From efbf79798e76dda939dc18af78e84721e342cc05 Mon Sep 17 00:00:00 2001 From: Matthew Bilyeu <1185129+bi1yeu@users.noreply.github.com> Date: Fri, 31 Jul 2026 13:56:41 -0400 Subject: [PATCH 1/3] docs(governance console): generate the available controls list The "All available controls" section was hand-maintained and had drifted from the control definitions: Dashboards with Low Quality Scores, Empty Log Indexes, Inactive Log Pipelines and Unscoped Application Keys were missing, "Inactive Metric Tag" should read "Inactive Metrics Tags", and "Monitors Without Team Tags" is still in development and should not have been published. Replaces the entries with a shortcode over data/governance_controls.json from websites-sources. Each section keeps its own intro prose and collapse-content wrapper, so only the control entries are generated; the shortcode is called once per usage concern. Its markup mirrors what a markdown definition list compiles to, so the entries render as they did before. Enforcement copy now reads "Enforcement: Automatically ..." rather than "Enforcement automatically ...", so the template can use the mitigation description verbatim instead of lowercasing its first character. An unrecognised usage_concern fails the build with the list of valid groups rather than silently rendering an empty section. Environment: Datadog workspace Co-Authored-By: Claude Opus 5 --- .../governance_console/controls.md | 70 ++----------------- .../governance_controls.html | 41 +++++++++++ 2 files changed, 47 insertions(+), 64 deletions(-) create mode 100644 layouts/shortcodes/account_management/governance_controls.html diff --git a/content/en/account_management/governance_console/controls.md b/content/en/account_management/governance_console/controls.md index 4a4bcffce61..1db4afd5722 100644 --- a/content/en/account_management/governance_console/controls.md +++ b/content/en/account_management/governance_console/controls.md @@ -46,85 +46,27 @@ Hover over each detection for options: Controls are organized by usage concern: security, cost optimization, and data hygiene. +
The controls below are generated from the Governance Console control definitions, so this list always reflects the controls that are generally available. Controls still in development are not listed.
+ {{% collapse-content title="Security" level="h3" expanded=false id="security" %}} Security controls detect and correct configuration that could lead to increased risk of a security incident in your Datadog account. -Unused API Keys -: Identifies API keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials. The default threshold is 30 days of inactivity, and can be adjusted.

- - Enforcement automatically identifies and revokes inactive API keys to improve security and reduce potential attack surface. - -Unused Application Keys -: Identifies application keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials. The default threshold is 30 days of inactivity, and can be adjusted.

- - Enforcement automatically identifies and revokes inactive application keys to improve security and reduce potential attack surface. - -Roles Without Users -: Identifies roles that have no active users assigned to them, indicating potential cleanup opportunities.

- - _This control does not support enforcement. Manual removal of unused roles required._ - -Users in No Teams -: Identifies active users that are not in any teams, indicating potential cleanup opportunities.

- - _This control does not support enforcement._ +{{< account_management/governance_controls usage_concern="Security" >}} {{% /collapse-content %}} {{% collapse-content title="Cost optimization" level="h3" expanded=false id="cost-optimization" %}} Cost optimization controls detect and correct configuration that could lead to increased spending on low value usage. -Unqueried Metrics -: Identifies metrics that are rarely or never queried and are not associated with any monitors, dashboards, SLOs, or notebooks, indicating potential cost savings opportunities.

- - Enforcement automatically removes unused metric tags using Metrics without Limits™ to optimize cardinality and reduce costs. - -Inactive Metric Tag -: Identifies metric tags that are rarely or never queried and are not associated with any monitors, dashboards, SLOs, or notebooks, presenting opportunities to reduce cardinality and costs.

- - Enforcement automatically configures Metrics without Limits™ to allowlist only active tags on filtered metrics, optimizing cardinality and cost efficiency. - -Synthetic Tests with Muted Monitors -: Identifies synthetic tests with muted monitors, which may indicate potential cost savings opportunities.

- - _This control does not support enforcement._ +{{< account_management/governance_controls usage_concern="Cost Optimization" >}} {{% /collapse-content %}} {{% collapse-content title="Data hygiene" level="h3" expanded=false id="data-hygiene" %}} Data hygiene controls detect and correct configuration that could lead to increased assets that are low quality or have unclear ownership. -Unused Dashboards -: Identifies dashboards that have not been viewed within your specified time threshold, helping maintain a clean and organized workspace. The default Dashboard Query includes all dashboards, but can be adjusted to select a specific scope of dashboards. The default Dashboard Activity Lookback Period is 30 days of query activity, and can be adjusted.

- - Enforcement automatically deletes dashboards to maintain a clean and organized workspace. - -Dashboards Owned by Disabled Users -: Identifies dashboards whose owner is a disabled user, which may impact dashboard maintenance and updates. The default Dashboard Query includes all dashboards, but can be adjusted to select a specific scope of dashboards.

- - _This control does not support enforcement._ - -Dashboards Without Team Tags -: Identifies dashboards that lack a team tag, making it difficult to track ownership and maintain accountability. The default Dashboard Query includes all dashboards, but can be adjusted to select a specific scope of dashboards. The default Dashboard Activity Lookback Period is 30 days of query activity, and can be adjusted.

- - _This control does not support enforcement._ - -Notebooks Without Team Tags -: Identifies notebooks that lack a team tag, making it difficult to track ownership and maintain accountability.

- - _This control does not support enforcement._ - -Monitors Without Team Tags -: Identifies monitors that lack a team tag, making it difficult to track ownership and maintain accountability.

- - _This control does not support enforcement._ - -Monitors with Broken Notification Handles -: Identifies monitors that contain invalid or broken @-mention handles, which may prevent notifications from reaching the intended recipients.

- - _This control does not support enforcement._ - - {{% /collapse-content %}} +{{< account_management/governance_controls usage_concern="Data Hygiene" >}} +{{% /collapse-content %}} [1]: https://app.datadoghq.com/governance/controls diff --git a/layouts/shortcodes/account_management/governance_controls.html b/layouts/shortcodes/account_management/governance_controls.html new file mode 100644 index 00000000000..53a0c812556 --- /dev/null +++ b/layouts/shortcodes/account_management/governance_controls.html @@ -0,0 +1,41 @@ +{{/* + Renders the Governance Console controls for a single usage concern as a + definition list, from data/governance_controls.json. + + Note: + - json file mounted from websites-sources: https://github.com/ddoghq/websites-sources/tree/main/data/governance_controls.json + - the generator publishes only controls with release_status "prod", and only + mitigations that are not feature flagged, so everything here is available + to every org. + - call this once per section. The intro prose for each section stays in + controls.md; only the control entries are generated. + + @param usage_concern: string - which group to render. One of "Security", + "Cost Optimization" or "Data Hygiene". Must match a + key in the data file. +*/}} + +{{- $usage_concern := .Get "usage_concern" -}} +{{- $controls := index $.Site.Data.governance_controls $usage_concern -}} + +{{- if not $controls -}} + {{- $groups := slice -}} + {{- range $group, $_ := $.Site.Data.governance_controls -}} + {{- $groups = $groups | append $group -}} + {{- end -}} + {{- errorf "governance_controls: no controls found for usage_concern %q in data/governance_controls.json. Available groups: %v" $usage_concern $groups -}} +{{- end -}} + +{{/* Markup mirrors what a markdown definition list compiles to, so the + generated entries render identically to the hand-written ones they + replaced. */}} +
+{{- range $controls }} +
{{ .name }}
+
{{ .description }}

+{{ if .enforcement }}{{ range .enforcement }}

Enforcement: {{ . }}

+{{ end }}{{ else }}

This control does not support enforcement.

+{{ end -}} +
+{{- end }} +
From fdb289351dad85d1f938ac45235137906aa47f5e Mon Sep 17 00:00:00 2001 From: Matthew Bilyeu <1185129+bi1yeu@users.noreply.github.com> Date: Fri, 31 Jul 2026 14:25:14 -0400 Subject: [PATCH 2/3] docs(governance console): drop the generated-list callout Removes the alert box introducing the section as generated. How the list is produced is not something a reader needs to act on, and the page already reads as the authoritative list of available controls. Environment: Datadog workspace Co-Authored-By: Claude Opus 5 --- content/en/account_management/governance_console/controls.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/en/account_management/governance_console/controls.md b/content/en/account_management/governance_console/controls.md index 1db4afd5722..8ab70f3424d 100644 --- a/content/en/account_management/governance_console/controls.md +++ b/content/en/account_management/governance_console/controls.md @@ -46,8 +46,6 @@ Hover over each detection for options: Controls are organized by usage concern: security, cost optimization, and data hygiene. -
The controls below are generated from the Governance Console control definitions, so this list always reflects the controls that are generally available. Controls still in development are not listed.
- {{% collapse-content title="Security" level="h3" expanded=false id="security" %}} Security controls detect and correct configuration that could lead to increased risk of a security incident in your Datadog account. From 4928bccc2ad5603f021587bf0940cb625161935a Mon Sep 17 00:00:00 2001 From: Matthew Bilyeu <1185129+bi1yeu@users.noreply.github.com> Date: Fri, 31 Jul 2026 15:52:27 -0400 Subject: [PATCH 3/3] chore(docs): gitignore the sourced governance controls data data/governance_controls.json is published by websites-sources and mounted from _vendor/data at build time, like permissions.json and workflow_bundles.json. A local copy - from a preview build, say - should never be committed, since it would shadow the sourced file with stale content. Environment: Datadog workspace Co-Authored-By: Claude Opus 5 --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index f9bc4010d69..129e85eed9f 100644 --- a/.gitignore +++ b/.gitignore @@ -274,6 +274,7 @@ data/permissions.json data/agent_config.json data/workflow_bundles.json data/python_action_libs.json +data/governance_controls.json agent_config_types_list.txt