Update AWS HA autoscale and starter cluster examples to use hardened AMIs with Graviton/ARM64 (#35956)

AWS starter and HA autoscale cluster examples are outdated now that legacy AMIs have been deprecated. Update them to use hardened AMIs and bump AWS terraform provider to v5.x. Graviton is the preferred (and cheaper) platform on EC2, so our documentation /example code should use such instance types. This also means using ARM64 builds as well. Remove the `monitor` role and associated infrastructure (as the new hardened AMIs lack telegraf, influxdb, etc.). s/letsencrypt/Let's Encrypt/ Ref #34282. Ref #36110. Closes #2734. Closes #4756. Closes #4572.
2026-09-21 05:55:42 +08:00 · 2024-01-06 20:03:30 +00:00
parent 6dad93c734
commit a38d3848ee
51 changed files with 155 additions and 950 deletions
@@ -71,7 +71,7 @@ by `insecure-drop`, which still creates temporary users but does not create a
 home directory. Users who need home directory creation should either wrap `useradd`/`userdel`
 or use PAM.

-##### Packages no longer published to legacy Debian and RPM repos
+#### Packages no longer published to legacy Debian and RPM repos

 `deb.releases.teleport.dev` and `rpm.releases.teleport.dev` were deprecated in
 Teleport 11. Beginning in Teleport 15, Debian and RPM packages will no longer be
@@ -167,6 +167,15 @@ perform this step since it must be done by an administrator at installation
 time. As a result, Teleport's service account can use more restrictive
 permissions.

+#### Example AWS cluster deployments updated
+
+The AWS terraform examples for Teleport clusters have been updated to use the
+newer hardened Amazon Linux 2023 AMIs. Additionally, the default architecture
+and instance type has been changed to ARM64/Graviton.
+
+As a result of this modernization, the legacy monitoring stack configuration
+used with the legacy AMIs has been removed.
+
 ## 14.0.0 (09/20/23)

 Teleport 14 brings the following new major features and improvements:
@@ -1,5 +1,5 @@
 #!/bin/bash
-# This script prepares a Letsencrypt certificate before all-in-one Teleport starts for the first time (if needed)
+# This script prepares a Let's Encrypt certificate before all-in-one Teleport starts for the first time (if needed)
 set -e
 if [[ "${DEBUG:-false}" == "true" ]]; then
    set -x
@@ -10,11 +10,11 @@ if [ -f /etc/teleport.d/conf ]; then
    source /etc/teleport.d/conf
 fi

-# check for letsencrypt
+# check for Let's Encrypt
 if [[ "${USE_LETSENCRYPT}" != "true" ]]; then
-    echo "Not using Letsencrypt, exiting with success"
+    echo "Not using Let's Encrypt, exiting with success"
    exit 0
 fi

 # copy certificates into place
-/bin/aws s3 sync --exact-timestamps s3://${TELEPORT_S3_BUCKET}/live/${TELEPORT_DOMAIN_NAME} /var/lib/teleport
+/bin/aws s3 sync --exact-timestamps s3://${TELEPORT_S3_BUCKET}/live/${TELEPORT_DOMAIN_NAME} /var/lib/teleport
@@ -215,7 +215,7 @@ fi
 touch ${USE_CONFIG_PATH}
 chmod 664 ${USE_CONFIG_PATH}

-# Use letsencrypt by default unless we are explicitly using ACM here
+# Use Let's Encrypt by default unless we are explicitly using ACM here
 if [[ "${USE_ACM}" != "true" ]]; then
    rm -f ${USE_CONFD_DIR}/role.all-acm
    echo "use-letsencrypt" > ${USE_CONFD_DIR}/use-letsencrypt
@@ -358,7 +358,7 @@ EOF
        write_ssh_and_tunnel_section 443
    fi

-    # if we are using letsencrypt (i.e. not ACM) then append config lines
+    # if we are using Let's Encrypt (i.e. not ACM) then append config lines
    if [[ "${USE_ACM}" != "true" ]]; then
        write_https_keypairs_section
    else
@@ -427,15 +427,6 @@ EOF
    systemctl_wrap enable teleport-node.service
    systemctl_wrap start --no-block teleport-node.service

-elif [[ "${TELEPORT_ROLE}" == "monitor" ]]; then
-    echo "monitor" > ${USE_CONFD_DIR}/role.monitor
-    # disable teleport service if this has the monitor role
-    systemctl_wrap disable teleport.service
-    # no teleport config needed
-    rm -f ${USE_CONFIG_PATH}
-    # run monitor setup as an independent service
-    systemctl_wrap start --no-block teleport-monitor-setup.service
-
 # starter cluster configuration
 elif [[ "${TELEPORT_ROLE}" == "auth,node,proxy" ]]; then
    echo "Teleport all-in-one configuration selected."
@@ -445,7 +436,7 @@ elif [[ "${TELEPORT_ROLE}" == "auth,node,proxy" ]]; then
        # always enable TLS routing when ACM is enabled
        USE_TLS_ROUTING=true
        sed -i 's/USE_TLS_ROUTING=false/USE_TLS_ROUTING=true/g' ${USE_CONFD_DIR}/conf
-        # remove letsencrypt config
+        # remove Let's Encrypt config
        rm -f ${USE_CONFD_DIR}/use-letsencrypt
        sed -i 's/USE_LETSENCRYPT=true/USE_LETSENCRYPT=false/g' ${USE_CONFD_DIR}/conf
        # enable ACM role to use alternative unit file
@@ -563,10 +554,10 @@ EOF

        systemctl_wrap enable teleport-acm.service
        systemctl_wrap start --no-block teleport-acm.service
-    # alternatively, if we are using letsencrypt, append config lines
+    # alternatively, if we are using Let's Encrypt, append config lines
    elif [[ "${USE_LETSENCRYPT}" == "true" ]] && [[ "${USE_ACM}" == "false" ]]; then
-        echo "Letsencrypt support enabled"
-        # these variables must all be set for letsencrypt to work
+        echo "Let's Encrypt support enabled"
+        # these variables must all be set for Let's Encrypt to work
        # it also needs the running instance to have permissions to read from/write to the S3 bucket
        if [[ "${TELEPORT_DOMAIN_ADMIN_EMAIL}" != "" && "${TELEPORT_DOMAIN_NAME}" != "" && "${TELEPORT_S3_BUCKET}" != "" ]]; then
            write_https_keypairs_section
@@ -662,10 +653,10 @@ EOF
        write_kubernetes_section TELEPORT_EXTERNAL_HOSTNAME
    fi

-    # if we are using letsencrypt, append config lines
+    # if we are using Let's Encrypt, append config lines
    if [[ "${USE_LETSENCRYPT}" == "true" ]]; then
-        echo "Letsencrypt support enabled"
-        # these variables must all be set for letsencrypt to work
+        echo "Let's Encrypt support enabled"
+        # these variables must all be set for Let's Encrypt to work
        # it also needs the running instance to have permissions to read from/write to the S3 bucket
        if [[ "${TELEPORT_DOMAIN_ADMIN_EMAIL}" != "" && "${TELEPORT_DOMAIN_NAME}" != "" && "${TELEPORT_S3_BUCKET}" != "" ]]; then
            write_https_keypairs_section
@@ -693,145 +684,8 @@ EOF
    fi
 fi

-# enable telegraf service if running in cluster mode
-if [[ "${TELEPORT_ROLE}" == "auth" || "${TELEPORT_ROLE}" == "node" || "${TELEPORT_ROLE}" == "proxy" ]]; then
-    # Install teleport telegraf configuration
-    # Telegraf will collect prometheus metrics and send to influxdb collector
-    cat >/etc/telegraf/telegraf.conf <<EOF
-# Configuration for telegraf agent
-[agent]
-  ## Default data collection interval for all inputs
-  interval = "10s"
-  ## Rounds collection interval to 'interval'
-  ## ie, if interval="10s" then always collect on :00, :10, :20, etc.
-  round_interval = true
-
-  ## Telegraf will send metrics to outputs in batches of at
-  ## most metric_batch_size metrics.
-  metric_batch_size = 1000
-  ## For failed writes, telegraf will cache metric_buffer_limit metrics for each
-  ## output, and will flush this buffer on a successful write. Oldest metrics
-  ## are dropped first when this buffer fills.
-  metric_buffer_limit = 10000
-
-  ## Collection jitter is used to jitter the collection by a random amount.
-  ## Each plugin will sleep for a random time within jitter before collecting.
-  ## This can be used to avoid many plugins querying things like sysfs at the
-  ## same time, which can have a measurable effect on the system.
-  collection_jitter = "0s"
-
-  ## Default flushing interval for all outputs. You shouldn't set this below
-  ## interval. Maximum flush_interval will be flush_interval + flush_jitter
-  flush_interval = "10s"
-  ## Jitter the flush interval by a random amount. This is primarily to avoid
-  ## large write spikes for users running a large number of telegraf instances.
-  ## ie, a jitter of 5s and interval 10s means flushes will happen every 10-15s
-  flush_jitter = "0s"
-
-  ## By default, precision will be set to the same timestamp order as the
-  ## collection interval, with the maximum being 1s.
-  ## Precision will NOT be used for service inputs, such as logparser and statsd.
-  precision = ""
-  ## Run telegraf in debug mode
-  debug = false
-  ## Run telegraf in quiet mode
-  quiet = false
-  ## Override default hostname, if empty use os.Hostname()
-  hostname = ""
-  ## If set to true, do no set the "host" tag in the telegraf agent.
-  omit_hostname = false
-
-###############################################################################
-#                            INPUT PLUGINS                                    #
-###############################################################################
-
-[[inputs.procstat]]
-  exe = "teleport"
-  prefix = "teleport"
-
-[[inputs.prometheus]]
-  # An array of urls to scrape metrics from.
-  urls = ["http://127.0.0.1:3000/metrics"]
-  # Add a metric name prefix
-  name_prefix = "teleport_"
-  # Add tags to be able to make beautiful dashboards
-  [inputs.prometheus.tags]
-    teleservice = "teleport"
-
-# Read metrics about cpu usage
-[[inputs.cpu]]
-  ## Whether to report per-cpu stats or not
-  percpu = true
-  ## Whether to report total system cpu stats or not
-  totalcpu = true
-  ## If true, collect raw CPU time metrics.
-  collect_cpu_time = false
-  ## If true, compute and report the sum of all non-idle CPU states.
-  report_active = false
-
-# Read metrics about disk usage by mount point
-[[inputs.disk]]
-  ## By default, telegraf gather stats for all mountpoints.
-  ## Setting mountpoints will restrict the stats to the specified mountpoints.
-  # mount_points = ["/"]
-
-  ## Ignore some mountpoints by filesystem type. For example (dev)tmpfs (usually
-  ## present on /run, /var/run, /dev/shm or /dev).
-  ignore_fs = ["tmpfs", "devtmpfs", "devfs"]
-
-# Read metrics about disk IO by device
-[[inputs.diskio]]
-
-# Get kernel statistics from /proc/stat
-[[inputs.kernel]]
-  # no configuration
-
-# Read metrics about memory usage
-[[inputs.mem]]
-  # no configuration
-
-# Read metrics about network usage
-[[inputs.net]]
-  # no configuration
-
-# Get the number of processes and group them by status
-[[inputs.processes]]
-  # no configuration
-
-# Read metrics about swap memory usage
-[[inputs.swap]]
-  # no configuration
-
-# Read metrics about system load & uptime
-[[inputs.system]]
-  # no configuration
-
-###############################################################################
-#                            OUTPUT PLUGINS                                   #
-###############################################################################
-
-# Configuration for influxdb server to send metrics to
-[[outputs.influxdb]]
-  ## The full HTTP or UDP endpoint URL for your InfluxDB instance.
-  ## Multiple urls can be specified as part of the same cluster,
-  ## this means that only ONE of the urls will be written to each interval.
-  urls = ["${TELEPORT_INFLUXDB_ADDRESS}"] # required
-  ## The target database for metrics (telegraf will create it if not exists).
-  database = "telegraf" # required
-
-  ## Retention policy to write to. Empty string writes to the default rp.
-  retention_policy = ""
-  ## Write consistency (clusters only), can be: "any", "one", "quorum", "all"
-  write_consistency = "any"
-
-  ## Write timeout (for the InfluxDB client), formatted as a string.
-  ## If not provided, will default to 5s. 0s means no timeout (not recommended).
-  timeout = "5s"
-EOF
-    systemctl_wrap enable telegraf.service
-    systemctl_wrap restart telegraf.service
 # handle configuration for agent mode
-elif [[ "${TELEPORT_ROLE}" == "agent" ]]; then
+if [[ "${TELEPORT_ROLE}" == "agent" ]]; then
    echo "agent" > ${USE_CONFD_DIR}/role.agent
    cat >${USE_CONFIG_PATH} <<EOF
 version: v3
@@ -1,7 +1,7 @@
 #!/bin/bash
 # This script uses DNS-01 challenge, which means that users
 # have to control route53 zone as it modifies zone records
-# to prove to letsencrypt that they own the domain.
+# to prove to Let's Encrypt that they own the domain.

 set -e
 if [[ "${DEBUG:-false}" == "true" ]]; then
@@ -1,6 +1,6 @@
 #!/bin/bash
 # Locking service makes sure that there is only one auth server performing certain action,
-# for example renewing or getting letsencrypt certificates
+# for example renewing or getting Let's Encrypt certificates

 set -e
 if [[ "${DEBUG:-false}" == "true" ]]; then
@@ -9,7 +9,6 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=test@email.com
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
 TELEPORT_DYNAMO_TABLE_NAME=gus-tftestkube4
 TELEPORT_DYNAMO_EVENTS_TABLE_NAME=gus-tftestkube4-events
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_LICENSE_PATH=/home/gus/downloads/teleport/license-gus.pem
 TELEPORT_LOCKS_TABLE_NAME=gus-tftestkube4-locks
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -9,7 +9,6 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=test@email.com
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
 TELEPORT_DYNAMO_TABLE_NAME=gus-tftestkube4
 TELEPORT_DYNAMO_EVENTS_TABLE_NAME=gus-tftestkube4-events
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_LICENSE_PATH=/home/gus/downloads/teleport/license-gus.pem
 TELEPORT_LOCKS_TABLE_NAME=gus-tftestkube4-locks
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -90,4 +89,4 @@ load fixtures/common
    load ${TELEPORT_CONFD_DIR?}/conf
    echo "${AUTH_BLOCK?}"
    echo "${AUTH_BLOCK?}" | grep -E "^  authentication:" -A3 | grep -q "second_factor:"
-}
+}
@@ -8,7 +8,6 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=test@email.com
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
 TELEPORT_DYNAMO_TABLE_NAME=gus-tftestkube4
 TELEPORT_DYNAMO_EVENTS_TABLE_NAME=gus-tftestkube4-events
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_LOCKS_TABLE_NAME=gus-tftestkube4-locks
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
 USE_ACM=false
@@ -9,7 +9,6 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=test@email.com
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
 TELEPORT_DYNAMO_TABLE_NAME=gus-tftestkube4
 TELEPORT_DYNAMO_EVENTS_TABLE_NAME=gus-tftestkube4-events
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_LICENSE_PATH=/home/gus/downloads/teleport/license-gus.pem
 TELEPORT_LOCKS_TABLE_NAME=gus-tftestkube4-locks
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -95,4 +94,4 @@ load fixtures/common
    load ${TELEPORT_CONFD_DIR?}/conf
    echo "${AUTH_BLOCK?}"
    echo "${AUTH_BLOCK?}" | grep -E "^  proxy_listener_mode: multiplex"
-}
+}
@@ -9,7 +9,6 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=test@email.com
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
 TELEPORT_DYNAMO_TABLE_NAME=gus-tftestkube4
 TELEPORT_DYNAMO_EVENTS_TABLE_NAME=gus-tftestkube4-events
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_LICENSE_PATH=/home/gus/downloads/teleport/license-gus.pem
 TELEPORT_LOCKS_TABLE_NAME=gus-tftestkube4-locks
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -89,4 +88,4 @@ load fixtures/common
    load ${TELEPORT_CONFD_DIR?}/conf
    echo "${AUTH_BLOCK?}"
    echo "${AUTH_BLOCK?}" | grep -E "^  authentication:" -A5 | grep -q "rp_id: ${TELEPORT_DOMAIN_NAME?}"
-}
+}
@@ -4,7 +4,6 @@ TELEPORT_ROLE=node
 EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 USE_ACM=false
 EOF
 }
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_PROXY_SERVER_NLB_ALIAS=gus-tftestkube-nlb.gravitational.io
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
 TELEPORT_ENABLE_MONGODB=true
@@ -142,4 +141,4 @@ load fixtures/common
    load ${TELEPORT_CONFD_DIR?}/conf
    echo "${PROXY_BLOCK?}"
    echo "${PROXY_BLOCK?}" | grep -E "^  trust_x_forwarded_for: true"
-}
+}
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
 TELEPORT_ENABLE_MONGODB=true
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_PROXY_SERVER_NLB_ALIAS=""
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_PROXY_SERVER_NLB_ALIAS=""
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_PROXY_SERVER_NLB_ALIAS=""
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -143,4 +142,4 @@ load fixtures/common
    load ${TELEPORT_CONFD_DIR?}/conf
    echo "${PROXY_BLOCK?}"
    echo "${PROXY_BLOCK?}" | grep -E "^  https_keypairs:"
-}
+}
@@ -5,7 +5,6 @@ EC2_REGION=us-west-2
 TELEPORT_AUTH_SERVER_LB=gus-tftestkube4-auth-0f66dd17f8dd9825.elb.us-east-1.amazonaws.com
 TELEPORT_CLUSTER_NAME=gus-tftestkube4
 TELEPORT_DOMAIN_NAME=gus-tftestkube4.gravitational.io
-TELEPORT_INFLUXDB_ADDRESS=http://gus-tftestkube4-monitor-ae7983980c3419ab.elb.us-east-1.amazonaws.com:8086
 TELEPORT_PROXY_SERVER_LB=gus-tftestkube4-proxy-bc9ba568645c3d80.elb.us-east-1.amazonaws.com
 TELEPORT_PROXY_SERVER_NLB_ALIAS=""
 TELEPORT_S3_BUCKET=gus-tftestkube4.gravitational.io
@@ -22,7 +22,7 @@ $ terraform version
 Terraform v1.5.6
 ```

-You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and MacOS Homebrew
+You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and macOS Homebrew
 as the `awscli` package.

 Fedora/CentOS: `yum -y install awscli`
@@ -48,7 +48,7 @@ You should also have a default region set under `~/.aws/config`:
 ```code
 $ cat ~/.aws/config
 # [default]
-# region = us-east-1
+# region = us-west-2
 ```

 As a result, you should be able to run a command like `aws ec2 describe-instances` to list running EC2 instances.
@@ -66,7 +66,7 @@ AWS services:
 - [IAM](https://aws.amazon.com/iam/)
 - [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)

-The Terraform deployment itself will create new IAM roles to be used by Teleport instances which have appropriately
+The Terraform deployment itself will create new IAM roles to be used by Teleport instances that have appropriately
 limited permission scopes for AWS services. However, the initial cluster setup must be done by a user with a high
 level of AWS permissions.

@@ -95,10 +95,8 @@ Initializing the backend...

 Initializing provider plugins...
 - Checking for available provider plugins...
- Installing hashicorp/random v3.5.1...
- Installed hashicorp/random v3.5.1 (signed by HashiCorp)
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
+- Installing hashicorp/aws v5.31.0...
+- Installed hashicorp/aws v5.31.0 (signed by HashiCorp)

 Terraform has been successfully initialized!

@@ -141,7 +139,7 @@ $ export TF_VAR_region="<Var name="us-west-2" />"
 ```

 The AWS region to run in. You should pick from the supported list as detailed in the [README](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/README.md).
-These are regions which support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html).
+These are regions that support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html).

 ### cluster_name

@@ -157,35 +155,36 @@ cluster from scratch, so choose carefully. A good example might be something lik
 ### ami_name

 ```code
-$ export TF_VAR_ami_name="gravitational-teleport-ami-ent-(=teleport.version=)"
+$ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)"
 ```

-Gravitational automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2
-AMIs when we release a new version of Teleport. The AMI names follow the format: `gravitational-teleport-ami-<type>-<version>`
-where `<type>` is either `oss` or `ent` (Enterprise) and `version` is the version of Teleport e.g. `(=teleport.version=)`.
+Teleport (Gravitational) automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2
+AMIs when we release a new version of Teleport. The AMI names follow the format: `teleport-<type>-<version>-<arch>`
+where `<type>` is either `oss` or `ent` (Enterprise), `version` is the version of Teleport, e.g. `(=teleport.version=)`,
+and `<arch>` is either `x86_64` or `arm64`.

 FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix.

-The AWS account ID which publishes these AMIs is `126027368216`. You can list the available AMIs with
+The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with
 the example `awscli` commands below. The output is in JSON format by default.

 <Admonition
  type="tip"
-  title="List Gravitational AMIs"
+  title="List Teleport AMIs"
 >
  OSS AMIs<br/>
  ```code
-  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss-(=teleport.version=)'
+  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-(=teleport.version=)-*'
  ```

  Enterprise AMIs<br/>
  ```code
-  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)'
+  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*'
  ```

-  List Enterprise FIPS 140-2 AMIs<br/>
+  Enterprise FIPS 140-2 AMIs<br/>
  ```code
-  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)-fips'
+  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*'
  ```
 </Admonition>

@@ -297,32 +296,16 @@ Remember that S3 bucket names must be globally unique, so if you see errors rela
 $ export TF_VAR_email="support@example.com"
 ```

-LetsEncrypt requires an email address for every certificate registered which can be used to send notifications and
+Let's Encrypt requires an email address for every certificate registered that can be used to send notifications and
 useful information. We recommend a generic ops/support email address which the team deploying Teleport has access to.

-### grafana_pass
-
-```code
-$ export TF_VAR_grafana_pass="CHANGE_THIS_VALUE"
-```
-
-We deploy Grafana along with every Terraform deployment and automatically make stats on cluster usage available in
-a custom dashboard. This variable sets up the password for the Grafana `admin` user. The Grafana web UI is served
-on the same subdomain as specified above in [`route53_domain`](#route53\_domain) on port 8443.
-
-With the variables set in this example, it would be available on [https://teleport.example.com:8443](https://teleport.example.com:8443)
-
-If you do not change this from the default (`CHANGE_THIS_VALUE`), then it will be set to a random value for security
-and you will need to log into the monitoring instance to discover this manually. As such, we recommend setting this
-to a known value at the outset.
-
 ### use_acm

 ```code
 $ export TF_VAR_use_acm="true"
 ```

-If set to the string `"false"`, Terraform will use [LetsEncrypt](https://letsencrypt.org/) to provision the public-facing
+If set to the string `"false"`, Terraform will use [Let's Encrypt](https://letsencrypt.org/) to provision the public-facing
 web UI certificate for the Teleport cluster ([`route53_domain`](#route53\_domain) - so [https://teleport.example.com](https://teleport.example.com) in this example).
 This uses an [AWS network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)
 to load-balance connections to the Teleport cluster's web UI, and its SSL termination is handled by Teleport itself.
@@ -357,12 +340,12 @@ $ export TF_VAR_teleport_auth_type="local"
 ```

 This value can be used to change the default authentication type used for the Teleport cluster. This is useful for persisting a
-default authentication type across AMI upgrades when you have a SAML, OIDC or GitHub connector configured in DynamoDB.
+default authentication type across AMI upgrades when you have a SAML, OIDC, or GitHub connector configured in DynamoDB.
 The default is `local`.

 - Teleport Community Edition supports `local` or `github`
- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml`
- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml`
+- Teleport Enterprise Edition supports `local`, `github`, `oidc`, or `saml`
+- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc`, or `saml`

 See the [Teleport authentication reference](../../reference/authentication.mdx) for more information.

@@ -372,13 +355,12 @@ See the [Teleport authentication reference](../../reference/authentication.mdx)

 Our reference deployment will provision the following instances for your cluster using AWS Auto Scaling Groups (ASG) with these default settings:

- 2 x `m4.large` Teleport Auth Service instances in an ASG, behind an internal network load balancer, configured using DynamoDB for
+- 2 x `m7g.large` Teleport Auth Service instances in an ASG, behind an internal network load balancer, configured using DynamoDB for
  shared storage. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf#L11)
- 2 x `m4.large` Teleport Proxy Service instances in an ASG, behind a public-facing load balancer - NLB for LetsEncrypt, ALB for ACM. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/proxy_asg.tf#L12)
- 1 x `m4.large` Teleport SSH Service instance in an ASG. Server instances in this ASG will join with Teleport SSH Service enabled and connected to the **auth**
+- 2 x `m7g.large` Teleport Proxy Service instances in an ASG, behind a public-facing load balancer - NLB for LetsEncrypt, ALB for ACM. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/proxy_asg.tf#L12)
+- 1 x `m7g.large` Teleport SSH Service instance in an ASG. Server instances in this ASG will join with Teleport SSH Service enabled and connected to the **auth**
  service. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/node_asg.tf#L10)
- 1 x `m4.large` monitoring server in an ASG which hosts the Grafana instance and receives monitoring data from each service in the cluster. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/monitor_asg.tf#L12)
- 1 x `t2.medium` bastion server which is the only permitted source for inbound SSH traffic to the instances. This is done
+- 1 x `t4g.medium` bastion server which is the only permitted source for inbound SSH traffic to the instances. This is done
  to avoid exposing each instance to the internet directly.

 [The instance types used for each ASG can be configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/vars.tf#L23-L45)
@@ -35,7 +35,7 @@ $ terraform version
 Terraform v1.5.6
 ```

-You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and MacOS Homebrew
+You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and macOS Homebrew
 as the `awscli` package.

 Fedora/CentOS: `yum -y install awscli`
@@ -61,7 +61,7 @@ You should also have a default region set under `~/.aws/config`:
 ```code
 $ cat ~/.aws/config
 # [default]
-# region = us-east-1
+# region = us-west-2
 ```

 As a result, you should be able to run a command like `aws ec2 describe-instances` to list running EC2 instances.
@@ -79,7 +79,7 @@ AWS services:
 - [IAM](https://aws.amazon.com/iam/)
 - [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)

-The Terraform deployment itself will create a new IAM role to be used by the Teleport instance which has appropriately
+The Terraform deployment itself will create a new IAM role to be used by the Teleport instance that has appropriately
 limited permission scopes for AWS services. However, the initial cluster setup must be done by a user with a high
 level of AWS permissions.

@@ -108,10 +108,8 @@ Initializing the backend...

 Initializing provider plugins...
 - Checking for available provider plugins...
- Installing hashicorp/random v3.5.1...
- Installed hashicorp/random v3.5.1 (signed by HashiCorp)
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
+- Installing hashicorp/aws v5.31.0...
+- Installed hashicorp/aws v5.31.0 (signed by HashiCorp)

 Terraform has been successfully initialized!

@@ -154,7 +152,7 @@ $ export TF_VAR_region="<Var name="us-west-2" />"
 ```

 The AWS region to run in. You should pick from the supported list as detailed in the [README](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/starter-cluster/README.md).
-These are regions which support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html).
+These are regions that support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html).

 ### cluster_name

@@ -170,35 +168,36 @@ cluster from scratch, so choose carefully. A good example might be something lik
 ### ami_name

 ```code
-$ export TF_VAR_ami_name="gravitational-teleport-ami-ent-(=teleport.version=)"
+$ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)"
 ```

-Gravitational automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we
-release a new version of Teleport. The AMI names follow the format: `gravitational-teleport-ami-<type>-<version>`
-where `<type>` is either `oss` or `ent` (Enterprise) and `version` is the version of Teleport e.g. `(=teleport.version=)`.
+Teleport (Gravitational) automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we
+release a new version of Teleport. The AMI names follow the format: `teleport-<type>-<version>-<arch>`
+where `<type>` is either `oss` or `ent` (Enterprise), `version` is the version of Teleport e.g. `(=teleport.version=)`,
+and `arch` is either `x86_64` or `arm64`.

 FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix.

-The AWS account ID which publishes these AMIs is `126027368216`. You can list the available AMIs with
+The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with
 the example `awscli` commands below. The output is in JSON format by default.

 <Admonition
  type="tip"
-  title="List Gravitational AMIs"
+  title="List Teleport AMIs"
 >
  OSS AMIs<br/>
  ```code
-  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss-(=teleport.version=)'
+  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-(=teleport.version=)-*'
  ```

  Enterprise AMIs<br/>
  ```code
-  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)'
+  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*'
  ```

-  List Enterprise FIPS 140-2 AMIs<br/>
+  Enterprise FIPS 140-2 AMIs<br/>
  ```code
-  aws --region <Var name="us-west-2" /> ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)-fips'
+  $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*'
  ```
 </Admonition>

@@ -318,7 +317,7 @@ A `micro` instance is fine for testing, but if this server will need to support
 $ export TF_VAR_email="support@example.com"
 ```

-LetsEncrypt requires an email address for every certificate registered which can be used to send notifications and
+Let's Encrypt requires an email address for every certificate registered which can be used to send notifications and
 useful information. We recommend a generic ops/support email address which the team deploying Teleport has access to.

 ### use_letsencrypt
@@ -327,7 +326,7 @@ useful information. We recommend a generic ops/support email address which the t
 $ export TF_VAR_use_letsencrypt="false"
 ```

-If set to the string `"true"`, Terraform will use [LetsEncrypt](https://letsencrypt.org/) to provision the public-facing
+If set to the string `"true"`, Terraform will use [Let's Encrypt](https://letsencrypt.org/) to provision the public-facing
 web UI certificate for the Teleport cluster ([`route53_domain`](#route53\_domain) - so [https://teleport.example.com](https://teleport.example.com) in this example).
 This uses an [AWS network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)
 to load-balance connections to the Teleport cluster's web UI, and its SSL termination is handled by Teleport itself.
@@ -374,8 +373,8 @@ default authentication type across AMI upgrades when you have a SAML, OIDC or Gi
 The default is `local`.

 - Teleport Community Edition supports `local` or `github`
- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml`
- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml`
+- Teleport Enterprise Edition supports `local`, `github`, `oidc`, or `saml`
+- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc`, or `saml`

 See the [Teleport authentication reference](../../reference/authentication.mdx) for more information.

@@ -370,14 +370,16 @@ for a list of the available configuration options.
 The image names all include the build timestamp (shown as `$TIMESTAMP` in the
 table below), and are tagged for easier searching.

-| Image name | Edition | Architecture | FIPS support | AMI Tags | Owner Account ID |
-| - | - | - | - | - | - |
-| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | 146628656107 |
-| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | 146628656107 |
-| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | 146628656107 |
-| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | 146628656107 |
-| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | 146628656107 |
-| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | 146628656107 |
+| Image name | Edition | Architecture | FIPS support | AMI Tags |
+| - | - | - | - | - |
+| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` |
+| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` |
+| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` |
+| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` |
+| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` |
+| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` |
+
+These AMIs are owned by AWS account ID `146628656107`.

 All images are based on Amazon Linux 2023 and have been hardened using the
 Amazon EC2 ImageBuilder [STIG](https://public.cyber.mil/stigs/) hardening
@@ -43,16 +43,13 @@ TF_VAR_enable_mysql_listener ?= true
 # This will be ignored if TF_VAR_use_tls_routing is set to true
 TF_VAR_enable_postgres_listener ?= true

-# Bucket name to store encrypted letsencrypt certificates.
+# Bucket name to store encrypted Let's Encrypt certificates.
 TF_VAR_s3_bucket_name ?=

-# Email of your support org, used for Letsencrypt cert registration process.
+# Email of your support org, used for Let's Encrypt cert registration process.
 TF_VAR_email ?=

-# Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install
-TF_VAR_grafana_pass ?=
-
-# (optional) Set to true to use ACM (Amazon Certificate Manager) to provision certificates rather than Letsencrypt
+# (optional) Set to true to use ACM (Amazon Certificate Manager) to provision certificates rather than Let's Encrypt
 # If you wish to use a pre-existing ACM certificate rather than having Terraform generate one for you, you can import it:
 # terraform import aws_acm_certificate.cert <certificate_arn>
 TF_VAR_use_acm ?= false
@@ -69,8 +66,8 @@ TF_VAR_use_tls_routing ?= false
 # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
 # or GitHub connector configured in DynamoDB. The default if not set is "local".
 # Teleport Community Edition supports "local" or "github"
-# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
-# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml"
 TF_VAR_teleport_auth_type ?= "local"

 export
@@ -33,20 +33,20 @@ In order to spin up AWS resources using these Terraform examples, you need the f
 # Set variables for Terraform

 # Region to run in - we currently have AMIs in the following regions:
-# ap-south-1,ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2
-# sa-east-1,us-east-1,us-east-2,us-west-1,us-west-2
+# ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1
+# eu-north-1, eu-west-1, eu-west-2, eu-west-3, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2
 export TF_VAR_region="us-west-2"

 # Cluster name is a unique cluster name to use, should be unique and not contain spaces or other special characters
 export TF_VAR_cluster_name="teleport.example.com"

 # AMI name contains the version of Teleport to install, and whether to use OSS or Enterprise version
-# These AMIs are published by Gravitational and shared as public whenever a new version of Teleport is released
+# These AMIs are published by Teleport (Gravitational) and shared as public whenever a new version of Teleport is released
 # To list available AMIs:
-# OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
-# Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
+# OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*'
+# Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-export TF_VAR_ami_name="gravitational-teleport-ami-ent-14.3.0"
+export TF_VAR_ami_name="teleport-ent-14.3.0-arm64"

 # AWS SSH key name to provision in installed instances, should be available in the region
 export TF_VAR_key_name="example"
@@ -104,16 +104,13 @@ export TF_VAR_s3_bucket_name="teleport.example.com"
 # Email of your support org, used for Let's Encrypt cert registration process.
 export TF_VAR_email="support@example.com"

-# Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install
-export TF_VAR_grafana_pass="CHANGE_THIS_VALUE"
-
 # This value can be used to change the default authentication type used for the Teleport cluster.
 # See https://goteleport.com/docs/reference/authentication for more information.
 # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
 # or GitHub connector configured in DynamoDB. The default is "local".
 # Teleport Community Edition supports "local" or "github"
-# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
-# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml"
 export TF_VAR_teleport_auth_type="local"

 # plan
@@ -36,8 +36,8 @@
      block:
        - name: Download and unpack new version of teleport
          get_url:
-            url: https://get.gravitational.com/teleport/{{teleport_version}}/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz
-            dest: /tmp/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz
+            url: https://cdn.teleport.dev/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz
+            dest: /tmp/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz
        - name: Unpack teleport binaries
          unarchive:
            extra_opts: ['--strip-components=1', '--show-stored-names']
@@ -47,7 +47,7 @@
              - "VERSION"
              - "INSTALL"
              - "CHANGELOG"
-            src: /tmp/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz
+            src: /tmp/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz
            dest: /usr/local/bin
            remote_src: true
            owner: "{{ 'root' if 'node' in group_names else 'teleport' }}"
@@ -1,62 +0,0 @@
-worker_processes auto;
-user nginx;
-pid /run/nginx.pid;
-
-events {
-	worker_connections 2048;
-}
-
-http {
-	sendfile on;
-	tcp_nopush on;
-	tcp_nodelay on;
-	keepalive_timeout 65;
-	types_hash_max_size 2048;
-	# server_tokens off;
-
-	# server_names_hash_bucket_size 64;
-	# server_name_in_redirect off;
-
-	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
-
-	##
-	# Logging Settings
-	##
-	error_log stderr;
-	access_log /var/log/nginx/access.log;
-	error_log /var/log/nginx/error.log;
-
-
-	##
-	# Gzip Settings
-	##
-	gzip on;
-
-	##
-	# Websocket settings
-	##
-	map $http_upgrade $connection_upgrade {
-		default upgrade;
-		'' close;
-	}
-
-	#
-	# Frontend grafana (no TLS, as we're using ACM on the LB)
-	#
-	server {
-		listen 8444 default_server;
-		location / {
-			proxy_pass http://127.0.0.1:3000;
-			proxy_set_header Host $http_host;
-		}
-		# Proxy Grafana Live WebSocket connections.
-		location /api/live/ {
-			proxy_http_version 1.1;
-			proxy_set_header Upgrade $http_upgrade;
-			proxy_set_header Connection $connection_upgrade;
-			proxy_set_header Host $http_host;
-			proxy_pass http://127.0.0.1:3000;
-		}
-	}
-}
@@ -1,75 +0,0 @@
-worker_processes auto;
-user nginx;
-pid /run/nginx.pid;
-
-events {
-	worker_connections 2048;
-}
-
-http {
-	sendfile on;
-	tcp_nopush on;
-	tcp_nodelay on;
-	keepalive_timeout 65;
-	types_hash_max_size 2048;
-	# server_tokens off;
-
-	# server_names_hash_bucket_size 64;
-	# server_name_in_redirect off;
-
-	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
-
-	##
-	# TLS settings - we are pretty strict here
-	# but well, it's a dev service, why not?
-	##
-	ssl_protocols TLSv1.2 TLSv1.3;
-	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-	ssl_prefer_server_ciphers off;
-
-	##
-	# Logging Settings
-	##
-	error_log stderr;
-	access_log /var/log/nginx/access.log;
-	error_log /var/log/nginx/error.log;
-
-
-	##
-	# Gzip Settings
-	##
-	gzip on;
-
-	##
-	# Websocket settings
-	##
-	map $http_upgrade $connection_upgrade {
-		default upgrade;
-		'' close;
-	}
-
-	#
-	# Frontend grafana with TLS
-	#
-	server {
-		listen 8443 default_server ssl http2;
-		ssl_certificate_key /etc/tls/certs/privkey.pem;
-		ssl_certificate /etc/tls/certs/fullchain.pem;
-		ssl_session_timeout 1d;
-		ssl_session_cache shared:SSL:10m;  # about 40000 sessions
-		ssl_session_tickets off;
-		location / {
-			proxy_pass http://127.0.0.1:3000;
-			proxy_set_header Host $http_host;
-		}
-		# Proxy Grafana Live WebSocket connections.
-		location /api/live/ {
-			proxy_http_version 1.1;
-			proxy_set_header Upgrade $http_upgrade;
-			proxy_set_header Connection $connection_upgrade;
-			proxy_set_header Host $http_host;
-			proxy_pass http://127.0.0.1:3000;
-		}
-	}
-}
@@ -9,10 +9,9 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=${email}
 TELEPORT_DOMAIN_NAME=${domain_name}
 TELEPORT_DYNAMO_TABLE_NAME=${dynamo_table_name}
 TELEPORT_DYNAMO_EVENTS_TABLE_NAME=${dynamo_events_table_name}
-TELEPORT_INFLUXDB_ADDRESS=${influxdb_addr}
 TELEPORT_LICENSE_PATH=${license_path}
 TELEPORT_LOCKS_TABLE_NAME=${locks_table_name}
 TELEPORT_S3_BUCKET=${s3_bucket}
 USE_ACM=${use_acm}
 USE_TLS_ROUTING=${use_tls_routing}
-EOF
+EOF
@@ -64,9 +64,7 @@ resource "aws_launch_template" "auth" {
      email                    = var.email
      domain_name              = var.route53_domain
      s3_bucket                = var.s3_bucket_name
-      influxdb_addr            = "http://${aws_lb.monitor.dns_name}:8086"
      license_path             = var.license_path
-      telegraf_version         = var.telegraf_version
      teleport_uid             = var.teleport_uid
      use_acm                  = var.use_acm
      use_tls_routing          = var.use_tls_routing
@@ -120,7 +120,7 @@ EOF

 }

-// S3 is used for letsencrypt, auth servers request certificates from letsencrypt
+// S3 is used for Let's Encrypt, auth servers request certificates from Let's Encrypt
 // and publish to S3 encrypted bucket. SSM is not used, because certificates and private keys
 // are too big for SSM.
 resource "aws_iam_role_policy" "auth_s3" {
@@ -1,10 +1,11 @@
+# orca-iac disable=b61415c4-ce88-4f3a-930b-821d0a4530bb
 // Bastion is an emergency access bastion
 // that could be spun up on demand in case
 // of the need to have emergency administrative access
 resource "aws_instance" "bastion" {
  count                       = "1"
  ami                         = data.aws_ami.base.id
-  instance_type               = "t2.medium"
+  instance_type               = "t4g.medium"
  key_name                    = var.key_name
  associate_public_ip_address = true
  source_dest_check           = false
@@ -3,7 +3,7 @@
 // are relying on systemd
 data "aws_ami" "base" {
  most_recent = true
-  owners      = [126027368216]
+  owners      = [146628656107]

  filter {
    name   = "name"
@@ -1,9 +0,0 @@
-#!/bin/bash
-cat >/etc/teleport.d/conf <<EOF
-TELEPORT_ROLE=monitor
-EC2_REGION=${region}
-TELEPORT_CLUSTER_NAME=${cluster_name}
-TELEPORT_DOMAIN_NAME=${domain_name}
-TELEPORT_S3_BUCKET=${s3_bucket}
-USE_ACM=${use_acm}
-EOF
@@ -1,244 +0,0 @@
-// Monitor is an example of influxdb + grafana deployment
-// Grafana is available on port 8443
-// Internal influxdb HTTP collector service listens on port 8086
-
-// Let's Encrypt
-resource "aws_autoscaling_group" "monitor" {
-  name                      = "${var.cluster_name}-monitor"
-  max_size                  = 1
-  min_size                  = 1
-  health_check_grace_period = 300
-  health_check_type         = "EC2"
-  desired_capacity          = 1
-  force_delete              = false
-  vpc_zone_identifier       = [aws_subnet.public[0].id]
-
-  launch_template {
-    id      = aws_launch_template.monitor.id
-    version = "$Latest"
-  }
-
-  // Auto scaling group is associated with internal load balancer for metrics ingestion
-  // and proxy load balancer for grafana
-  target_group_arns = [aws_lb_target_group.proxy_grafana[0].arn, aws_lb_target_group.monitor.arn]
-  count             = var.use_acm ? 0 : 1
-
-  tag {
-    key                 = "TeleportCluster"
-    value               = var.cluster_name
-    propagate_at_launch = true
-  }
-
-  tag {
-    key                 = "TeleportRole"
-    value               = "monitor"
-    propagate_at_launch = true
-  }
-
-  // external autoscale algos can modify these values,
-  // so ignore changes to them
-  lifecycle {
-    ignore_changes = [
-      desired_capacity,
-      max_size,
-      min_size,
-    ]
-  }
-}
-
-// ACM
-resource "aws_autoscaling_group" "monitor_acm" {
-  name                      = "${var.cluster_name}-monitor"
-  max_size                  = 1
-  min_size                  = 1
-  health_check_grace_period = 300
-  health_check_type         = "EC2"
-  desired_capacity          = 1
-  force_delete              = false
-  vpc_zone_identifier       = [aws_subnet.public[0].id]
-
-  launch_template {
-    id      = aws_launch_template.monitor.id
-    version = "$Latest"
-  }
-
-  // Auto scaling group is associated with internal load balancer for metrics ingestion
-  // and proxy load balancer for grafana
-  target_group_arns = [aws_lb_target_group.proxy_grafana_acm[0].arn, aws_lb_target_group.monitor.arn]
-  count             = var.use_acm ? 1 : 0
-
-  tag {
-    key                 = "TeleportCluster"
-    value               = var.cluster_name
-    propagate_at_launch = true
-  }
-
-  // external autoscale algos can modify these values,
-  // so ignore changes to them
-  lifecycle {
-    ignore_changes = [
-      desired_capacity,
-      max_size,
-      min_size,
-    ]
-  }
-}
-
-// Needs to have a public IP
-// tfsec:ignore:aws-ec2-no-public-ip
-resource "aws_launch_template" "monitor" {
-  lifecycle {
-    create_before_destroy = true
-  }
-  name_prefix   = "${var.cluster_name}-monitor-"
-  image_id      = data.aws_ami.base.id
-  instance_type = var.monitor_instance_type
-  user_data = base64encode(templatefile(
-    "${path.module}/monitor-user-data.tpl",
-    {
-      region           = var.region
-      cluster_name     = var.cluster_name
-      influxdb_version = var.influxdb_version
-      grafana_version  = var.grafana_version
-      telegraf_version = var.telegraf_version
-      s3_bucket        = var.s3_bucket_name
-      domain_name      = var.route53_domain
-      use_acm          = var.use_acm
-    }
-  ))
-
-  metadata_options {
-    http_tokens   = "required"
-    http_endpoint = "enabled"
-  }
-
-  block_device_mappings {
-    device_name = "/dev/xvda"
-    ebs {
-      delete_on_termination = true
-      encrypted             = true
-      iops                  = 3000
-      throughput            = 125
-      volume_type           = "gp3"
-    }
-  }
-
-  key_name      = var.key_name
-  ebs_optimized = true
-
-  network_interfaces {
-    associate_public_ip_address = true
-    security_groups             = [aws_security_group.monitor.id]
-  }
-
-  iam_instance_profile {
-    name = aws_iam_instance_profile.monitor.name
-  }
-}
-
-// Monitors support traffic coming from internal cluster subnets and expose 8443 for grafana
-resource "aws_security_group" "monitor" {
-  name        = "${var.cluster_name}-monitor"
-  description = "SG for ${var.cluster_name}-monitor"
-  vpc_id      = local.vpc_id
-  tags = {
-    TeleportCluster = var.cluster_name
-  }
-}
-
-// SSH access via bastion only
-resource "aws_security_group_rule" "monitor_ingress_allow_ssh" {
-  description              = "SSH access via bastion only"
-  type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
-  protocol                 = "tcp"
-  security_group_id        = aws_security_group.monitor.id
-  source_security_group_id = aws_security_group.bastion.id
-}
-
-// Ingress traffic to SSL port 8443 is allowed from everywhere (Let's Encrypt)
-// tfsec:ignore:aws-ec2-no-public-ingress-sgr
-resource "aws_security_group_rule" "monitor_ingress_allow_web" {
-  description       = "Ingress traffic to SSL port 8443 is allowed from everywhere (Lets Encrypt)"
-  type              = "ingress"
-  from_port         = 8443
-  to_port           = 8443
-  protocol          = "tcp"
-  cidr_blocks       = var.allowed_monitor_ingress_cidr_blocks
-  security_group_id = aws_security_group.monitor.id
-  count             = var.use_acm ? 0 : 1
-}
-
-// Ingress traffic to non-SSL port 8444 is allowed from everywhere (ACM)
-// tfsec:ignore:aws-ec2-no-public-ingress-sgr
-resource "aws_security_group_rule" "monitor_ingress_allow_web_acm" {
-  description       = "Ingress traffic to non-SSL port 8444 is allowed from everywhere (ACM)"
-  type              = "ingress"
-  from_port         = 8444
-  to_port           = 8444
-  protocol          = "tcp"
-  cidr_blocks       = var.allowed_monitor_ingress_cidr_blocks
-  security_group_id = aws_security_group.monitor.id
-  count             = var.use_acm ? 1 : 0
-}
-
-// Influxdb metrics collector traffic is limited to internal VPC CIDR
-// We use CIDR here because traffic arriving from NLB is not marked with security group
-resource "aws_security_group_rule" "monitor_collector_ingress_allow_vpc_cidr_traffic" {
-  description       = "Influxdb metrics collector traffic is limited to internal VPC CIDR"
-  type              = "ingress"
-  from_port         = 8086
-  to_port           = 8086
-  protocol          = "tcp"
-  cidr_blocks       = [var.vpc_cidr]
-  security_group_id = aws_security_group.monitor.id
-}
-
-// All egress traffic is allowed
-// tfsec:ignore:aws-ec2-no-public-egress-sgr
-resource "aws_security_group_rule" "monitor_egress_allow_all_traffic" {
-  description       = "All egress traffic is allowed"
-  type              = "egress"
-  from_port         = 0
-  to_port           = 0
-  protocol          = "-1"
-  cidr_blocks       = var.allowed_monitor_egress_cidr_blocks
-  security_group_id = aws_security_group.monitor.id
-}
-
-// Network load balancer for influxdb collector
-// Notice that in this case it is in the single subnet
-// because network load balancers only distribute traffic
-// in the same AZ, and this example does not have HA InfluxDB setup
-resource "aws_lb" "monitor" {
-  name               = "${var.cluster_name}-monitor"
-  internal           = true
-  subnets            = [aws_subnet.public[0].id]
-  load_balancer_type = "network"
-  idle_timeout       = 3600
-
-  tags = {
-    TeleportCluster = var.cluster_name
-  }
-}
-
-// Target group is associated with monitor instance
-resource "aws_lb_target_group" "monitor" {
-  name     = "${var.cluster_name}-monitor"
-  port     = 8086
-  vpc_id   = aws_vpc.teleport.id
-  protocol = "TCP"
-}
-
-// 8086 is monitor metrics collector
-resource "aws_lb_listener" "monitor" {
-  load_balancer_arn = aws_lb.monitor.arn
-  port              = "8086"
-  protocol          = "TCP"
-
-  default_action {
-    target_group_arn = aws_lb_target_group.monitor.arn
-    type             = "forward"
-  }
-}
@@ -1,89 +0,0 @@
-// Proxy instance profile and roles
-resource "aws_iam_role" "monitor" {
-  name = "${var.cluster_name}-monitor"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {"Service": "ec2.amazonaws.com"},
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
-
-}
-
-// Monitor fetches certificates obtained by auth servers from encrypted S3 bucket.
-// Monitors do not setup certificates, to keep privileged operations happening
-// only on auth servers.
-resource "aws_iam_instance_profile" "monitor" {
-  name       = "${var.cluster_name}-monitor"
-  role       = aws_iam_role.monitor.name
-  depends_on = [aws_iam_role_policy.monitor_s3]
-}
-
-resource "aws_iam_role_policy" "monitor_s3" {
-  name = "${var.cluster_name}-monitor-s3"
-  role = aws_iam_role.monitor.id
-
-  policy = <<EOF
-{
-   "Version": "2012-10-17",
-   "Statement": [
-     {
-       "Effect": "Allow",
-       "Action": ["s3:ListBucket"],
-       "Resource": ["arn:aws:s3:::${aws_s3_bucket.certs.bucket}"]
-     },
-     {
-       "Effect": "Allow",
-       "Action": [
-         "s3:GetObject"
-       ],
-       "Resource": ["arn:aws:s3:::${aws_s3_bucket.certs.bucket}/*"]
-     }
-   ]
- }
- 
-EOF
-
-}
-
-// Fetch and setup default grafana adminpass
-resource "aws_iam_role_policy" "monitor_ssm" {
-  name = "${var.cluster_name}-monitor-ssm"
-  role = aws_iam_role.monitor.id
-
-  policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ssm:GetParameters",
-                "ssm:GetParametersByPath",
-                "ssm:GetParameter",
-                "ssm:PutParameter"
-            ],
-            "Resource": "arn:aws:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/teleport/${var.cluster_name}/grafana_pass"
-        },
-        {
-         "Effect":"Allow",
-         "Action":[
-            "kms:Decrypt"
-         ],
-         "Resource":[
-            "arn:aws:kms:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:key/${data.aws_kms_alias.ssm.target_key_id}"
-         ]
-      }
-    ]
-}
-EOF
-
-}
-
@@ -4,6 +4,5 @@ TELEPORT_ROLE=node
 EC2_REGION=${region}
 TELEPORT_AUTH_SERVER_LB=${auth_server_addr}
 TELEPORT_CLUSTER_NAME=${cluster_name}
-TELEPORT_INFLUXDB_ADDRESS=${influxdb_addr}
 USE_ACM=${use_acm}
-EOF
+EOF
@@ -52,9 +52,7 @@ resource "aws_launch_template" "node" {
    {
      region           = var.region
      cluster_name     = var.cluster_name
-      telegraf_version = var.telegraf_version
      auth_server_addr = aws_lb.auth.dns_name
-      influxdb_addr    = "http://${aws_lb.monitor.dns_name}:8086"
      use_acm          = var.use_acm
    }
  ))
@@ -3,11 +3,7 @@ terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-      version = "~> 4.0"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.0"
+      version = "~> 5.0"
    }
  }
 }
@@ -5,7 +5,6 @@ EC2_REGION=${region}
 TELEPORT_AUTH_SERVER_LB=${auth_server_addr}
 TELEPORT_CLUSTER_NAME=${cluster_name}
 TELEPORT_DOMAIN_NAME=${domain_name}
-TELEPORT_INFLUXDB_ADDRESS=${influxdb_addr}
 TELEPORT_PROXY_SERVER_LB=${proxy_server_lb_addr}
 TELEPORT_PROXY_SERVER_NLB_ALIAS=${proxy_server_nlb_alias}
 TELEPORT_S3_BUCKET=${s3_bucket}
@@ -14,4 +13,4 @@ TELEPORT_ENABLE_MYSQL=${enable_mysql_listener}
 TELEPORT_ENABLE_POSTGRES=${enable_postgres_listener}
 USE_ACM=${use_acm}
 USE_TLS_ROUTING=${use_tls_routing}
-EOF
+EOF
@@ -2,7 +2,7 @@
 // set up in the public subnet. This is the only group of servers that are
 // accepting traffic from the internet.

-// letsencrypt
+// Let's Encrypt
 resource "aws_autoscaling_group" "proxy" {
  name                      = "${var.cluster_name}-proxy"
  max_size                  = 5
@@ -126,11 +126,9 @@ resource "aws_launch_template" "proxy" {
      auth_server_addr         = aws_lb.auth.dns_name
      proxy_server_lb_addr     = var.use_acm ? aws_lb.proxy_acm[0].dns_name : aws_lb.proxy[0].dns_name
      proxy_server_nlb_alias   = var.route53_domain_acm_nlb_alias
-      influxdb_addr            = "http://${aws_lb.monitor.dns_name}:8086"
      email                    = var.email
      domain_name              = var.route53_domain
      s3_bucket                = var.s3_bucket_name
-      telegraf_version         = var.telegraf_version
      enable_mongodb_listener  = var.enable_mongodb_listener
      enable_mysql_listener    = var.enable_mysql_listener
      enable_postgres_listener = var.enable_postgres_listener
@@ -136,19 +136,6 @@ resource "aws_security_group_rule" "proxy_ingress_allow_web" {
  security_group_id = aws_security_group.proxy.id
 }

-// Ingress traffic to grafana port 8443 is allowed from all directions (ACM)
-// tfsec:ignore:aws-ec2-no-public-ingress-sgr
-resource "aws_security_group_rule" "proxy_ingress_allow_grafana_acm" {
-  description       = "Ingress traffic to grafana port 8443 is allowed from all directions (ACM)"
-  type              = "ingress"
-  from_port         = 8443
-  to_port           = 8443
-  protocol          = "tcp"
-  cidr_blocks       = var.allowed_proxy_ingress_cidr_blocks
-  security_group_id = aws_security_group.proxy_acm[0].id
-  count             = var.use_acm ? 1 : 0
-}
-
 // Egress traffic is allowed everywhere
 // tfsec:ignore:aws-ec2-no-public-egress-sgr
 resource "aws_security_group_rule" "proxy_egress_allow_all_traffic" {
@@ -193,13 +180,14 @@ resource "aws_lb" "proxy" {

 // Application load balancer for proxy server TLS listener (using ACM)
 resource "aws_lb" "proxy_acm" {
-  name               = "${var.cluster_name}-proxy-acm"
-  internal           = false
-  subnets            = aws_subnet.public.*.id
-  load_balancer_type = "application"
-  idle_timeout       = 3600
-  security_groups    = [aws_security_group.proxy_acm[0].id]
-  count              = var.use_acm ? 1 : 0
+  name                       = "${var.cluster_name}-proxy-acm"
+  internal                   = false
+  subnets                    = aws_subnet.public.*.id
+  load_balancer_type         = "application"
+  idle_timeout               = 3600
+  drop_invalid_header_fields = true
+  security_groups            = [aws_security_group.proxy_acm[0].id]
+  count                      = var.use_acm ? 1 : 0
  tags = {
    TeleportCluster = var.cluster_name
  }
@@ -227,7 +215,7 @@ resource "aws_lb_listener" "proxy_proxy" {
 }

 // Tunnel endpoint/listener on LB - this is only used with ACM (as
-// Teleport web/tunnel multiplexing can be used with Letsencrypt)
+// Teleport web/tunnel multiplexing can be used with Let's Encrypt)
 resource "aws_lb_target_group" "proxy_tunnel" {
  name     = "${var.cluster_name}-proxy-tunnel"
  port     = 3024
@@ -337,7 +325,7 @@ resource "aws_lb_listener" "proxy_mongodb" {
 // This is address used for remote clusters to connect to and the users
 // accessing web UI.

-// Proxy web target group (using letsencrypt)
+// Proxy web target group (using Let's Encrypt)
 resource "aws_lb_target_group" "proxy_web" {
  name     = "${var.cluster_name}-proxy-web"
  port     = 3080
@@ -346,7 +334,7 @@ resource "aws_lb_target_group" "proxy_web" {
  protocol = "TCP"
 }

-// Proxy web listener (using letsencrypt)
+// Proxy web listener (using Let's Encrypt)
 resource "aws_lb_listener" "proxy_web" {
  load_balancer_arn = aws_lb.proxy[0].arn
  port              = "443"
@@ -386,48 +374,3 @@ resource "aws_lb_listener" "proxy_web_acm" {
    type             = "forward"
  }
 }
-
-// This is a small hack to expose grafana over web port 8443
-// feel free to remove it or replace with something else
-// Let's Encrypt
-resource "aws_lb_target_group" "proxy_grafana" {
-  name     = "${var.cluster_name}-proxy-grafana"
-  port     = 8443
-  vpc_id   = aws_vpc.teleport.id
-  protocol = "TCP"
-  count    = var.use_acm ? 0 : 1
-}
-
-resource "aws_lb_listener" "proxy_grafana" {
-  load_balancer_arn = aws_lb.proxy[0].arn
-  port              = "8443"
-  protocol          = "TCP"
-  count             = var.use_acm ? 0 : 1
-
-  default_action {
-    target_group_arn = aws_lb_target_group.proxy_grafana[0].arn
-    type             = "forward"
-  }
-}
-
-// ACM
-resource "aws_lb_target_group" "proxy_grafana_acm" {
-  name     = "${var.cluster_name}-proxy-grafana"
-  port     = 8444
-  vpc_id   = aws_vpc.teleport.id
-  protocol = "HTTP"
-  count    = var.use_acm ? 1 : 0
-}
-
-resource "aws_lb_listener" "proxy_grafana_acm" {
-  load_balancer_arn = aws_lb.proxy_acm[0].arn
-  port              = "8443"
-  protocol          = "HTTPS"
-  certificate_arn   = aws_acm_certificate_validation.cert[0].certificate_arn
-  count             = var.use_acm ? 1 : 0
-
-  default_action {
-    target_group_arn = aws_lb_target_group.proxy_grafana_acm[0].arn
-    type             = "forward"
-  }
-}
@@ -5,7 +5,7 @@ data "aws_route53_zone" "proxy" {
 }

 // Route53 record connects proxy network load balancer
-// letsencrypt
+// Let's Encrypt
 resource "aws_route53_record" "proxy" {
  zone_id = data.aws_route53_zone.proxy.zone_id
  name    = var.route53_domain
@@ -20,7 +20,7 @@ resource "aws_route53_record" "proxy" {
 }

 // Route53 record connects proxy network load balancer with wildcard
-// letsencrypt
+// Let's Encrypt
 resource "aws_route53_record" "proxy_wildcard" {
  zone_id = data.aws_route53_zone.proxy.zone_id
  name    = "*.${var.route53_domain}"
@@ -48,28 +48,3 @@ resource "aws_s3_bucket_public_access_block" "certs" {
  ignore_public_acls      = true
  restrict_public_buckets = true
 }
-
-resource "aws_s3_object" "grafana_teleport_dashboard" {
-  bucket = aws_s3_bucket.certs.bucket
-  key    = "health-dashboard.json"
-  source = "./assets/health-dashboard.json"
-  etag   = filemd5("./assets/health-dashboard.json")
-}
-
-// Grafana nginx config (Let's Encrypt)
-resource "aws_s3_object" "grafana_teleport_nginx" {
-  bucket = aws_s3_bucket.certs.bucket
-  key    = "grafana-nginx.conf"
-  source = "./assets/grafana-nginx.conf"
-  count  = var.use_acm ? 0 : 1
-  etag   = filemd5("./assets/grafana-nginx.conf")
-}
-
-// Grafana nginx config (ACM)
-resource "aws_s3_object" "grafana_teleport_nginx_acm" {
-  bucket = aws_s3_bucket.certs.bucket
-  key    = "grafana-nginx.conf"
-  source = "./assets/grafana-nginx-acm.conf"
-  count  = var.use_acm ? 1 : 0
-  etag   = filemd5("./assets/grafana-nginx-acm.conf")
-}
@@ -9,11 +9,3 @@ resource "aws_ssm_parameter" "license" {
  value     = file(var.license_path)
  overwrite = true
 }
-
-resource "aws_ssm_parameter" "grafana_pass" {
-  name      = "/teleport/${var.cluster_name}/grafana_pass"
-  type      = "SecureString"
-  value     = var.grafana_pass
-  overwrite = true
-}
-
@@ -23,25 +23,19 @@ variable "teleport_uid" {
 // Instance types used for authentication servers auto scale groups
 variable "auth_instance_type" {
  type    = string
-  default = "m4.large"
+  default = "m7g.large"
 }

 // Instance types used for proxy auto scale groups
 variable "proxy_instance_type" {
  type    = string
-  default = "m4.large"
+  default = "m7g.large"
 }

 // Instance types used for teleport nodes auto scale groups
 variable "node_instance_type" {
  type    = string
-  default = "t2.medium"
-}
-
-// Instance types used for monitor auto scale groups
-variable "monitor_instance_type" {
-  type    = string
-  default = "m4.large"
+  default = "t4g.medium"
 }

 // SSH key name to provision instances withx
@@ -49,7 +43,7 @@ variable "key_name" {
  type = string
 }

-// DNS and letsencrypt integration variables
+// DNS and Let's Encrypt integration variables
 // Zone name to host DNS record, e.g. example.com
 variable "route53_zone" {
  type = string
@@ -92,12 +86,12 @@ variable "enable_postgres_listener" {
  default = false
 }

-// Email for letsencrypt domain registration
+// Email for Let's Encrypt domain registration
 variable "email" {
  type = string
 }

-// S3 Bucket to create for encrypted letsencrypt certificates
+// S3 Bucket to create for encrypted Let's Encrypt certificates
 variable "s3_bucket_name" {
  type = string
 }
@@ -151,27 +145,6 @@ variable "autoscale_max_write_capacity" {
  default = 100
 }

-// InfluxDB and Telegraf versions
-variable "influxdb_version" {
-  type    = string
-  default = "1.4.2"
-}
-
-variable "telegraf_version" {
-  type    = string
-  default = "1.5.1-1"
-}
-
-variable "grafana_version" {
-  type    = string
-  default = "4.6.3"
-}
-
-// Password for grafana admin user
-variable "grafana_pass" {
-  type = string
-}
-
 // Whether to use Amazon-issued certificates via ACM or not
 // This must be set to true for any use of ACM whatsoever, regardless of whether Terraform generates/approves the cert
 variable "use_acm" {
@@ -195,7 +168,6 @@ variable "allowed_bastion_ssh_ingress_cidr_blocks" {
  default = ["0.0.0.0/0"]
 }

-
 // CIDR blocks allowed for egress from bastion
 variable "allowed_bastion_ssh_egress_cidr_blocks" {
  type    = list(any)
@@ -220,18 +192,6 @@ variable "allowed_auth_egress_cidr_blocks" {
  default = ["0.0.0.0/0"]
 }

-// CIDR blocks allowed for ingress for Teleport Monitor ports
-variable "allowed_monitor_ingress_cidr_blocks" {
-  type    = list(any)
-  default = ["0.0.0.0/0"]
-}
-
-// CIDR blocks allowed for egress from Teleport Monitor
-variable "allowed_monitor_egress_cidr_blocks" {
-  type    = list(any)
-  default = ["0.0.0.0/0"]
-}
-
 // CIDR blocks allowed for egress from Teleport Node
 variable "allowed_node_egress_cidr_blocks" {
  type    = list(any)
@@ -274,8 +234,8 @@ variable "route53_domain_acm_nlb_alias" {
 // This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
 // or GitHub connector configured in DynamoDB. The default if not set is "local".
 // Teleport Community Edition supports "local" or "github"
-// Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
-// Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+// Teleport Enterprise Edition supports "local", "github", "oidc", or "saml"
+// Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml"
 variable "teleport_auth_type" {
  type    = string
  default = "local"
@@ -10,8 +10,8 @@ resource "aws_vpc" "teleport" {

 // Elastic IP for NAT gateways
 resource "aws_eip" "nat" {
-  count = length(local.azs)
-  vpc   = true
+  count  = length(local.azs)
+  domain = "vpc"
  tags = {
    TeleportCluster = var.cluster_name
  }
@@ -14,10 +14,10 @@ TF_VAR_key_name ?=
 TF_VAR_license_path ?=

 # AMI name contains the version of Teleport to install, and whether to use OSS or Enterprise version
-# These AMIs are published by Gravitational and shared as public whenever a new version of Teleport is released
+# These AMIs are published by Teleport (Gravitational) and shared as public whenever a new version of Teleport is released
 # To list available AMIs:
-# OSS: aws ec2 describe-images --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
-# Enterprise: aws ec2 describe-images --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
+# OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*'
+# Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*'
 TF_VAR_ami_name ?=

 # Route 53 zone to use, should be the zone registered in AWS, e.g. example.com
@@ -76,8 +76,8 @@ TF_VAR_use_tls_routing ?= true
 # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
 # or GitHub connector configured in DynamoDB. The default if not set is "local".
 # Teleport Community Edition supports "local" or "github"
-# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
-# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml"
 TF_VAR_teleport_auth_type ?= "local"

 export
@@ -78,9 +78,9 @@ Update the included Makefile to define your configuration.
 # Set up Terraform variables in a separate environment file, or inline here

 # Region to run in - we currently have AMIs in the following regions:
-# ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2
-# sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2
-TF_VAR_region ?= "us-east-1"
+# ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1
+# eu-north-1, eu-west-1, eu-west-2, eu-west-3, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2
+TF_VAR_region ?= "us-west-2"

 # Cluster name is a unique cluster name to use, should be unique and not contain spaces or other special characters
 TF_VAR_cluster_name ?= "TeleportCluster1"
@@ -95,10 +95,10 @@ TF_VAR_license_path ?= "/path/to/license"
 # AMI name contains the version of Teleport to install, and whether to use OSS or Enterprise version
 # These AMIs are published by Teleport and shared as public whenever a new version of Teleport is released
 # To list available AMIs:
-# OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
-# Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
+# OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*'
+# Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-TF_VAR_ami_name ?= "gravitational-teleport-ami-ent-14.3.0"
+TF_VAR_ami_name ?= "teleport-ent-14.3.0-arm64"

 # Route 53 hosted zone to use, must be a root zone registered in AWS, e.g. example.com
 TF_VAR_route53_zone ?= "example.com"
@@ -127,7 +127,7 @@ export TF_VAR_enable_postgres_listener="false"
 export TF_VAR_s3_bucket_name="teleport.example.com"

 # AWS instance type to provision for running this Teleport cluster
-export TF_VAR_cluster_instance_type="t3.micro"
+export TF_VAR_cluster_instance_type="t4g.micro"

 # Email to be used for Let's Encrypt certificate registration process.
 export TF_VAR_email="support@example.com"
@@ -155,8 +155,8 @@ export TF_VAR_use_tls_routing="true"
 # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
 # or GitHub connector configured in DynamoDB. The default is "local".
 # Teleport Community Edition supports "local" or "github"
-# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
-# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml"
 export TF_VAR_teleport_auth_type="local"

 # plan
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-      version = "~> 4.0"
+      version = "~> 5.0"
    }
  }
 }
@@ -25,7 +25,7 @@ data "aws_subnets" "all" {

 data "aws_ami" "base" {
  most_recent = true
-  owners      = [126027368216]
+  owners      = [146628656107]

  filter {
    name   = "name"
@@ -5,4 +5,4 @@ resource "aws_ssm_parameter" "license" {
  type      = "SecureString"
  value     = file(var.license_path)
  overwrite = true
-}
+}
@@ -127,8 +127,8 @@ variable "cluster_instance_type" {
 // This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
 // or GitHub connector configured in DynamoDB. The default if not set is "local".
 // Teleport Community Edition supports "local" or "github"
-// Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
-// Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+// Teleport Enterprise Edition supports "local", "github", "oidc", or "saml"
+// Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml"
 variable "teleport_auth_type" {
  type    = string
  default = "local"