* Add AWSSAMLProviderV1 to access graph proto
* Access Graph: sync AWS SAML Providers
* Parse SAML entity descriptor before sending to TAG
* Add protos for AWS OIDC providers
* Fetch AWS OIDC providers
* Fetch signing certificates for AWS SAML providers
* Deflake identity provider fetch test
The concrete implementation of IAM mock uses a map,
resulting in non-deterministic iteration order.
Sort the results before comparing to alleviate.
* Update lib/srv/discovery/fetchers/aws-sync/iam_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* AWS OIDC: Script to configure EC2 Auto Discover with SSM
There's a new teleport command that adds an inline policy which enables
the AWS OIDC Integration to handle EC2 Auto Discover using the script
mode (SSM).
It also adds the SSM Document used in the teleport installation.
There's also a new endpoint which returns the one off script that uses
that command.
* Update lib/integrations/awsoidc/ec2_ssm_iam_config.go
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
---------
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
* AWS OIDC: IAM set up for AWS App Access
AWS App Access using AWS OIDC Integration requires a new policy in the
AWS OIDC Role.
This PR adds a one-off script that executes the configuration command
that adds said policy.
* improved comments, remove dead code, improve logging
* improve comment and http client var name
* move back to interface
* remove default client
* rename role to rolename
* enable fips endpoint support
* restrict target roles by their tags
* use true for tag value
* Support Azure CLI Access on AKS with workload identity
* fix lint and properly pass along a logger
* fix typos
* reverse error check and fix typo
* fix terraform go.mod
* fix event handler go.mod
* AutoDiscover: add support for EICE nodes
* ignore openssh nodes when updating labels from serverinfo
* downcase imports
* improve comment on why we need account/instance and subkind
* add applyovertime method
* skip nodes that wont expire in the near future
* create helper functions
It was discovered that some customers' EKS clusters did not have their IMDSv2 hop limits
set correctly, causing requests for key functionality to attempt IMDSv1 fallback and failing.
For now, re-enable IMDSv1 fallback by way of removing the explicit disabling of
`EC2MetadataEnableFallback` until better documentation, error handling, and other work
can be done to inform customers that they need to correctly set their IMDSv2 hop limits.
* GCP MySQL IAM Auth support
* convert no permission
* fix mock
* add UT
* minor refactoring
* fix lint
* return an error for postgres username format
* make user not found error more readable
* add a debug log when falling back to password auth
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Add command for configuring EKS IAM access for Discover
* Remove redundant dot.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Simplify test cases
* Fix typo.
* Fix imports
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* AWS OIDC: Deploy Database Service to multiple VPCs
* Update lib/web/apiserver.go
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Update lib/web/ui/integration.go
Co-authored-by: Lisa Kim <lisa@goteleport.com>
---------
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* feat: AWS KMS keystore backend
This commit adds backend support for AWS KMS as a keystore backend for
Teleport CAs.
It is similar to the existing GCP KMS support.
This PR was getting a bit large, so it does not yet expose the
configuration parameters to enable this in a real cluster, which will
come in a following PR, along with docs.
* simplify string concat
* fix lint
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
This PR adds a new label to RDS Instances and RDS Clusters to identify
its VPC ID.
For Clusters, an additional fetch was necessary because RDS
DescribeDBCluster does not return its VPC. So, a DescribeDBInstance must
be performed to obtain that information from one of its members.
This will allow us to deploy a DatabaseService in a specific VPC and
only proxy the Databases that also belong to that VPC.
* Added IAM Authentication with IAM role support for Amazon Redshift
* add auth UT
* update configurator
* remove fixtures
---------
Co-authored-by: root <root@ip-10-0-0-211.ca-central-1.compute.internal>
* Discovery: Use Integration credentials for fetchers
* fix typos, improve docs, add clients.closer
* be explicit about using ambient or integration credentials
* remove integration assignment when using ambient credentials
* be explicit about using ambient credentials in db service
* fix cache key for region only sessions
* re-trigger license/cla check
Looks like we were depending on the golang-jwt library to catch
this case rather than checking explicitly, and an update to the
library broke us.
Fixes#34514
Two changes to AWS SDK usage:
Teleport should never use AWS IMDSv1 for requests, so disable the
ability to fallback to it, as it could be a malicious attempt to
downgrade security.
Teleport generally prefers FIPS endpoints when in FIPS mode, but
there were a few places that were not selecting the FIPS endpoints.
Ensure that the FIPS endpoints if BoringCrypto is being used.
* Delete aws oidc old flow
* Account for http prefixes for proxy addr and print role arn value
* Clean up aws related rules
* Add new script endpoint and clean up naming
* Create configure iam perm component
* Extract common error and use ConfigureIamPerm comp
* Extract finish dialog, shown after creating integration
* Refactor aws integration enroll screen
* Clarify aws oidc integration uses
* Fix iam config test
* Add ec2:DescribeSecurityGroups to StatementForListRDSDatabases
* Address CR
* Remove region selector
* Fix test
A recent change on Azure Side forces the server id to include the
`.default` suffix.
Fixes#33920
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
This commit adds a one-off teleport command that configures the
necessary IAM permissions for the upcoming External Cloud Audit
(BYOBucket) feature.
An example command invocation looks like:
```
$ teleport integration configure externalcloudaudit-iam \
--aws-region us-west-2 --role nic-byob-test --policy nic-byob \
--session-recordings s3://nic-byob/sess-rec-v2 \
--audit-events s3://nic-byob/events --athena-results s3://nic-byob/results \
--athena-workgroup primary --glue-database nic_byob --glue-table nic_byob_table
```
In normal usage this command will be generated for the user so that they
can just copy a command from the Web UI and run it in AWS CloudShell.
The permissions generated here are based on
https://github.com/gravitational/cloud/blob/rfd/77-bring-your-own-bucket/rfd/0077-Bring-your-own-bucket.md,
but only include the permissions necessary for using the feature at
runtime and not any permissions necessary to bootstrap/create the
resources.
This change fixes a few bugs with GCP auto-discovery:
- Fix project ID not propagating to the GCP client, causing
failed API calls.
- Fix the default installer not recognizing when it was running
on GCP.
- Fix newlines in instance metadata breaking `jq` in default installer.
- Fix zone parsing from instance metadata in default installer.
* AWS OIDC: command to configure IAM for listing databases
Previously we were guiding users in a series of screens and copy/paste
so that the user could configure the AWS OIDC Integration.
This guide also included adding the first feature: enroll an RDS
Database.
We created a new command that sets up the OIDC IdP, but decoupled from
the enroll rds feature.
After updating the guide to use the new command and remove the guide, we
must provide a way for users to set up the required policy for Enrolling
RDS Databases.
This PR adds that command
* review pt1
* rename to ConfigureIAMListDatabasesRequest
* removed wrapper
* fix command description
* move aws client setup to common
* use logrus instead of log
* AWS OIDC: Set up integration with a single command
Creating an AWS OIDC Integration requires a lot of clicks, copy/paste,
navigation between tabs.
This PR adds a single teleport command that creates all the required
resources in AWS:
- AWS OIDC Identity Provider that uses Teleport as source
- AWS IAM Role that can be used by this Identity Provider
This role, will then have inline policies allowing multiple features in
Teleport.
Example: a policy must be added to this role that has
`rds:DescribeInstances` and `rds:DescribeClusters` so that the user can
use the integration to enroll RDS Databases.
* improve docs
* improve godoc
When deploying a Teleport service using the AWS OIDC DeployService, we
can provide the SecurityGroups to be applied to the network
configuration of the service.
Using the default SG for the VPC (vpc is inferred from the used subnets)
might not always be the best one (it is usually locked down).
This PR adds an optional new field that clients can use to be explicit
about the SGs they want.
We also added a new permission when configuring the IAM Permissions for
the DeployService, to allow the usage of the ListSecurityGroups action.
Users can see the list of SG and then pick which ones they want.
* AWS OIDC: Configure IAM for EC2 Instance Connect Endpoint
This PR adds a new teleport command that sets up the required
permissions to use EC2 Instance Connect Endpoint to connect to an EC2
instance.
It also adds a oneoff script that runs this command.
The goal is to give a user a script for them to run, the script then
downloads teleport and calls AWS APIs to create the inline policy.
* add const and lowercase error
* use correct client
* url checker
* add ut
* add comment in test plan
* warnOnError only when err is not nil
* fix typos etc.
* enable metadata service permission for discovered databases
* add a debug log when azure db url is validated
* EC2 Instance Connect Endpoint: List EC2 Instances
We must list the EC2 instances to the user, so they can pick one and
then add them as a Node.
This PR adds EC2 Instance Listing.
To do this, we convert the EC2 Instance into Teleport Server with a
special subkind: SubKindOpenSSHEC2InstanceConnectEndpointNode
This is similar to the ListDatabases endpoint.
* review pt1
* fix const and add test
* use any instead of interface{}
