AWS - SecretsManager API Key extraction doesn't match Managed Secrets Rotation field name (`apiKey`, not `dd_api_key`)

[MrFishFinger]

The Datadog Extension's AWS SecretsManager support (via DD_API_KEY_SECRET_ARN) can't consume Managed Rotation for Datadog Secrets (secret type DatadogApiKey):

That secret's JSON shape is:

{
  "apiKey": "{{32-character hex API key}}",
  "apiKeyId": "{{API key UUID}}"
}

The Datadog Extension's current JSON-secret extraction mechanism looks for a hardcoded dd_api_key field, not apiKey (added in commit 43ff705).

Note that for the Datadog Agent, it is possible to specify the SecretsManager secret name AND the name of the JSON key to use (it uses ENC[secret_id;key] syntax). See code: https://github.com/DataDog/datadog-agent/blob/main/cmd/secret-generic-connector/backend/aws/secrets.go

Would it be possible to adapt this so the Datadog Extension also checks the JSON key name apiKey? or make the JSON key name configurable, similar to the Datadog Agent's ENC[id;key] approach?

[MrFishFinger]

related Issue: #1126 - FYI: @litianningdatadog

[litianningdatadog]

@MrFishFinger Thanks for the report, and for linking #1126 — good catch that AWS's own Managed Rotation for Datadog API Key secret type doesn't match the dd_api_key field we added in #1146. We'll extend the JSON-secret extraction to also recognize apiKey (the field name used by that managed rotation secret type), so both shapes work out of the box. Will follow up here once that's out.