chore: add AWS integration via Terraform example and docs

[shanishiri]

Summary

Adds customer-facing documentation and a runnable example for deploying the Dash0 AWS integration with Terraform's aws_cloudformation_stack resource, pointing at the official v2 CloudFormation template hosted on S3 (dash0-customer-integration-cloudformation-v2.yaml). This is the Terraform counterpart to the Dash0AwsIntegration CDK construct.

The template provisions the IAM roles Dash0 assumes to read telemetry, and — via a self-managed CloudFormation StackSet — per-region resources for the AWS/Lambda namespace (Kinesis Firehose delivery stream + CloudWatch metric stream + S3 backup bucket) and, optionally, an EventBridge rule + ApiDestination + Connection that forward Lambda lifecycle events (UpdateFunctionConfiguration, DeleteFunction) to Dash0 in near real-time.

With template 2.2 (dash0-infrastructure#1193) and the matching control-plane changes (dash0#15193), TechnicalId is optional for IaC onboarding — when omitted or left empty, the template derives the IAM external ID from the CloudFormation stack ID. No Dash0-internal organization identifier is required.

What's included

• docs/guides/aws_cloudformation_integration.md — guide covering prerequisites, CloudFormation parameters, Terraform variables, and step-by-step usage. Documents that:
  • CAPABILITY_AUTO_EXPAND is required (in addition to CAPABILITY_NAMED_IAM) because the template contains a nested AWS::CloudFormation::StackSet
  • Regions is passed as a CommaDelimitedList — the Terraform list variable is join-ed into a comma-separated string
  • TechnicalId is optional; empty value triggers stack-ID fallback (recommended for Terraform)
  • Lambda lifecycle events require a CloudTrail trail logging management events in the selected regions; the template does not create one
  • The StackSet's S3 backup bucket is retained on terraform destroy by design
• docs/index.md — links the new guide
• examples/guides/aws_cloudformation_integration/ — runnable example:
  • main.tf — the aws_cloudformation_stack resource with v2 template URL, all parameters, and both required capabilities
  • variables.tf — including regions, dash0_regional_endpoint, optional technical_id (default ""), plus collect_lambda_lifecycle_events (default "true") and resources_instrumentation (default "true")
  • terraform.tfvars.example — safe placeholder values, no real credentials, no technical_id required

CloudFormation parameters documented

Parameter	Required	Default	Notes
ApiKey	Yes	—	Dash0 API key (auth token), marked sensitive
Regions	Yes	—	Comma-separated regions for AWS/Lambda streaming + lifecycle events
Dash0RegionalEndpoint	Yes	—	Regional ingress base URL (no path/trailing slash); template appends paths internally
TechnicalId	No	""	External ID for IAM role assumption; when empty, template uses CloudFormation stack ID
Dataset	No	default	Target Dash0 dataset
ResourcesInstrumentation	No	"true"	Enable Lambda/resource instrumentation role
CollectLambdaLifecycleEvents	No	"true"	Forward Lambda lifecycle events via EventBridge

Notes

• Not a native Dash0 provider resource — it uses the AWS provider to deploy the CloudFormation stack with Dash0's hosted template.
• The api_key variable is sensitive, so Terraform won't display it in plan/apply output.
• The parent stack is region-specific, but the Regions parameter independently controls which regions the nested StackSet provisions Lambda metrics streaming into.
• Requires template 2.2 deployed to the hosted S3 URL and matching control-plane-api changes for the empty-TechnicalId path to work end-to-end (CLO-906).

Test plan

• Review docs/guides/aws_cloudformation_integration.md for accuracy and completeness
• Review examples/guides/aws_cloudformation_integration/main.tf for correctness
• Verify the v2 S3 template URL resolves correctly
• terraform apply the example against a test AWS account + Dash0 org and confirm:
  • stack + per-region StackSet reach CREATE_COMPLETE with TechnicalId = ""
  • IAM role trust policies use the CloudFormation stack ID as sts:ExternalId
  • integration appears in Dash0 UI
  • second terraform plan shows no changes

[RaphaelManke]

Thats not valid, there is no UI element to get the technical id. Lets discuss if we even need it, or can we derive it from the api key?