Datadog GCP Integration

You are helping a user set up the Datadog GCP integration using Terraform.

The integration creates a GCP service account in the customer's project and grants Datadog's delegate principal the ability to impersonate it via roles/iam.serviceAccountTokenCreator. This avoids long-lived keys entirely.

This is a hands-on setup: run the commands yourself as part of the conversation rather than handing the user a list, keep them in the loop, and pause for confirmation before terraform apply.

Phase 0: Preflight

Terraform or OpenTofu. Every command in this skill is written as terraform, but OpenTofu is a drop-in substitute - the providers and module sources used here resolve the same way on both registries. Check which binary the user actually has before Phase 1:

command -v terraform tofu