In order to provide better validation when installing the IC integration via `tctl`,
this patch moves some IC-specific validation tools from `teleport.e` to
into the OSS repository.
* Add the dynamodbutils and stsutils packages
* Use stsutils.NewFromConfig()
* Use stsutils.NewV1()
* Use dynamodbutils.IsFIPSEnabled()
* Add forbidigo rules
* Appease linter
This eliminates the SigningService in favor of a free function
SignRequest, which eliminates AWS credential loading and simplifies the
AWS utils package.
In the process of doing this refactor, the AWS app handler has been
changed to use AWS SDK v2 to load its credentials as well.
* refactor(opensearch): use aws config provider for signing service
* test(opensearch): cleanup unused code
* fix: accept a base role on the signing service
* feat(aws): provide a way to use different external id for role
* add external ID
---------
Co-authored-by: STeve Huang <xin.huang@goteleport.com>
* Fix AWS SigV4 parsing
Parsing the AWS SigV4 Authorization header no longer requires spaces
between the components - only the comma delimiter is required.
* add test case for empty signed header list
This only converts the places in the utils package that were
logging with logrus, but it does not fully remove the logrus
package as a dependency. The package is home to the logrus text
formatter which needs to exist until slog is the only logging
mechanism in use.
The AWS endpoint sanititazion was inadvertantly being applied all
the time, causing configurations not using custom endpoints to be
forced into using a custom endpoint instead of AWS.
There is a slight behavior change in aws-sdk-go-v2 regarding custom
endpoints. The new sdk requires the endpoints to be a valid URI, and
the legacy sdk would allow a hostname only enpoint and automatically
apply a scheme. To prevent breaking existing configurations when
upgrading to v17, we now have to apply the same logic to endpoints
manually that the legacy sdk used to apply for us.
Closes https://github.com/gravitational/teleport/issues/48760.
When migrating the S3 events handler to use aws-sdk-go-v2 applying
the FIPS settings and custom endpoint were inadvertently dropped.
This restores the functionality, while also adding tests to ensure
that they are always respected going forward.
A similar test was added to the dynamodb events handler as well to
prevent any regressions with FIPS settings there.
* migrate aws configurator to sdk v2
* rename package imports with lowercase
* export iam client interface
* mock loading aws config
* remove underscore from test name
* remove loop var reassignment
* Add AWS AccountID to IAM Roles in AWS App Access
* add story
* Use named export
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Allow dynamic AWS Session provider
Up until now, all the AWS Sessions were generated using the ambient
credentials.
This PRs changes this and allows for custom AWS Session Providers.
This will allow the Session to be created from an Integration.
Another PR will be created where this is used to allow AWS OIDC to be
used as an AWS Session Provider.
* typo
It was discovered that some customers' EKS clusters did not have their IMDSv2 hop limits
set correctly, causing requests for key functionality to attempt IMDSv1 fallback and failing.
For now, re-enable IMDSv1 fallback by way of removing the explicit disabling of
`EC2MetadataEnableFallback` until better documentation, error handling, and other work
can be done to inform customers that they need to correctly set their IMDSv2 hop limits.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
Two changes to AWS SDK usage:
Teleport should never use AWS IMDSv1 for requests, so disable the
ability to fallback to it, as it could be a malicious attempt to
downgrade security.
Teleport generally prefers FIPS endpoints when in FIPS mode, but
there were a few places that were not selecting the FIPS endpoints.
Ensure that the FIPS endpoints if BoringCrypto is being used.
If the upload completer fails due to a permissions error, emit a
warning indicating that the upload completer will not function
properly, but suppress the stack trace.
Closes#28999
* feat: support authenticating with AWS IAM for MongoDB Atlas
* chore(lint): fix errors
* test(tsh): add missing database field
* refactor(mongodb): check for error on each authenticator branch
* refactor(mongodb): update log messages and atlas check
* refactor(auth): use IsRoleARN helper instead of IsARN
* chore(db): remove unused line
* chore(mongodb): split authenticator func
* refactor(db): rename get atlas token function
* tests(db): reuse already existent auth property
* chore(mongodb): add docs reference
* refactor(db): support role chaining
* feat(types): "require" iam role for atlas users
* refactor(db): use external id only on the first session
* refactor(services): add new database matcher for regular users and aws
* chore(db): rename functions to be more assertive
* chore(types): fix lint
* test(db): remove duplicated test
The test being removed here is covered by `TestMongoDBAtlas`
(lib/srv/db/auth_test.go).
* log a warning when an invalid AWS IAM role ARN is filtered out
* add tests for nested role arn path and remove superfluous test parallelism
* add extra godoc info for BuildRoleARN
* improve mock IAM error messages
- Failing tests' error messages were not specific enough to know what
happened.
* refactor code to call GetAWS() once
- Avoids constantly fetching a full copy of the AWS metadata.
- Reduces verbosity of code.
* reuse MetadataFromRedshiftCluster in meta fetcher
- Avoids repeating the same logic inside the fetcher.
* improve database-access DynamoDB config checking
- Don't early return from database CheckAndSetDefaults so AWS account ID
is checked properly, and any other future checks added will apply to
DynamoDB as well.
* add aws utils for parsing AWS IAM roles
- ParseRoleARN will parse an AWS ARN and verify that it is a valid
AWS IAM Role resource
- CheckARNPartitionAndAccount is a helper that verifies an ARN partition
and account ID matches the caller's expectations.
* use cmp.Diff instead of require.Equal in db tests
- require.Equal spams a lot of protobuf noise.
- cmp.Diff yields a precise, readable diff on test failure.
When the AWS Account ID is provided, we must check that it is a valid
one.
AWS Account ID is a well documented field: 12-digit string
This check is meant to prevent typos when creating Databases mainly from
the Web UI in the context of Teleport Discover.
* Move logic out of RoundTrip and into ServeHTTP as a middleware before handing off to oxy forwarder
* Move AWS signing service code into lib/utils/aws/signing.go
* use app server close context for audit event emitting
* add go doc comments.
* refactor request rewriting to make the copy in a more robust way.
* pass status code as uint32 rather than casting in audit emitter
* clone request instead of making a new request, and rewrite url to force https
* update header handling
* Set oxy forwarder to PassHostHeader=false to ensure the host header is
the URL being sought.
* Remove code that deleted forwarding headers previously, we should keep
those (X-Forwarded-*).
* Audit log the AWS Host sought rather than the incoming request Host
header (prior behavior maintained, we just rewrite the request
differently using Clone).
* Remove obsolete header copying helper func
* protobuf update
* Update proto to use dynamodb request event specific to app-access
We will include a similar event for dynamodb via database-access.
We split the events so that app and database access events are not coupled.
This way we do not have to include optional database/app metadata in one event too.
* Update protos
* Update oneof
* Move AppMetaData up with the other metadata and add a 'target' field
* Remove operation plane
* Fix typo
* Configure signing service with transport instead of http client
* Protect from resource exhaustion attacks
* Add IsDynamoDB to types.Application
* Add new event and code for dynamodb requests
* Add async emitter to app access
* Add audit.go to unify app access auditing
* Refactor auditing in app access
* Use the new audit's onSessionChunk/onRequest methods
* Put the session context in the session chunk
* Use a TeeStreamer to send AppSessionDynamoDBRequest directly to audit log as well as session file
* Change streamWriter to streamCloser in sessionChunk to clarify that it should only be used for closing
* Update handler test to test dynamodb events
* Update test to use streamCloser
* Update sever test
* Add doc strings
* Return error from audit interface methods so callers can choose what do to with it
* Move app session start/end into audit interface
* Configure tcpServer to use the server's emitter instead of auth
client, as an Audit interface.
* Have tcpServer call onSessionStart/End instead of emitting events
itself.
* Remove unneeded check type
* Rename Transport -> RoundTripper
* Fix test after renaming field
* Rename drainBody and defer body closing
* Fix subtle named return mistake
* Update lib/service/service.go
Co-authored-by: Tobiasz Heller <14020794+tobiaszheller@users.noreply.github.com>
* Update lib/service/service.go
Co-authored-by: Tobiasz Heller <14020794+tobiaszheller@users.noreply.github.com>
* Rename ok->shouldSkipCleanup to make the purpose of it more clear
* Refactor request body decoding into aws utils
* Use request instead of signed request for audit event
* Determine if req is for a dynamo endpoint instead of checking app uri
* Remove obsolete app func IsDynamoDB
* Update handler test
* Use generic console app uri to test that we differentiate request by endpoint instead of app uri
* Use a dynamodb request which has a body to test that we include the body in the audit event
* Test for expected body JSON
* fix lint
* Fixup merge
Co-authored-by: Tobiasz Heller <14020794+tobiaszheller@users.noreply.github.com>
Gabriel Corado