add DD_AWS_USE_NON_FIPS_ENDPOINTS env var to opt out of fips endpoints

Author: nhulston

datadog_lambda/api.py

@@ -66,10 +66,14 @@ def get_api_key() -> str:
 
     REGION = os.environ.get("AWS_REGION", "")
     is_gov_region = REGION.startswith("us-gov-")
+    use_non_fips_endpoints = os.environ.get("DD_AWS_USE_NON_FIPS_ENDPOINTS", "").lower() == "true"
 
     if DD_API_KEY_SECRET_ARN:
-        # Secrets manager endpoints: https://docs.aws.amazon.com/general/latest/gr/asm.html
-        fips_endpoint = f"https://secretsmanager-fips.{REGION}.amazonaws.com" if is_gov_region else None
+        if is_gov_region and not use_non_fips_endpoints:
+            # Secrets manager endpoints: https://docs.aws.amazon.com/general/latest/gr/asm.html
+            fips_endpoint = f"https://secretsmanager-fips.{REGION}.amazonaws.com"
+        else:
+            fips_endpoint = None
         secrets_manager_client = boto3.client(
             "secretsmanager",
             endpoint_url=fips_endpoint
@@ -78,8 +82,11 @@ def get_api_key() -> str:
             SecretId=DD_API_KEY_SECRET_ARN
         )["SecretString"]
     elif DD_API_KEY_SSM_NAME:
-        # SSM endpoints: https://docs.aws.amazon.com/general/latest/gr/ssm.html
-        fips_endpoint = f"https://ssm-fips.{REGION}.amazonaws.com" if is_gov_region else None
+        if is_gov_region and not use_non_fips_endpoints:
+            # SSM endpoints: https://docs.aws.amazon.com/general/latest/gr/ssm.html
+            fips_endpoint = f"https://ssm-fips.{REGION}.amazonaws.com"
+        else:
+            fips_endpoint = None
         ssm_client = boto3.client(
             "ssm",
             endpoint_url=fips_endpoint
@@ -88,8 +95,11 @@ def get_api_key() -> str:
             Name=DD_API_KEY_SSM_NAME, WithDecryption=True
         )["Parameter"]["Value"]
     elif DD_KMS_API_KEY:
-        # KMS endpoints: https://docs.aws.amazon.com/general/latest/gr/kms.html
-        fips_endpoint = f"https://kms-fips.{REGION}.amazonaws.com" if is_gov_region else None
+        if is_gov_region and not use_non_fips_endpoints:
+            # KMS endpoints: https://docs.aws.amazon.com/general/latest/gr/kms.html
+            fips_endpoint = f"https://kms-fips.{REGION}.amazonaws.com"
+        else:
+            fips_endpoint = None
         kms_client = boto3.client(
             "kms",
             endpoint_url=fips_endpoint