* Add the dynamodbutils and stsutils packages
* Use stsutils.NewFromConfig()
* Use stsutils.NewV1()
* Use dynamodbutils.IsFIPSEnabled()
* Add forbidigo rules
* Appease linter
This eliminates all remaining references to AWS SDK v1 in the
lib/srv/db/... and lib/srv/discovery/... packages.
Most of the changes are simply to remove dead code.
Go 1.23.5 changed the certificate (added another host), and the
thumbprint is now different.
Instead of updating the thumbprint, we now rely on the presented
certificate by the TLS Server.
This should ensure the test doesn't break again if the test certificate
is changed again.
* Remove EICE dead code
Accessing EC2 instances using EC2 Instance Connect Endpoint was
developed some releases ago.
However, due to strict quotas put in place by amazon, we decide to
remove this feature.
Since a couple of releases ago we hide this feature from the UI.
This PR removes dead code:
- removes the UI bits used during the Discovery flow
- removes the `teleport integrationn configure eice-iam` command
- removes API endpoinst that are no longer used
- deprecates the unused gRPC calls
The following parts were kept, to ensure we don't break existing set
ups:
- auto discovery of ec2 instances using the EICE method
- accessing Servers which have the ec2-ice subkind
- kubernetes operator and terraform provider EICE resource management
We might remove those in the future, but for now, they will be kept.
* add delete version notice
* Initial command to create the managed identity and role
* Adding permissions and applying command params
* Adding graph permissions to the MSI
* Updating parameters
* Adding some details and cleaning up comments
* Fixing go.sum
* Linting
* License
* PR feedback
* Decoupling sync config with an interface for testing
* Tweaks to test mocking
* PR feedback
* Rebase adjustments
* PR feedback
* Switch to empty struct maps instead of bool maps for set representation
* Godocs
* Adding user agent to Azure SDK requests
* Linting
Calling the AWS API `ecs:ListServices` with a non-existent ECS Cluster
name will return a 400 w/ ClusterNotFoundException.
The existing code was not handling that error and a raw error was
returned.
This PR changes the logic to ensure that case is handled and that the
ListDeployedDatabaseServices returns an empty list.
An alternative would be to call the ListClusters beforehand, but that
would increase the number of API calls we do to external services.
This replaces awsconfig.WithIntegrationCredentialProvider option with the
awsconfig.WithOIDCIntegrationClient option.
This solves a chicken/egg problem with AWS config loading - callers no
longer need to load AWS config (to create a credential provider) to load
AWS config.
The OIDCIntegrationClient interface is also much simpler to implement.
This also adds default option overrides when creating an awsconfig.Cache.
For now, this is used to add an OIDCIntegrationClient when creating the
cache so that dependent callers don't have to.
* fix: allow CredentialCache.Retrieve to return before initialization
Fixes#50747
This PR adds an option to allow CredentialsCache.Retrieve to return with
an error before CredentialsCache.SetGenerateOIDCTokenFn has been called.
We have been relying on this behaviour for Auth service startup, because
the credential cache is a dependency for the audit storage, which is a
dependency for the auth server, which is a dependency for the credential
cache's GenerateOIDCTokenFn.
Some non-critical checks during auth startup must fail instead of
hanging on blocking the process from successfully starting.
* use default io timeout
* synchronize access to generateOIDCTokenFn
* fix: access graph fails to fetch s3 bucket details
With SDK V1, AWS get bucket details such as policies, acls, status...
didn't require the specification of the target s3 bucket location. With
the recent changes to support newer versions of the AWS SDK, the get
bucket details started to fail with the following error:
```
BucketRegionError: incorrect region, the bucket is not in 'ap-south-1' region at endpoint '', bucket is in 'eu-central-1' region
status code: 301, request id: QS5C24H12ZV3VNM4, host id: mzVDk4010MPTCFdxyE/XwERX9W35MSge85PG+h5Jvwyvi7MhxdXLaysb2PTZCMY9r1ngBi6Gv6g=, failed to fetch bucket "cyz" acls polic
```
This PR uses `HeadBucket` to retrieve the location of the s3 bucket and
then uses the bucket location client to retrieve the s3 bucket details.
Fixes#50757
* fix tests
* handle review comments
* AWS OIDC: List Deployed Database Services HTTP API
This PR adds a new endpoint which returns the deployed database
services.
Calling the ECS APIs requires a region, so we had to iterate over the
following resources to collect the relevant regions:
- databases
- database services
- discovery configs
* extract loops
* improve config parse and moved endpoint to a GET
* revert http verb for listing
* remove pointer
* AWS OIDC: List Deployed Database Services - implementation
This PR implements the List Deployed Database Services.
This will be used to let the user know which deployed database services
were deployed during the Enroll New Resource / RDS flows.
* validate region for dashboard url
* UserTasks for Discover EKS: create tasks when auto enrolling fails
This PRs changes the DiscoveryService to ensure it creates UserTasks
when EKS Clusters fail to auto-enroll.
* simplify types
After running this flow a couple more times, we discovered that some
times it takes longer than 25s.
From multiple tests we found out that it can take up to 30s.
Instead of setting that as the wait time, we add a little more to ensure
we are more resilient.
Entra sometimes sends the OptionClaims when retrieving a certain application if only SAML2Token is set, other times it doesn't return them.
This PR fills all id and access token values so entra doesn't fail to send the optional token value.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
At a previous PR we added two new fields in the UI and backend, but
failed to add them to the layers in between (grpc service).
This PR adds them and also fixes a typo on the EndpointPublicAccess
field name.
During the EKS Enrollment in the Discover wizard, when listing clusters,
check for pre-reqs when showing available clusters.
1. When in Cloud, only allow enrollment if the cluster has a Public
Endpoint for configuration.
1. Only show clusters which have the API authentication mode enabled
(either API only or API_AND_CONFIG_MAP).
* Discover EKS: handle 'CONFIG_MAP' authentication mode gracefully
EKS Cluster Access Config's Authentication mode can be set to one of:
- API
- API_AND_CONFIG_MAP
- CONFIG_MAP
Teleport requires either API or API_AND_CONFIG_MAP to install the helm
chart.
This PR checks this value before trying to install the helm chart.
This way the user is presented with a better error message.
* use vars coming from ekstypes
* AWS IC SDK
* awsoidc credprovider package
* go mod tidy on integrations
* place aws-sdk-v2 imports together
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* [entraid] add setup script for offline clusters.
This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible.
The UX is the following:
```text
Step 1: Run the Setup Script
1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility.
2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar.
3. Once uploaded, execute the script by running the following command:
$ bash entraid.sh
**Important Considerations**:
- You must have **Azure privileged administrator permissions** to complete the integration.
- Ensure you're using the **Bash** environment in Cloud Shell.
- During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials.
- **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended.
Once the script completes, type 'continue' to proceed, 'exit' to quit: continue
Step 2: Input Tenant ID and Client ID
With the output of Step 1, please copy and paste the following information:
Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Successfully created EntraID plugin "name".
```
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* move function to api
* handle code review comments
* Apply suggestions from code review
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* fix url
* enable group claims
* add godoc
* handle code review comments
* fix gomod
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* AWS OIDC Ping: allow custom ARN
This PR changes the Ping method to accept a custom ARN.
This is meant to be used by WebUI to do a health check for the
integration:
- when creating
- when editing
- when selecting during Discover flows
If the Ping method receives an ARN, it will use that value instead of
using the one stored in the backend.
* rename arn to roleArn
* rename arn to role_arn
---------
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* Moves and exposes the AWS OIDC credentials cache
The IdentityCenter integration users OIDC to authenticate with AWS, and so
will re-use the existing OIDC credential caching code used by the external
audit storage package.
This change
- extracts the credential cache from the `externalauditstorage` package,
- moves it to the `awsoidc` package to indicate that is generally useful, not
just for storage access), and
- makes it public.
This patch also copies the applicable cache tests from `externalauditstorage`. The
credential cache tests in `externalauditstorage` have been preserved because they
also test backwards compatibility with AWS SDK v1 credential provider, which the
new tests do not.
* Test fixup
* Linter fixups
* Remove ttlValuer
* Apply suggestions from code review
Co-authored-by: Marek Smoliński <marek@goteleport.com>
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* feat: adds a new 'policy-preset' flag to 'integration configure awsoidc-idp' command
* adapt to new awsactions
* output formatting and golden test
* run ui prettier, fix getAwsOidcConfigureIdpScriptUrl test
* comments cleanup, mend TestBuildAWSOIDCIdPConfigureScript test
* address review:
- use AwsOidcPolicyPreset in UrlAwsOidcConfigureIdp
- use NoSuchEntityException instead of EntityAlreadyExistsException in PutRolePolicy mock
- fix typo
* use empty string as unspecified value
* add optional field comment
* Merge branch 'master' of github.com:gravitational/teleport into sshah/aws-oidc-preset-policy
* Revert "Merge branch 'master' of github.com:gravitational/teleport into sshah/aws-oidc-preset-policy"
This reverts commit ad2a0904e9.
* integration configure commands prompt for changes
This applies to the following "teleport integration configure" subcommands:
* deployservice-iam
* eice-iam
* ec2-ssm-iam
* aws-app-access-iam
* eks-iam
* access-graph
* listdatabases-iam
These commands will now describe the actions they will take, the
resources that will be created/configured, and will by default prompt
the user to confirm the changes.
Confirmation prompt can be skipped by passing the new --confirm flag.
The confirmation prompt is enabled by default because the most common
case, if not the only case, where a user runs these commands is via an
opaque "bash -c $(curl ...)" script generated by a web UI enrollment
wizard.
* address feedback
* fix test
* pluralize only when there are multiple actions
* remove leading newline from func body
* remove extra newline in ec2 iam configure request
* improve --confirm flag description
* fix test
* remove extraneous else
* dont display escaped ssm doc for op plan
Applies to the integration command that the web UI discover flows tell
users to run in AWS CloudShell to setup the AWS OIDC identity provider:
teleport integration configure awsoidc-idp
The command describes itself, its actions, and the desired state after
it runs. It then prompts the user (by default) to confirm the action
plan before proceeding.
The confirmation prompt can be overridden with cli flag --confirm
if desired.
The IAM role it configures is no longer required to have the "ownership"
tags that teleport applies if it's created by teleport, since the user is
now prompted for confirmation before making changes.
This allows a user to configure an existing IAM role without tagging the
role for configuration by teleport.
The command will still attempt to ensure the IAM role it configures has
teleport tags, but failing to do so is only a warning.
