feat: Add a changelog for the v5

Signed-off-by: Vincent Boutour <vincent.boutour@datadoghq.com>

Author: ViBiOh

aws/logs_monitoring/CHANGELOG.md

@@ -0,0 +1,118 @@
+# Datadog Lambda Forwarder Changelog
+
+## v5.0.0 - BREAKING CHANGES
+
+### Overview
+
+Version 5.0.0 of the Datadog Lambda Forwarder introduces several breaking changes that remove deprecated features and improve log filtering behavior. This release simplifies the forwarder configuration and aligns with modern AWS integration patterns.
+
+### Breaking Changes
+
+#### 1. Removed TCP Transport Support
+
+**What Changed:**
+
+- Removed the `DD_USE_TCP` / `DdUseTcp` environment variable and parameter
+- Deleted the TCP client implementation
+- All logs now **must** be sent via HTTP/HTTPS
+
+**Migration Required:**
+
+- Remove any configuration setting `DD_USE_TCP=true` or `DdUseTcp=true`
+- The forwarder will now exclusively use HTTP transport
+- If you were using TCP with custom ports (10516), these configurations will be ignored
+- The default HTTP endpoint is now `http-intake.logs.<DD_SITE>` on port 443
+
+---
+
+#### 2. Removed Deprecated PrivateLink Environment Variable
+
+**What Changed:**
+
+- Removed the `DD_USE_PRIVATE_LINK` / `DdUsePrivateLink` environment variable and parameter
+
+**Migration Required:**
+
+- Remove any configuration setting `DD_USE_PRIVATE_LINK=true`
+- **AWS PrivateLink is still fully supported**, but you must follow [PrivateLink documentation](https://docs.datadoghq.com/agent/guide/private-link/):
+    1. Set up VPC endpoints for `api`, `http-logs.intake`, and `trace.agent` as documented
+    2. Configure the forwarder with `DdUseVPC=true`
+    3. Set `VPCSecurityGroupIds` and `VPCSubnetIds`
+
+**Why This Changed:**
+
+- The variable was deprecated since 4 years, we use the major release opportunity to cleanup with a breaking change.
+
+---
+
+#### 3. Changed Regex Matching Behavior for Log Filtering
+
+**What Changed:**
+
+- `IncludeAtMatch` / `INCLUDE_AT_MATCH` and `ExcludeAtMatch` / `EXCLUDE_AT_MATCH` regex patterns now match **only against the log message** itself
+- Previously, these patterns matched against the **entire JSON-formatted log**
+
+**Migration Required:**
+
+- **Review and update your filtering regex patterns**
+- If your patterns relied on matching against JSON structure or metadata fields, they will need to be rewritten
+- Example changes needed:
+    - **Before (v4)**: `\"awsRegion\":\"us-east-1\"` (matched JSON with escaped quotes)
+    - **After (v5)**: `"awsRegion":"us-east-1"` (matches the message content directly)
+- Patterns that matched the `message` field content should continue to work with minimal changes
+
+---
+
+### New Features
+
+#### 4. Backend Storage Tag Enrichment
+
+**Added:**
+
+- New `DD_ENRICH_S3_TAGS` / `DdEnrichS3Tags` parameter (default: `true`)
+- New `DD_ENRICH_CLOUDWATCH_TAGS` / `DdEnrichCloudwatchTags` parameter (default: `true`)
+- These instruct the Datadog backend to automatically enrich logs with resource tags **after ingestion**
+- New cloudwatch tags can appear on logs, check your Datadog log index configuration to ensure smooth transition.
+
+**Benefits:**
+
+- **Reduces forwarder cost** and execution time
+- Provides the same tag enrichment as `DdFetchS3Tags` and `DdFetchLogGroupTags`
+- Requires [Resource Collection](https://docs.datadoghq.com/integrations/amazon-web-services/#resource-collection) enabled in your AWS integration
+
+**Deprecation Notice:**
+
+- `DdFetchS3Tags` is now marked as **DEPRECATED** in favor of `DdEnrichS3Tags`
+- `DdFetchLogGroupTags` is now marked as **DEPRECATED** in favor of `DdEnrichCloudwatchTags`
+- `DD_FETCH_S3_TAGS` now defaults to `false` (previously `true`)
+
+---
+
+### Upgrade Instructions
+
+#### Pre-Upgrade Checklist
+
+1. **Verify you're not using TCP transport:**
+
+    ```bash
+    aws lambda get-function-configuration --function-name "<YOUR_FORWARDER>" --query 'Environment.Variables.DD_USE_TCP'
+    ```
+
+2. **Verify you're not using the deprecated PrivateLink variable:**
+
+    ```bash
+    aws lambda get-function-configuration --function-name "<YOUR_FORWARDER>" --query 'Environment.Variables.DD_USE_PRIVATE_LINK'
+    ```
+
+3. **Review your log filtering patterns:**
+    - If using `IncludeAtMatch` or `ExcludeAtMatch`, test your patterns against log messages only
+    - Remove any JSON escaping (e.g., `\"` → `"`)
+
+#### Testing
+
+After upgrading:
+
+1. Verify logs are being forwarded to Datadog
+2. Check that filtering rules still work as expected
+3. Confirm tag enrichment is working (check logs in Datadog Explorer)
+4. Monitor forwarder execution duration and errors in CloudWatch