Datadog Lambda monitoring for Python: attach the extension layer, not just the forwarder

# Datadog on Lambda (Python): the extension layer is the setup

Two Datadog pieces exist for Lambda and agents mix them up: the **Lambda Extension** (runs alongside your function, ships telemetry directly) and the **Forwarder** (a separate Lambda that tails CloudWatch log groups). For metrics, traces, and enhanced Lambda metrics, you want the extension.

## Setup

1. Attach the Datadog Extension layer to your function. The layer ARN pattern is `arn:aws:lambda:[region]:464622532012:layer:Datadog-Extension:[version]` plus the runtime layer for your language. Use the latest version from the docs, not a version you remember.
2. Set function env vars: `DD_API_KEY` (use Secrets Manager or KMS in prod; plaintext key in the template is flagged in the docs as quick-testing only) and `DD_SITE` matching your org region.
3. Enable the pieces you want: `DD_TRACE_ENABLED=true` for APM, `DD_LOGS_ENABLED` / log forwarding for logs, `DD_ENHANCED_METRICS` for the enhanced Lambda metrics.

The docs show the CloudFormation macro and SAM transform that do all of this for you if you are in CloudFormation/SAM land. One macro install per region, then annotate functions.

## Extension vs forwarder, concretely

- Extension: in-account, no log-group subscription needed, ships metrics/traces/logs straight to Datadog. Cold start cost is small but real; keep the layer version current.
- Forwarder: needed when you want CloudWatch Logs (from any source, not just Lambda) shipped to Datadog, or when you cannot touch the function. It subscribes to log groups, which has account-level subscription filter limits worth knowing about.

You can run both: extension for telemetry, forwarder for the log groups the extension does not cover.

## Verify

Invoke the function, then check Serverless, Functions in the app. You want invocations, duration, and cold starts charting. If the function shows nothing: check the layer actually attached (wrong region in the ARN is common), then the env vars, then the site. APM traces need the tracer library in your code too, the extension alone does not instrument Python.