelinesApi apiInstance = new ObservabilityPipelinesApi(defaultClient);
+
+    ObservabilityPipelineSpec body =
+        new ObservabilityPipelineSpec()
+            .data(
+                new ObservabilityPipelineSpecData()
+                    .attributes(
+                        new ObservabilityPipelineDataAttributes()
+                            .config(
+                                new ObservabilityPipelineConfig()
+                                    .destinations(
+                                        Collections.singletonList(
+                                            new ObservabilityPipelineConfigDestinationItem(
+                                                new ObservabilityPipelineAmazonS3GenericDestination()
+                                                    .id("generic-s3-destination")
+                                                    .inputs(
+                                                        Collections.singletonList(
+                                                            "my-processor-group"))
+                                                    .type(
+                                                        ObservabilityPipelineAmazonS3GenericDestinationType
+                                                            .GENERIC_ARCHIVES_S3)
+                                                    .bucket("my-bucket")
+                                                    .region("us-east-1")
+                                                    .storageClass(
+                                                        ObservabilityPipelineAmazonS3DestinationStorageClass
+                                                            .STANDARD)
+                                                    .encoding(
+                                                        new ObservabilityPipelineAmazonS3GenericEncoding(
+                                                            new ObservabilityPipelineAmazonS3GenericEncodingJson()
+                                                                .type(
+                                                                    ObservabilityPipelineAmazonS3GenericEncodingJsonType
+                                                                        .JSON)))
+                                                    .compression(
+                                                        new ObservabilityPipelineAmazonS3GenericCompression(
+                                                            new ObservabilityPipelineAmazonS3GenericCompressionGzip()
+                                                                .algorithm(
+                                                                    ObservabilityPipelineAmazonS3GenericCompressionGzipType
+                                                                        .GZIP)
+                                                                .level(6L)))
+                                                    .serverSideEncryption(
+                                                        ObservabilityPipelineAmazonS3DestinationServerSideEncryption
+                                                            .AWS_KMS)
+                                                    .ssekmsKeyId(
+                                                        "arn:aws:kms:us-east-1:123456789012:key/mrk-abc123"))))
+                                    .processorGroups(
+                                        Collections.singletonList(
+                                            new ObservabilityPipelineConfigProcessorGroup()
+                                                .enabled(true)
+                                                .id("my-processor-group")
+                                                .include("service:my-service")
+                                                .inputs(
+                                                    Collections.singletonList(
+                                                        "datadog-agent-source"))
+                                                .processors(
+                                                    Collections.singletonList(
+                                                        new ObservabilityPipelineConfigProcessorItem(
+                                                            new ObservabilityPipelineFilterProcessor()
+                                                                .enabled(true)
+                                                                .id("filter-processor")
+                                                                .include("status:error")
+                                                                .type(
+                                                                    ObservabilityPipelineFilterProcessorType
+                                                                        .FILTER))))))
+                                    .sources(
+                                        Collections.singletonList(
+                                            new ObservabilityPipelineConfigSourceItem(
+                                                new ObservabilityPipelineDatadogAgentSource()
+                                                    .id("datadog-agent-source")
+                                                    .type(
+                                                        ObservabilityPipelineDatadogAgentSourceType
+                                                            .DATADOG_AGENT)))))
+                            .name("Pipeline with S3 Generic SSE-KMS"))
+                    .type("pipelines"));
+
+    try {
+      ValidationResponse result = apiInstance.validatePipeline(body);
+      System.out.println(result);
+    } catch (ApiException e) {
+      System.err.println("Exception when calling ObservabilityPipelinesApi#validatePipeline");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}

src/main/java/com/datadog/api/client/v2/model/ObservabilityPipelineAmazonS3DestinationServerSideEncryption.java

@@ -0,0 +1,67 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2019-Present Datadog, Inc.
+ */
+
+package com.datadog.api.client.v2.model;
+
+import com.datadog.api.client.ModelEnum;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/** Server-side encryption type for Amazon S3. */
+@JsonSerialize(
+    using =
+        ObservabilityPipelineAmazonS3DestinationServerSideEncryption
+            .ObservabilityPipelineAmazonS3DestinationServerSideEncryptionSerializer.class)
+public class ObservabilityPipelineAmazonS3DestinationServerSideEncryption
+    extends ModelEnum<String> {
+
+  private static final Set<String> allowedValues =
+      new HashSet<String>(Arrays.asList("aws:kms", "AES256"));
+
+  public static final ObservabilityPipelineAmazonS3DestinationServerSideEncryption AWS_KMS =
+      new ObservabilityPipelineAmazonS3DestinationServerSideEncryption("aws:kms");
+  public static final ObservabilityPipelineAmazonS3DestinationServerSideEncryption AES256 =
+      new ObservabilityPipelineAmazonS3DestinationServerSideEncryption("AES256");
+
+  ObservabilityPipelineAmazonS3DestinationServerSideEncryption(String value) {
+    super(value, allowedValues);
+  }
+
+  public static class ObservabilityPipelineAmazonS3DestinationServerSideEncryptionSerializer
+      extends StdSerializer<ObservabilityPipelineAmazonS3DestinationServerSideEncryption> {
+    public ObservabilityPipelineAmazonS3DestinationServerSideEncryptionSerializer(
+        Class<ObservabilityPipelineAmazonS3DestinationServerSideEncryption> t) {
+      super(t);
+    }
+
+    public ObservabilityPipelineAmazonS3DestinationServerSideEncryptionSerializer() {
+      this(null);
+    }
+
+    @Override
+    public void serialize(
+        ObservabilityPipelineAmazonS3DestinationServerSideEncryption value,
+        JsonGenerator jgen,
+        SerializerProvider provider)
+        throws IOException, JsonProcessingException {
+      jgen.writeObject(value.value);
+    }
+  }
+
+  @JsonCreator
+  public static ObservabilityPipelineAmazonS3DestinationServerSideEncryption fromValue(
+      String value) {
+    return new ObservabilityPipelineAmazonS3DestinationServerSideEncryption(value);
+  }
+}

src/main/java/com/datadog/api/client/v2/model/ObservabilityPipelineAmazonS3GenericDestination.java

@@ -35,6 +35,8 @@
   ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_INPUTS,
   ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_KEY_PREFIX,
   ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_REGION,
+  ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_SERVER_SIDE_ENCRYPTION,
+  ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_SSEKMS_KEY_ID,
   ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_STORAGE_CLASS,
   ObservabilityPipelineAmazonS3GenericDestination.JSON_PROPERTY_TYPE
 })
@@ -72,6 +74,12 @@ public class ObservabilityPipelineAmazonS3GenericDestination {
   public static final String JSON_PROPERTY_REGION = "region";
   private String region;
 
+  public static final String JSON_PROPERTY_SERVER_SIDE_ENCRYPTION = "server_side_encryption";
+  private ObservabilityPipelineAmazonS3DestinationServerSideEncryption serverSideEncryption;
+
+  public static final String JSON_PROPERTY_SSEKMS_KEY_ID = "ssekms_key_id";
+  private String ssekmsKeyId;
+
   public static final String JSON_PROPERTY_STORAGE_CLASS = "storage_class";
   private ObservabilityPipelineAmazonS3DestinationStorageClass storageClass;
 
@@ -328,6 +336,55 @@ public void setRegion(String region) {
     this.region = region;
   }
 
+  public ObservabilityPipelineAmazonS3GenericDestination serverSideEncryption(
+      ObservabilityPipelineAmazonS3DestinationServerSideEncryption serverSideEncryption) {
+    this.serverSideEncryption = serverSideEncryption;
+    this.unparsed |= !serverSideEncryption.isValid();
+    return this;
+  }
+
+  /**
+   * Server-side encryption type for Amazon S3.
+   *
+   * @return serverSideEncryption
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_SERVER_SIDE_ENCRYPTION)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public ObservabilityPipelineAmazonS3DestinationServerSideEncryption getServerSideEncryption() {
+    return serverSideEncryption;
+  }
+
+  public void setServerSideEncryption(
+      ObservabilityPipelineAmazonS3DestinationServerSideEncryption serverSideEncryption) {
+    if (!serverSideEncryption.isValid()) {
+      this.unparsed = true;
+    }
+    this.serverSideEncryption = serverSideEncryption;
+  }
+
+  public ObservabilityPipelineAmazonS3GenericDestination ssekmsKeyId(String ssekmsKeyId) {
+    this.ssekmsKeyId = ssekmsKeyId;
+    return this;
+  }
+
+  /**
+   * The AWS KMS key ID used for SSE-KMS encryption. Only applies when <code>server_side_encryption
+   * </code> is set to <code>aws:kms</code>.
+   *
+   * @return ssekmsKeyId
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_SSEKMS_KEY_ID)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public String getSsekmsKeyId() {
+    return ssekmsKeyId;
+  }
+
+  public void setSsekmsKeyId(String ssekmsKeyId) {
+    this.ssekmsKeyId = ssekmsKeyId;
+  }
+
   public ObservabilityPipelineAmazonS3GenericDestination storageClass(
       ObservabilityPipelineAmazonS3DestinationStorageClass storageClass) {
     this.storageClass = storageClass;
@@ -449,6 +506,11 @@ public boolean equals(Object o) {
         && Objects.equals(this.inputs, observabilityPipelineAmazonS3GenericDestination.inputs)
         && Objects.equals(this.keyPrefix, observabilityPipelineAmazonS3GenericDestination.keyPrefix)
         && Objects.equals(this.region, observabilityPipelineAmazonS3GenericDestination.region)
+        && Objects.equals(
+            this.serverSideEncryption,
+            observabilityPipelineAmazonS3GenericDestination.serverSideEncryption)
+        && Objects.equals(
+            this.ssekmsKeyId, observabilityPipelineAmazonS3GenericDestination.ssekmsKeyId)
         && Objects.equals(
             this.storageClass, observabilityPipelineAmazonS3GenericDestination.storageClass)
         && Objects.equals(this.type, observabilityPipelineAmazonS3GenericDestination.type)
@@ -470,6 +532,8 @@ public int hashCode() {
         inputs,
         keyPrefix,
         region,
+        serverSideEncryption,
+        ssekmsKeyId,
         storageClass,
         type,
         additionalProperties);
@@ -489,6 +553,10 @@ public String toString() {
     sb.append("    inputs: ").append(toIndentedString(inputs)).append("\n");
     sb.append("    keyPrefix: ").append(toIndentedString(keyPrefix)).append("\n");
     sb.append("    region: ").append(toIndentedString(region)).append("\n");
+    sb.append("    serverSideEncryption: ")
+        .append(toIndentedString(serverSideEncryption))
+        .append("\n");
+    sb.append("    ssekmsKeyId: ").append(toIndentedString(ssekmsKeyId)).append("\n");
     sb.append("    storageClass: ").append(toIndentedString(storageClass)).append("\n");
     sb.append("    type: ").append(toIndentedString(type)).append("\n");
     sb.append("    additionalProperties: ")

src/test/resources/cassettes/features/v2/Validate_an_observability_pipeline_with_amazon_s3_generic_destination_SSE_KMS_encryption_returns_OK_response.freeze

@@ -0,0 +1 @@
+2026-06-29T12:00:00.000Z

src/test/resources/cassettes/features/v2/Validate_an_observability_pipeline_with_amazon_s3_generic_destination_SSE_KMS_encryption_returns_OK_response.json

@@ -0,0 +1,32 @@
+[
+  {
+    "httpRequest": {
+      "body": {
+        "type": "JSON",
+        "json": "{\"data\":{\"attributes\":{\"config\":{\"destinations\":[{\"bucket\":\"my-bucket\",\"compression\":{\"algorithm\":\"gzip\",\"level\":6},\"encoding\":{\"type\":\"json\"},\"id\":\"generic-s3-destination\",\"inputs\":[\"my-processor-group\"],\"region\":\"us-east-1\",\"server_side_encryption\":\"aws:kms\",\"ssekms_key_id\":\"arn:aws:kms:us-east-1:123456789012:key/mrk-abc123\",\"storage_class\":\"STANDARD\",\"type\":\"amazon_s3_generic\"}],\"processor_groups\":[{\"enabled\":true,\"id\":\"my-processor-group\",\"include\":\"service:my-service\",\"inputs\":[\"datadog-agent-source\"],\"processors\":[{\"enabled\":true,\"id\":\"filter-processor\",\"include\":\"status:error\",\"type\":\"filter\"}]}],\"sources\":[{\"id\":\"datadog-agent-source\",\"type\":\"datadog_agent\"}]},\"name\":\"Pipeline with S3 Generic SSE-KMS\"},\"type\":\"pipelines\"}}"
+      },
+      "headers": {},
+      "method": "POST",
+      "path": "/api/v2/obs-pipelines/pipelines/validate",
+      "keepAlive": false,
+      "secure": true
+    },
+    "httpResponse": {
+      "body": "{\"errors\":[]}\n",
+      "headers": {
+        "Content-Type": [
+          "application/vnd.api+json"
+        ]
+      },
+      "statusCode": 200,
+      "reasonPhrase": "OK"
+    },
+    "times": {
+      "remainingTimes": 1
+    },
+    "timeToLive": {
+      "unlimited": true
+    },
+    "id": "3ebcfb84-7f20-b291-ecce-ab7e46920009"
+  }
+]

src/test/resources/com/datadog/api/client/v2/api/observability_pipelines.feature

@@ -271,6 +271,14 @@ Feature: Observability Pipelines
     Then the response status is 200 OK
     And the response "errors" has length 0
 
+  @skip @team:DataDog/observability-pipelines
+  Scenario: Validate an observability pipeline with amazon_s3_generic destination SSE-KMS encryption returns "OK" response
+    Given new "ValidatePipeline" request
+    And body with value {"data": {"attributes": {"config": {"destinations": [{"id": "generic-s3-destination", "inputs": ["my-processor-group"], "type": "amazon_s3_generic", "bucket": "my-bucket", "region": "us-east-1", "storage_class": "STANDARD", "encoding": {"type": "json"}, "compression": {"algorithm": "gzip", "level": 6}, "server_side_encryption": "aws:kms", "ssekms_key_id": "arn:aws:kms:us-east-1:123456789012:key/mrk-abc123"}], "processor_groups": [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]}], "sources": [{"id": "datadog-agent-source", "type": "datadog_agent"}]}, "name": "Pipeline with S3 Generic SSE-KMS"}, "type": "pipelines"}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "errors" has length 0
+
   @skip @team:DataDog/observability-pipelines
   Scenario: Validate an observability pipeline with cloud_prem destination buffer returns "OK" response
     Given new "ValidatePipeline" request