diff --git a/CHANGELOG.md b/CHANGELOG.md index 5eeea323922..56bf8efbb1a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1847,7 +1847,7 @@ This is a minor Teleport release with a focus on new features and bug fixes. ### Improvements * Alpha: Enhanced Session Recording lets you know what's really happening during a Teleport Session. [#2948](https://github.com/gravitational/teleport/issues/2948) -* Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. [Read the docs](./docs/pages/enterprise/workflow). [#3006](https://github.com/gravitational/teleport/issues/3006) +* Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. [Read the docs](./docs/pages/access-controls/access-requests.mdx). [#3006](https://github.com/gravitational/teleport/issues/3006) * Beta: Teleport provides HA Support using Firestore and Google Cloud Storage using Google Cloud Platform. [Read the docs](./docs/pages/setup/deployments/gcp.mdx). [#2821](https://github.com/gravitational/teleport/pull/2821) * Remote tctl execution is now possible. [Read the docs](./docs/pages/setup/reference/cli.mdx#tctl). [#1525](https://github.com/gravitational/teleport/issues/1525) [#2991](https://github.com/gravitational/teleport/issues/2991) diff --git a/docs/config.json b/docs/config.json index 8637be58ac8..66871cacf9c 100644 --- a/docs/config.json +++ b/docs/config.json @@ -734,7 +734,7 @@ "slug": "/access-controls/getting-started/" }, { - "title": "Guides", + "title": "Cluster Access and RBAC", "slug": "/access-controls/guides/", "entries": [ { @@ -773,6 +773,46 @@ } ] }, + { + "title": "Access Requests", + "slug": "/access-controls/access-requests/", + "entries": [ + { + "title": "Role Requests", + "slug":"/access-controls/access-requests/role-requests/" + }, + { + "title": "Resource Requests", + "slug":"/access-controls/access-requests/resource-requests/" + } + ] + }, + { + "title": "Access Request Plugins", + "slug": "/access-controls/access-request-plugins/", + "entries": [ + { + "title": "Mattermost", + "slug":"/access-controls/access-request-plugins/ssh-approval-mattermost/" + }, + { + "title": "PagerDuty", + "slug":"/access-controls/access-request-plugins/ssh-approval-pagerduty/" + }, + { + "title": "Jira Server", + "slug":"/access-controls/access-request-plugins/ssh-approval-jira-server/" + }, + { + "title": "Jira Cloud", + "slug":"/access-controls/access-request-plugins/ssh-approval-jira-cloud/" + }, + { + "title": "Slack", + "slug":"/access-controls/access-request-plugins/ssh-approval-slack/" + } + ] + }, { "title": "Reference", "slug": "/access-controls/reference/" @@ -1393,6 +1433,46 @@ "source": "/setup/admin/graceful-restarts/", "destination": "/setup/admin/upgrading-the-teleport-binary/", "permanent": true + }, + { + "source": "/enterprise/workflow/", + "destination": "/access-controls/access-requests/", + "permanent": true + }, + { + "source": "/enterprise/workflow/ssh-approval-mattermost/", + "destination": "/access-controls/access-request-plugins/ssh-approval-mattermost/", + "permanent": true + }, + { + "source": "/enterprise/workflow/ssh-approval-mattermost/", + "destination": "/access-controls/access-request-plugins/ssh-approval-pagerduty/", + "permanent": true + }, + { + "source": "/enterprise/workflow/ssh-approval-jira-server/", + "destination": "/access-controls/access-request-plugins/ssh-approval-jira-server/", + "permanent": true + }, + { + "source": "/enterprise/workflow/ssh-approval-jira-cloud/", + "destination": "/access-controls/access-request-plugins/ssh-approval-jira-cloud/", + "permanent": true + }, + { + "source": "/enterprise/workflow/ssh-approval-slack/", + "destination": "/access-controls/access-request-plugins/ssh-approval-slack/", + "permanent": true + }, + { + "source": "/enterprise/workflow/resource-requests/", + "destination": "/access-controls/access-requests/resource-requests/", + "permanent": true + }, + { + "source": "/enterprise/workflow/role-requests/", + "destination": "/access-controls/access-requests/role-requests/", + "permanent": true } ] } diff --git a/docs/pages/access-controls/access-request-plugins/index.mdx b/docs/pages/access-controls/access-request-plugins/index.mdx new file mode 100644 index 00000000000..43638ffa410 --- /dev/null +++ b/docs/pages/access-controls/access-request-plugins/index.mdx @@ -0,0 +1,12 @@ +--- +title: Just-in-Time Access Request Plugins +description: "Use Teleport's Access Request plugins to least-privilege access without sacrificing productivity." +layout: tocless-doc +--- + +Teleport Just-in-Time Access Requests allow users to receive temporary elevated +privileges by seeking consent from one or more reviewers, depending on your +configuration. + +(!docs/pages/includes/access-request-integrations.mdx!) + diff --git a/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx b/docs/pages/access-controls/access-request-plugins/ssh-approval-jira-cloud.mdx similarity index 100% rename from docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx rename to docs/pages/access-controls/access-request-plugins/ssh-approval-jira-cloud.mdx diff --git a/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx b/docs/pages/access-controls/access-request-plugins/ssh-approval-jira-server.mdx similarity index 100% rename from docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx rename to docs/pages/access-controls/access-request-plugins/ssh-approval-jira-server.mdx diff --git a/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx b/docs/pages/access-controls/access-request-plugins/ssh-approval-mattermost.mdx similarity index 100% rename from docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx rename to docs/pages/access-controls/access-request-plugins/ssh-approval-mattermost.mdx diff --git a/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx b/docs/pages/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx similarity index 100% rename from docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx rename to docs/pages/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx diff --git a/docs/pages/enterprise/workflow/ssh-approval-slack.mdx b/docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx similarity index 99% rename from docs/pages/enterprise/workflow/ssh-approval-slack.mdx rename to docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx index 6f2a4897ad6..45d9810afe9 100644 --- a/docs/pages/enterprise/workflow/ssh-approval-slack.mdx +++ b/docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx @@ -527,12 +527,11 @@ $ sudo systemctl enable teleport-slack $ sudo systemctl start teleport-slack ``` - ## Next steps - Read our guides to configuring [Resource Access - Requests](./resource-requests.mdx) and [Role Access - Requests](./role-requests.mdx) so you can get the most out + Requests](../access-requests/resource-requests.mdx) and [Role Access + Requests](../access-requests/role-requests.mdx) so you can get the most out of your Access Request plugins. ## Feedback diff --git a/docs/pages/enterprise/workflow/index.mdx b/docs/pages/access-controls/access-requests.mdx similarity index 50% rename from docs/pages/enterprise/workflow/index.mdx rename to docs/pages/access-controls/access-requests.mdx index eb024e84e35..08800eade27 100644 --- a/docs/pages/enterprise/workflow/index.mdx +++ b/docs/pages/access-controls/access-requests.mdx @@ -1,16 +1,22 @@ --- -title: Just-in-time Access Requests +title: Just-in-Time Access Requests description: Teleport allows users to request new access capabilities from the CLI or UI. Requests can be escalated via ChatOps or anywhere else via our flexible Authorization Workflow API. -h1: Teleport Just-in-time Access Requests +layout: tocless-doc --- -Teleport Just-in-time Access Requests allow any developer to request access to +Teleport Just-in-Time Access Requests allow any user to request access to a resource or role depending on need. The request can then be approved or denied based on a configurable number of approvers. +Just-in-Time Access Requests are a powerful way to implement the principle of +least privilege in your organization, leaving an attacker with no permanent +admins to target. Users receive elevated privileges for a limited period of +time. And aside from their reviewer privileges, users who review requests can +have limited access to cluster resources. + -Just-in-time Access Requests are a feature of Teleport Enterprise. +Just-in-Time Access Requests are a feature of Teleport Enterprise. Open-source Teleport users can get a preview of how Access Requests work by requesting a role via the Teleport CLI. Full Access Request functionality, including Resource Access Requests and an intuitive and searchable UI are @@ -20,11 +26,10 @@ available in Teleport Enterprise. ## Resource Access Requests -Resource Access Requests follow the principle of least privilege. On teams -leveraging Teleport, engineers can easily get access to only the individual -resources they need, when they need it. +With Resource Access Requests, engineers can easily get access to only the +individual resources they need, when they need it. -[Get started with Resource Access Requests](./resource-requests.mdx). +[Get started with Resource Access Requests](./access-requests/resource-requests.mdx). ## Role Access Requests @@ -32,9 +37,4 @@ Role Access Requests balance security and flexibility. Engineers can request temporary credentials with elevated roles in order to perform critical system-wide tasks. -[Get started with Role Access Requests](./role-requests.mdx). - - -## Integrating with an External Tool -(!docs/pages/includes/access-request-integrations.mdx!) - +[Get started with Role Access Requests](./access-requests/role-requests.mdx). diff --git a/docs/pages/enterprise/workflow/resource-requests.mdx b/docs/pages/access-controls/access-requests/resource-requests.mdx similarity index 100% rename from docs/pages/enterprise/workflow/resource-requests.mdx rename to docs/pages/access-controls/access-requests/resource-requests.mdx diff --git a/docs/pages/enterprise/workflow/role-requests.mdx b/docs/pages/access-controls/access-requests/role-requests.mdx similarity index 100% rename from docs/pages/enterprise/workflow/role-requests.mdx rename to docs/pages/access-controls/access-requests/role-requests.mdx diff --git a/docs/pages/access-controls/guides.mdx b/docs/pages/access-controls/guides.mdx index 294df91c17f..030ca194167 100644 --- a/docs/pages/access-controls/guides.mdx +++ b/docs/pages/access-controls/guides.mdx @@ -1,36 +1,40 @@ --- -title: Access Controls Guides -description: Detailed guides for configuring Teleport Access Controls. +title: Configure Access +description: How to configure access to specific resources in your infrastructure or your Teleport cluster as a whole. layout: tocless-doc --- - +Teleport gives you fine-grained control over who can access resources in your +infrastructure as well as how they can access those resources. Once you have +deployed a Teleport cluster, configure access controls to achieve the right +security policies for your organization. + + + + Protect access to critical resources with dual authorization. + + + Set up dynamic access policies with role templates. + + + Create certificates for other users with impersonation. + + + Use passwordless authentication (Preview). + + + Add two-factor authentication through WebAuthn. + + + Per-session multi-mactor authentication. + + + Lock access to active user sessions or hosts. + + + Require session auditors and allow fine-grained live session access. + + + diff --git a/docs/pages/access-controls/guides/dual-authz.mdx b/docs/pages/access-controls/guides/dual-authz.mdx index 1419efade97..cc00e3e2794 100644 --- a/docs/pages/access-controls/guides/dual-authz.mdx +++ b/docs/pages/access-controls/guides/dual-authz.mdx @@ -22,7 +22,7 @@ of two team members for a privileged role `dbadmin`. - The steps below describe how to use Teleport with Mattermost. You can also [integrate with many other providers](../../enterprise/workflow/index.mdx). + The steps below describe how to use Teleport with Mattermost. You can also [integrate with many other providers](../access-requests.mdx). ## Prerequisites diff --git a/docs/pages/access-controls/guides/locking.mdx b/docs/pages/access-controls/guides/locking.mdx index b172998a312..cdc7801d099 100644 --- a/docs/pages/access-controls/guides/locking.mdx +++ b/docs/pages/access-controls/guides/locking.mdx @@ -32,7 +32,7 @@ A lock can target the following objects or attributes: - a Teleport Node by the Node's UUID (effectively unregistering it from the cluster) - a Windows desktop by the desktop's name -- an [Access Request](../../enterprise/workflow/index.mdx) by UUID +- an [Access Request](../access-requests.mdx) by UUID ## Prerequisites diff --git a/docs/pages/api/introduction.mdx b/docs/pages/api/introduction.mdx index 771b8a3288b..9784538bb6d 100644 --- a/docs/pages/api/introduction.mdx +++ b/docs/pages/api/introduction.mdx @@ -13,7 +13,7 @@ to programatically interact with the API. [tsh and tctl](../setup/reference/cli. Here is what you can do with the Go Client: - Integrating with external tools, which we have already done - for [several tools](../enterprise/workflow/index.mdx#integrating-with-an-external-tool), + for [several tools](../access-controls/access-request-plugins/index.mdx), such as Slack, Jira, and Mattermost. - Writing a program/bot to manage Access Requests automatically, based on your use case. One idea is to allow/deny developer requests based on their currently assigned tasks. diff --git a/docs/pages/architecture/authorization.mdx b/docs/pages/architecture/authorization.mdx index 31a8996a8b7..b5a47132306 100644 --- a/docs/pages/architecture/authorization.mdx +++ b/docs/pages/architecture/authorization.mdx @@ -374,7 +374,7 @@ spec: - [Access Control Reference](../access-controls/reference.mdx). - [Teleport Predicate Language](../setup/reference/predicate-language.mdx). -- [Access Requests Guides](../enterprise/workflow/index.mdx) +- [Access Requests Guides](../access-controls/access-requests.mdx) - [Architecture Overview](overview.mdx) - [Teleport Auth](authentication.mdx) - [Teleport Nodes](nodes.mdx) diff --git a/docs/pages/database-access/introduction.mdx b/docs/pages/database-access/introduction.mdx index a3b22ce8f68..d118352d1fb 100644 --- a/docs/pages/database-access/introduction.mdx +++ b/docs/pages/database-access/introduction.mdx @@ -11,7 +11,7 @@ Some of the things you can do with Database Access: - Users can retrieve short-lived database certificates using single sign-on flow thus maintaining their organization-wide identity. - Configure role-based access controls for databases and implement custom - [Access Request](../enterprise/workflow/index.mdx) workflows. + [Access Request](../access-controls/access-requests.mdx) workflows. - Capture database access events as well as query activity in the audit log. Database Access currently supports the following databases: diff --git a/docs/pages/enterprise/introduction.mdx b/docs/pages/enterprise/introduction.mdx index fd04211c5de..389459cbcd1 100644 --- a/docs/pages/enterprise/introduction.mdx +++ b/docs/pages/enterprise/introduction.mdx @@ -15,7 +15,7 @@ The table below gives a quick overview of the benefits of Teleport Enterprise. | Teleport Enterprise Feature | Description | | - | - | | [Single Sign-On (SSO)](#sso) | Allows Teleport to integrate with existing enterprise identity systems. Examples include Active Directory, GitHub, Google Apps and numerous identity middleware solutions like Auth0, Okta, and so on. Teleport supports SAML and OAuth/OpenID Connect protocols to interact with them. | -| [Access Requests](workflow/index.mdx) | User interface for teams to create and review requests to access infrastructure with escalated privileges. | +| [Access Requests](../access-controls/access-requests.mdx) | User interface for teams to create and review requests to access infrastructure with escalated privileges. | | [FedRAMP/FIPS](#fedrampfips) | Access controls to meet the requirements in a FedRAMP System Security Plan (SSP). This includes a FIPS 140-2 friendly build of Teleport Enterprise as well as a variety of improvements to aid in complying with security controls even in FedRAMP High environments. | | [Hardware Security Module support](./hsm.mdx)|The Teleport Auth Service can use your organization's HSM to generate TLS credentials, ensuring a highly reliable and secure public key infrastructure.| | [Moderated Sessions](../access-controls/guides/moderated-sessions.mdx)|Allow or require moderators to be present in SSH or Kubernetes sessions.| @@ -82,7 +82,8 @@ See our [FedRAMP for SSH and Kubernetes](fedramp.mdx) guide for more information With Teleport we've introduced the ability for users to request additional roles. The Access Request API makes it easy to dynamically approve or deny these requests. -See [Access Requests Guide for more information](workflow/index.mdx) +See [Access Requests Guide for more +information](../access-controls/access-requests.mdx) ## Hardware Security Module support diff --git a/docs/pages/enterprise/soc2.mdx b/docs/pages/enterprise/soc2.mdx index 28830dfafd8..e9d7c53b5c0 100644 --- a/docs/pages/enterprise/soc2.mdx +++ b/docs/pages/enterprise/soc2.mdx @@ -59,10 +59,10 @@ Each principle has many “Points of Focus” which will apply differently to di | CC6.1 - Manages Credentials for Infrastructure and Software | New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. | [Invite nodes to your cluster with short lived tokens](../setup/admin/adding-nodes.mdx) | | CC6.1 - Uses Encryption to Protect Data | The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. | Teleport Audit logs can use DynamoDB encryption at rest. | | CC6.1 - Protects Encryption Keys | Processes are in place to protect encryption keys during generation, storage, use, and destruction. | Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA and rotated automatically | -| CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system's asset owner or authorized custodian. | [Request Approval from the command line](../setup/reference/cli.mdx#tctl-request-approve) | [Build Approval Workflows with Access Requests](./workflow/index.mdx) | [Use Plugins to send approvals to tools like Slack or Jira](./workflow/index.mdx) | | | -| CC6.2 - Removes Access to Protected Assets When Appropriate | Processes are in place to remove credential access when an individual no longer requires such access. | [Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window](./workflow/index.mdx) | +| CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system's asset owner or authorized custodian. | [Request Approval from the command line](../setup/reference/cli.mdx#tctl-request-approve) | [Build Approval Workflows with Access Requests](../access-controls/access-requests.mdx) | [Use Plugins to send approvals to tools like Slack or Jira](../access-controls/access-requests.mdx) | | | +| CC6.2 - Removes Access to Protected Assets When Appropriate | Processes are in place to remove credential access when an individual no longer requires such access. | [Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window](../access-controls/access-requests.mdx) | | CC6.2 - Reviews Appropriateness of Access Credentials | The appropriateness of access credentials is reviewed on a periodic basis for unnecessary and inappropriate individuals with credentials. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | -| CC6.3 - Creates or Modifies Access to Protected Information Assets | Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. | [Build Approval Workflows with Access Requests](./workflow/index.mdx) to get authorization from asset owners. | +| CC6.3 - Creates or Modifies Access to Protected Information Assets | Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. | [Build Approval Workflows with Access Requests](../access-controls/access-requests.mdx) to get authorization from asset owners. | | CC6.3 - Removes Access to Protected Information Assets | Processes are in place to remove access to protected information assets when an individual no longer requires access. | Teleport uses temporary credentials and can be integrated with your version control system or even your HR system to [revoke access with the Access requests API](../api/introduction.mdx) | | CC6.3 - Uses Role-Based Access Controls | Role-based access control is utilized to support segregation of incompatible functions. | [Role based access control ("RBAC") allows Teleport administrators to grant granular access permissions to users.](../access-controls/introduction.mdx) | | CC6.3 - Reviews Access Roles and Rules | The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals with access and access rules are modified as appropriate. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | diff --git a/docs/pages/includes/access-request-integrations.mdx b/docs/pages/includes/access-request-integrations.mdx index a2740c48cfb..5a6175f966d 100644 --- a/docs/pages/includes/access-request-integrations.mdx +++ b/docs/pages/includes/access-request-integrations.mdx @@ -1,11 +1,11 @@ -Admins can review Just-in-time Access Requests via a third-party communication -service. The Access Request API makes it easy to dynamically approve or deny -these requests. +With Teleport's Access Request plugins, users can request, +approve, and deny access without leaving your organization's existing messaging +and project management solutions. | Integration | Feature | Type | Setup Instructions | | - | - | - | - | -| Slack | | Chatbot | [Setup Slack](/docs/enterprise/workflow/ssh-approval-slack.mdx) | -| Mattermost | | Chatbot | [Setup Mattermost](/docs/enterprise/workflow/ssh-approval-mattermost.mdx) | -| Jira Server | | Project Board | [Setup Jira Server](/docs/enterprise/workflow/ssh-approval-jira-server.mdx) | -| Jira Cloud | | Project Board | [Setup Jira Cloud](/docs/enterprise/workflow/ssh-approval-jira-cloud.mdx) | -| PagerDuty | | Schedule | [Setup PagerDuty](/docs/enterprise/workflow/ssh-approval-pagerduty.mdx) | +| Slack | | Chatbot | [Set up Slack](/docs/enterprise/workflow/ssh-approval-slack.mdx) | +| Mattermost | | Chatbot | [Set up Mattermost](/docs/enterprise/workflow/ssh-approval-mattermost.mdx) | +| Jira Server | | Project Board | [Set up Jira Server](/docs/enterprise/workflow/ssh-approval-jira-server.mdx) | +| Jira Cloud | | Project Board | [Set up Jira Cloud](/docs/enterprise/workflow/ssh-approval-jira-cloud.mdx) | +| PagerDuty | | Schedule | [Set up PagerDuty](/docs/enterprise/workflow/ssh-approval-pagerduty.mdx) | diff --git a/docs/pages/setup/security/reduce-blast-radius.mdx b/docs/pages/setup/security/reduce-blast-radius.mdx index 42b0b0e0982..fc398fdac8a 100644 --- a/docs/pages/setup/security/reduce-blast-radius.mdx +++ b/docs/pages/setup/security/reduce-blast-radius.mdx @@ -288,7 +288,7 @@ Two `user`s can grant elevated privileges to another `user` temporarily without - [Per-session MFA](../../access-controls/guides/per-session-mfa.mdx) - [Dual authorization](../../access-controls/guides/dual-authz.mdx) - [Role templates, allow/deny rules, and traits](../../access-controls/guides/role-templates.mdx) -- [Access requests and plugins](../../enterprise/workflow/index.mdx) +- [Access Requests](../../access-controls/access-requests.mdx) ### Background reading - [Authentication connectors](../reference/authentication.mdx)