Enhance DD_API_KEY_SECRET_ARN description with JSON support

[litianningdatadog]

What does this PR do? What is the motivation?

Merge instructions

Merge readiness:

• Ready for merge

For Datadog employees:

Your branch name MUST follow the <name>/<description> convention and include the forward slash (/). Without this format, your pull request will not pass CI, the GitLab pipeline will not run, and you won't get a branch preview. Getting a branch preview makes it easier for us to check any issues with your PR, such as broken links.

If your branch doesn't follow this format, rename it or create a new branch and PR.

[6/5/2025] Merge queue has been disabled on the documentation repo. If you have write access to the repo, the PR has been reviewed by a Documentation team member, and all of the required checks have passed, you can use the Squash and Merge button to merge the PR. If you don't have write access, or you need help, reach out in the #documentation channel in Slack.

AI assistance

Additional notes

[chatgpt-codex-connector]

💡 Codex Review

documentation/content/en/serverless/guide/agent_configuration.md

Line 15 in 294a32f

| `DD_API_KEY_SECRET_ARN` | The environment variable with your Datadog API key, using an AWS Secrets Manager secret. **One** key environment variable is required. Starting v96, we can now extract the API key from a JSON-formatted Secrets Manager secret. If the secret value is a JSON object containing the field `dd_api_key` (hardcoded, not configurable), its value is used as the API key; otherwise the raw secret string is used as before. See [serverless CLI environment variables][7]. |

Update setup pages that still reject JSON secrets

When this new v96 behavior is published here, users following the primary Lambda setup pages still get the opposite instruction: a repo-wide search shows content/en/serverless/aws_lambda/instrumentation/nodejs.md:221, python.md:211, and many other serverless/application-security pages still say the DD_API_KEY_SECRET_ARN secret must be plaintext “not a JSON blob.” Since those pages are the install paths where users create the secret, leaving them unchanged makes the docs contradictory and will continue steering v96 users away from the newly documented dd_api_key JSON format.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[duncanista]

approving from serverless, lets wait on docs to approve

[estherk15]

Left one suggestion on wording. If it looks ok, I can commit and merge for you. For future docs PRs, can you add a / to your branch name?

[estherk15]

Suggested change

| `DD_API_KEY_SECRET_ARN` | The environment variable with your Datadog API key, using an AWS Secrets Manager secret. **One** key environment variable is required. Starting v96, we can now extract the API key from a JSON-formatted Secrets Manager secret. If the secret value is a JSON object containing the field `dd_api_key` (hardcoded, not configurable), its value is used as the API key; otherwise the raw secret string is used as before. See [serverless CLI environment variables][7]. |

| `DD_API_KEY_SECRET_ARN` | The environment variable with your Datadog API key, using an AWS Secrets Manager secret. **One** key environment variable is required. Starting with version 96, you can extract the API key from a JSON-formatted Secrets Manager secret. If the secret value is a JSON object containing the field `dd_api_key` (hardcoded, not configurable), its value is used as the API key; otherwise the raw secret string is used as the API key. See [Serverless CLI environment variables][7]. |