From f75caa148811175f654844bcf474735f809372a9 Mon Sep 17 00:00:00 2001
From: Olivier John Ndjike Nzia <olivier.ndjikenzia@datadoghq.com>
Date: Wed, 22 Apr 2026 13:26:45 -0400
Subject: [PATCH 1/4] add us-2

---
 scripts/publish_govcloud.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/publish_govcloud.sh b/scripts/publish_govcloud.sh
index 5edd3b08..32dd23d4 100755
--- a/scripts/publish_govcloud.sh
+++ b/scripts/publish_govcloud.sh
@@ -9,7 +9,7 @@
 # Download button on the `layer bundle` job. This will be a zip file containing
 # all of the required layers. Run this script as follows:
 #
-# ENVIRONMENT=[us1-staging-fed or us1-fed] [LAYER_NAME_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud.sh <layer-bundle.zip>
+# ENVIRONMENT=[us1-staging-fed|us1-fed|us2-fed] [LAYER_NAME_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud.sh <layer-bundle.zip>
 #
 # protip: you can drag the zip file from finder into your terminal to insert
 # its path.
@@ -49,9 +49,11 @@ elif [ $ENVIRONMENT = "us1-fed" ]; then
         echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
         exit 1
     fi
+elif [ $ENVIRONMENT = "us2-fed" ]; then
+    AWS_VAULT_ROLE=sso-govcloud-fed-us2-engineering
 
 else
-    printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed or us1-fed.\n"
+    printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed, us1-fed, or us2.\n"
     exit 1
 fi
 

From 4dea0de1220414324cff7a308f9e2710533fe7fa Mon Sep 17 00:00:00 2001
From: Olivier John Ndjike Nzia <olivier.ndjikenzia@datadoghq.com>
Date: Wed, 22 Apr 2026 13:30:07 -0400
Subject: [PATCH 2/4] typo

---
 scripts/publish_govcloud.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/publish_govcloud.sh b/scripts/publish_govcloud.sh
index 32dd23d4..2c3b4fe1 100755
--- a/scripts/publish_govcloud.sh
+++ b/scripts/publish_govcloud.sh
@@ -53,7 +53,7 @@ elif [ $ENVIRONMENT = "us2-fed" ]; then
     AWS_VAULT_ROLE=sso-govcloud-fed-us2-engineering
 
 else
-    printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed, us1-fed, or us2.\n"
+    printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed, us1-fed, or us2-fed.\n"
     exit 1
 fi
 

From d2556ec05cea8eb5cd86286d19134ed1c3370168 Mon Sep 17 00:00:00 2001
From: Olivier John Ndjike Nzia <olivier.ndjikenzia@datadoghq.com>
Date: Fri, 24 Apr 2026 10:07:34 -0400
Subject: [PATCH 3/4] update aws role

---
 scripts/publish_govcloud.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/publish_govcloud.sh b/scripts/publish_govcloud.sh
index 2c3b4fe1..c099a1e0 100755
--- a/scripts/publish_govcloud.sh
+++ b/scripts/publish_govcloud.sh
@@ -50,8 +50,14 @@ elif [ $ENVIRONMENT = "us1-fed" ]; then
         exit 1
     fi
 elif [ $ENVIRONMENT = "us2-fed" ]; then
-    AWS_VAULT_ROLE=sso-govcloud-fed-us2-engineering
+    AWS_VAULT_ROLE=sso-govcloud-fed-us2-lambda-layer-operator
 
+    export STAGE=gov-prod
+
+    if [[ ! "$PACKAGE_NAME" =~ ^datadog_lambda_py-signed-bundle-[0-9]+$ ]]; then
+        echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
+        exit 1
+    fi
 else
     printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed, us1-fed, or us2-fed.\n"
     exit 1

From 81e915c84d744580386008f9bf597e30e42bdfeb Mon Sep 17 00:00:00 2001
From: Olivier John Ndjike Nzia <olivier.ndjikenzia@datadoghq.com>
Date: Fri, 24 Apr 2026 10:28:33 -0400
Subject: [PATCH 4/4] update usage comment

---
 scripts/publish_govcloud.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/publish_govcloud.sh b/scripts/publish_govcloud.sh
index c099a1e0..19c8c17c 100755
--- a/scripts/publish_govcloud.sh
+++ b/scripts/publish_govcloud.sh
@@ -9,7 +9,7 @@
 # Download button on the `layer bundle` job. This will be a zip file containing
 # all of the required layers. Run this script as follows:
 #
-# ENVIRONMENT=[us1-staging-fed|us1-fed|us2-fed] [LAYER_NAME_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud.sh <layer-bundle.zip>
+# CI_COMMIT_TAG=<vX.Y.Z> ENVIRONMENT=[us1-staging-fed|us1-fed|us2-fed] [LAYER_NAME_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud.sh <layer-bundle.zip>
 #
 # protip: you can drag the zip file from finder into your terminal to insert
 # its path.