Adds the required `iam:CreateSAMLProvider` permission to the Teleport-generated
Identity Center policy statement. This permission is required when provisioning
the first Account Assignment to a new AWS Account in order to create a SAML provider
tying the AWS Account to the Identity Center instance's auth system.
* fips: Rename IsBoringBinary to IsFIPSBuild throughout
Rename the function and method `IsBoringBinary` to `IsFIPSBuild`
throughout the code base and change references to boringcrypto to
fips140 or similar. This is part of removing boringcrypto from the
build, replacing it with Go-native FIPS140.
There are still some references to "boring":
* The PingResponse message has a field IsBoring in authservice.proto.
This cannot be changed without breaking source compatibility in api/
* The example in examples/teleport-usage has an explicit check for the
boring package to set an AWS FIPS option. This will be changed when
the actual change to Go-native FIPS is done.
* Rust references to boringsys - this is still used in Rust and will not
be changed when using Go-native FIPS.
* The actual import of boring to use it. This will be changed when using
Go-Native FIPS.
This rename is separate from the Go-native FIPS implementation so it can
be backported to keep the branches close, to avoid unnecessary
conflicts.
* fips: Add "crypto/tls/fipsonly" import for boring builds
Import the "crypto/tls/fipsonly" package when building in fips mode.
This import is also done in the Enterprise repo with some rename magic
so that the file the import is in only exists for fips builds. This was
necessary when boringcrypto was only available in a special branch of
the Go toolchain, but has not been necessary since Go 1.19 when
boringcrypto was brought into the proper toolchain.
Moving this here makes the enterprise makefile and fips build simpler.
There is no need to split this now.
The import causes TLS negotiation to reject non-FIPS140 ciphers.
---------
Co-authored-by: Cam Hutchison <camh@xdna.net>
All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* lib/cloud/awsconfig: validate AWS region before fetching config
Add region validation to both `Cache.GetConfig` and `ProviderFunc.GetConfig`
using the existing `apiutilsaws.IsValidRegion` helper. Returns a bad parameter
error early if a non-empty region is invalid, preventing unnecessary downstream
calls with a bad region and upstream validations.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* fix unit tests
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
During AWS OIDC integration set up, the user receives a script that they
must run in order to set up the integration in AWS side.
This script, among other things, creates the AWS IAM Identity Provider
(OIDC type), which then teleport uses to access the AWS APIs.
During the IdP creation, some errors can occur.
One of them is when the IdP already exists, in this case the script
ignores the step and continues to the next ones.
We were wrongly parsing the AWS errors into 'already exists' error type.
When AWS returns code 409, we always assume it is an EntityAlreadyExists
error type.
However, we might also get a 409 code with LimitExceeded.
In this case, the script must stop and return the error to the user.
You can see the full list of errors here:
https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html#API_CreateOpenIDConnectProvider_Errors
* AWS EC2 Discovery: discover in all enabled regions
* use wildcard
* require at least one region
* downgrade discovery service for old clients
* move region x type check to runtime
* add test back
* fix expected version
* Further refactoring of Azure and GCP cloud clients
* drop redundant GCP/Azure qualifiers from method names, remove unused fields
* rename methods in consumer interfaces
* feat: add support for Azure OIDC integration auth for discovery service
* docs: improve documentation for getAzureClients function
* feat: add integration field to Azure fetcher configurations
* update expected test result
* update another expected test result; update said test to use EventuallyWithT for improved error reporting
* lint fix
* split `cloud.Clients` interface into smaller, cloud-specific types
* rename types, package
* remove InstanceMetadataClient and related types
* fix imports
* close GCP clients in TLSServer close method
* close GCP clients in Server Stop method
* add TODO to close GCP clients when no longer in use
* accessgraph sync: Add AWS IAM role for EKS audit logs
Update the `teleport configure integration acces-graph aws-iam` command
to add a permission to access EKS audit logs via CloudWatch Logs if the
`--eks-audit-logs` flag is passed. This is necessary so that an
integration can pull the EKS audit logs if so configured in a discovery
access graph matcher.
* web: Add web eksAuditLogs to integration configure endpoint
Extend the web endpoint for the webscript for integrations configure
access-graph-cloud-sync-iam.sh to add the `eksAuditLogs` query param to
configure with EKS audit logs enabled. Add tests for this endpoint as
there were none.
* Server discovery: use a single installation script for all clouds
When doing Server Auto Discovery we were using slightly different
scripts for installing teleport into the target instances/VMs.
This meant duplicated effort for new features and tests.
This PR reduces the number of places we generate a script, by moving
everything to a single method.
It also fixes a bug where we might not be able to use dynamic matchers
(aka DiscoveryConfig resource) for GCP and Azure.
If GCP and Azure matchers in a DiscoveryConfig, do not have the
ProxyAddr configure, we would generate an invalid script.
Now, if absent, we will fetch it from the cache. Just like we do for the
AWS EC2 flow.
* escape token name
* add test case for azure client id
This PR adds a new param, `env` which will be used to inject environment
variables into the script.
This will be useful for injecting the TELEPORT_INSTALL_SUFFIX and
TELEPORT_UPDATE_GROUP used by `teleport-update` and, soon, `teleport
install autodiscover-node` command.
* chore: Bump Go to 1.25.1
Update all Go modules to use Go 1.25.1.
* Use stable synctest API introduced in Go 1.25
All existing tests that used synctest have had their build
constraints removed and have been updated to use synctest.Test
instead of synctest.Run. There are still tests in teleport.e that
needs to be updated before we can remove GOEXPERIMENT=synctest
and retire the synctest build tag.
* Remove coverage from go test invocations
This is a temporary workaround to https://github.com/golang/go/issues/75031.
When the buildboxes have Go 1.25 installed globally this should no
longer be an issue and coverage can be restored.
* Lazily unmount cgroups
Adds the MNT_DETACH flag to the cgroups unmount call to workaround
issues stemming from a behavior chagne in Go 1.25 to support
automatically setting GOMAXPROCS. In doing so the Go runtime
interacts with cgroups to determine what limits should be applied
which interferes with our ability to clean up.
Fixes https://github.com/gravitational/teleport/issues/58879.
* Fix syntest bug with waitgroups
```
=== Failed
=== FAIL: lib/srv/discovery TestDiscoveryServerEKS (unknown)
fatal error: sync: WaitGroup.Add called from multiple synctest bubbles
```
The failure stems from a bug in Go 1.25 and is a result of loading
aws configs which internally use a sync.WaitGroup. This can be worked
around in the short term by mocking out the aws.Config since the test
is configured to use a mock eks client anyway. Other tests may still
run into this issue until Go 1.25.2 - though our relatively small number
of synctest usage at this point may limit our exposure to said bug.
* Proto changes
* Types changes
* Configuration changes
* Cloud client, `go.mod`
* Add method to fetch AlloyDB token
* Engine changes
* `make -C integrations/operator crd`
* lint fix
* `make -C integrations/terraform docs`
* change GCPCloudSQL comment in proto
* Update lib/srv/db/postgres/alloydb.go
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* Update lib/srv/db/common/auth.go
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* address review comments
* lint fix
* Rename `is_alloy_db` to `is_alloydb`
* Clarify comments for AlloyDB database fields in DatabaseGCP struct
* Nudge user towards proper permissions
* Update lib/srv/db/postgres/alloydb.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* remove todo in favor of longer comment
* reduce indentation
* suggest custom IAM role with minimal required scope
* Major implementation update:
- new URI format `alloydb://<connection uri>`
- removed some configuration fields; added `gcp.alloydb.endpoint` instead
- added connection URI resolution against configured endpoint type
- made query cancellation and health checks aware of AlloyDB needs
- unified query cancellation logic to use the `connector` type
* Revert description changes for flags; these are redundant for AlloyDB
* Enhance error handling in ParseAlloyDBConnectionURI function and add comprehensive test cases for invalid URIs
* split `endpoint` into `endpoint_type` and `endpoint_override`
* Remove indentation from custom error messages
* Log resolved database address
* fix serialization test
* explain the logic in `getGCPType`
* use string instead of enum for endpoint type
* add missing cast
---------
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* access-graph: Add KMS resource protos
Add the `AWSKMSKeyV1` protobuf messages to support importing KMS key
into the access graph.
This new type is added to the `AWSResource` oneof.
The Go bindings were regenerated using `make grpc`.
* access-graph: Add AWS KMS key discovery to access graph
Implement AWS KMS keys discovery and ingest into access graph. The
fetcher discovers keys across all specified regions.
For each KMS key, the fetcher retrieves the following details:
* Key metadata, including ARN, creation date, and HSM cluster ID
* Resource tags
* Key aliases
* The key policy document
Add a mock KMS client to support comprehensive unit testing of the new
fetcher, covering various key configurations and error cases.
The new KMS key resource is integrated into the existing discovery framework,
including the merge, deduplication, and reconciliation steps.
The required IAM policy for access graph discovery is updated to include the
necessary `kms:` permissions.
Correct typo in the `GlueTableName` field name.
* Address review feedback
* Address second set of review feedback
* Regenerate go-bindings for proto
* Fix golden files with new AWS KMS actions
This PR fixes an incorrect AWS IAM permission that didn't set the
wildcard for the `s3:GetObject` permission. This caused the download to
fail because AWS requires the file wildcard to be present.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* New teleport configure command: AWS Roles Anywhere set up
This PR adds a new teleport configuration command which performs the AWS
IAM Roles Anywhere Integration set up.
It does the following:
- creates a new Roles Anywhere Trust Anchor using the certificate received
- creates a new IAM Role which allows the required APIs for sync, and is
usable by the Roles Anywhere service, filtered by the created Trust
Anchor
- creates a new Roles Anywhere Profile which can use the IAM Role above
This is part of the new AWS IAM Roles Anywhere integration required set
up.
* clarify placeholder usage + tests
* fix godoc
* AWS Web/Console Access using IAM Roles Anywhere Integration
This PR adds support for AWS Web/Console Access using the IAM Roles
Anywhere Integration.
When trying to access an AWS App which has an associated:
- integration of AWS RA kind
- Roles Anywhere metadata: profile ARN
- IAM Role
There is a new flow which generates credentials using the:
- trust anchor present in the integration metadata
- profile arn present in the AppServer metadata
- target IAM Role
- and a X.509 certificate generated from the AWS Roles Anywhere CA
Those credentials are then used to generate the signing URL using the
federation service.
* move assume role details to helper func
* remove dead code, fix comment and error message
- Updated configuration to acept SQSQueueURL, CloudTrailBucket, and KMSKeyARNs.
- Updated integration commands to accept new parameters for SQS and S3.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* database service runs health checks on MongoDB, PostgreSQL, and MySQL
databases
* proxy service routes database user connections based on health status
* Delete audit stream version check for v13
* Remove string parsing for bpf min kernel version
* Remove string parsing for min etcd version
* Remove version string parsing for route not found
* Remove string parsing for min mariadb version
* Remove string parsing for min mongodb custom data version
* Remove string parsing for min openat2 kernel version
* Use consts in api/version.go
* Generate api/version.go with a go command
* Avoid using a global variable SemVersion
* Keep but deprecate SemVersion in api
* fix-license
If the new DNS endpoints are enabled the CA should be omitted from
the TLS configuration. The endpoints are signed by a different CA
than the cluster and are publicly trusted so a custom CA does not
need to be configured.
Closes https://github.com/gravitational/teleport/issues/54143
Adds an additional type constraint go FnCacheGet and FnCacheGetWithTTL
to enforce that all keys are comparable. This should allow the
removal of various compile time hashability checks that are in
place for existing keys of custom types.
* refactor: migrate app access to AWS SDK v2
* refactor: code review suggestions
* refactor: avoid using cache provide for AWS console signed request
* refactor: add option to provide the base config to GetConfig (awsconfig)
* test: use credential provider mock
* fix(app): correct logger init order
* refactor: rename option to WithBaseCredentialsProvider
* test(app): enforce base config credentials
* Add the dynamodbutils and stsutils packages
* Use stsutils.NewFromConfig()
* Use stsutils.NewV1()
* Use dynamodbutils.IsFIPSEnabled()
* Add forbidigo rules
* Appease linter
This eliminates all remaining references to AWS SDK v1 in the
lib/srv/db/... and lib/srv/discovery/... packages.
Most of the changes are simply to remove dead code.
Marco Dinis