* Add AWSSAMLProviderV1 to access graph proto
* Access Graph: sync AWS SAML Providers
* Parse SAML entity descriptor before sending to TAG
* Add protos for AWS OIDC providers
* Fetch AWS OIDC providers
* Fetch signing certificates for AWS SAML providers
* Deflake identity provider fetch test
The concrete implementation of IAM mock uses a map,
resulting in non-deterministic iteration order.
Sort the results before comparing to alleviate.
* Update lib/srv/discovery/fetchers/aws-sync/iam_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* AWS OIDC: Script to configure EC2 Auto Discover with SSM
There's a new teleport command that adds an inline policy which enables
the AWS OIDC Integration to handle EC2 Auto Discover using the script
mode (SSM).
It also adds the SSM Document used in the teleport installation.
There's also a new endpoint which returns the one off script that uses
that command.
* Update lib/integrations/awsoidc/ec2_ssm_iam_config.go
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
---------
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
* AWS OIDC: IAM set up for AWS App Access
AWS App Access using AWS OIDC Integration requires a new policy in the
AWS OIDC Role.
This PR adds a one-off script that executes the configuration command
that adds said policy.
* improved comments, remove dead code, improve logging
* improve comment and http client var name
* move back to interface
* remove default client
* rename role to rolename
* enable fips endpoint support
* restrict target roles by their tags
* use true for tag value
* AutoDiscover: add support for EICE nodes
* ignore openssh nodes when updating labels from serverinfo
* downcase imports
* improve comment on why we need account/instance and subkind
* add applyovertime method
* skip nodes that wont expire in the near future
* create helper functions
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Add command for configuring EKS IAM access for Discover
* Remove redundant dot.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Simplify test cases
* Fix typo.
* Fix imports
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* AWS OIDC: Deploy Database Service to multiple VPCs
* Update lib/web/apiserver.go
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Update lib/web/ui/integration.go
Co-authored-by: Lisa Kim <lisa@goteleport.com>
---------
Co-authored-by: Lisa Kim <lisa@goteleport.com>
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Delete aws oidc old flow
* Account for http prefixes for proxy addr and print role arn value
* Clean up aws related rules
* Add new script endpoint and clean up naming
* Create configure iam perm component
* Extract common error and use ConfigureIamPerm comp
* Extract finish dialog, shown after creating integration
* Refactor aws integration enroll screen
* Clarify aws oidc integration uses
* Fix iam config test
* Add ec2:DescribeSecurityGroups to StatementForListRDSDatabases
* Address CR
* Remove region selector
* Fix test
This commit adds a one-off teleport command that configures the
necessary IAM permissions for the upcoming External Cloud Audit
(BYOBucket) feature.
An example command invocation looks like:
```
$ teleport integration configure externalcloudaudit-iam \
--aws-region us-west-2 --role nic-byob-test --policy nic-byob \
--session-recordings s3://nic-byob/sess-rec-v2 \
--audit-events s3://nic-byob/events --athena-results s3://nic-byob/results \
--athena-workgroup primary --glue-database nic_byob --glue-table nic_byob_table
```
In normal usage this command will be generated for the user so that they
can just copy a command from the Web UI and run it in AWS CloudShell.
The permissions generated here are based on
https://github.com/gravitational/cloud/blob/rfd/77-bring-your-own-bucket/rfd/0077-Bring-your-own-bucket.md,
but only include the permissions necessary for using the feature at
runtime and not any permissions necessary to bootstrap/create the
resources.
* AWS OIDC: command to configure IAM for listing databases
Previously we were guiding users in a series of screens and copy/paste
so that the user could configure the AWS OIDC Integration.
This guide also included adding the first feature: enroll an RDS
Database.
We created a new command that sets up the OIDC IdP, but decoupled from
the enroll rds feature.
After updating the guide to use the new command and remove the guide, we
must provide a way for users to set up the required policy for Enrolling
RDS Databases.
This PR adds that command
* review pt1
* rename to ConfigureIAMListDatabasesRequest
* removed wrapper
* fix command description
* move aws client setup to common
* use logrus instead of log
* AWS OIDC: Set up integration with a single command
Creating an AWS OIDC Integration requires a lot of clicks, copy/paste,
navigation between tabs.
This PR adds a single teleport command that creates all the required
resources in AWS:
- AWS OIDC Identity Provider that uses Teleport as source
- AWS IAM Role that can be used by this Identity Provider
This role, will then have inline policies allowing multiple features in
Teleport.
Example: a policy must be added to this role that has
`rds:DescribeInstances` and `rds:DescribeClusters` so that the user can
use the integration to enroll RDS Databases.
* improve docs
* improve godoc
When deploying a Teleport service using the AWS OIDC DeployService, we
can provide the SecurityGroups to be applied to the network
configuration of the service.
Using the default SG for the VPC (vpc is inferred from the used subnets)
might not always be the best one (it is usually locked down).
This PR adds an optional new field that clients can use to be explicit
about the SGs they want.
We also added a new permission when configuring the IAM Permissions for
the DeployService, to allow the usage of the ListSecurityGroups action.
Users can see the list of SG and then pick which ones they want.
* AWS OIDC: Configure IAM for EC2 Instance Connect Endpoint
This PR adds a new teleport command that sets up the required
permissions to use EC2 Instance Connect Endpoint to connect to an EC2
instance.
It also adds a oneoff script that runs this command.
The goal is to give a user a script for them to run, the script then
downloads teleport and calls AWS APIs to create the inline policy.
* add const and lowercase error
* use correct client
* EC2 Instance Connect Endpoint: List EC2 Instances
We must list the EC2 instances to the user, so they can pick one and
then add them as a Node.
This PR adds EC2 Instance Listing.
To do this, we convert the EC2 Instance into Teleport Server with a
special subkind: SubKindOpenSSHEC2InstanceConnectEndpointNode
This is similar to the ListDatabases endpoint.
* review pt1
* fix const and add test
* use any instead of interface{}
The t.Log() function calls have been removed from most tests. This is to keep our test logs cleaner and more focused on error messages. Logging every detail in tests makes it harder to spot actual errors and relevant information.
* Add certificate rotation to `teleport openssh join`
Fix agentless test
Resolve comments
refactor to use existing rotation/backend
resolve comments
resolve comments
Use a comma separated additional-principals
resolve comments
resolve some comments
resolve comments
resolve comments
add sshd_test
remove openssh from config.Configure
just use current time for registerServer rotation
resolve comments
* resolve comments
* fix having to .Shutdown and .Close
* make check command configurable
* typo
* Add a timeout to shutdown
* AWSOIDC Integration: ListDatabases
This PR adds a new Action for the AWSOIDC Integration: ListDatabases
The goal of this action is to provide the User a list of RDS Databases
from which the User will pick one to be added as a Teleport Database
Resource.
This way, the user doesn't need to copy/paste DB name, endpoints and
labels.
Before being able to call this action, the User has to set up an AWS
OIDC integration.
How does it work:
```
Client (web app)
│ ▲
│ │4. Returns list of DBs
1. List Databases │ │ (name, tags, status, endpoint)
│ │
│ │
│ │
│ │
▼ │ 3. rds.DescribeDBInstances
┌───────────┴────┐ (auth: token) ┌─────────┐
│ ├─────────────────────────────────►│ │
│ Teleport Proxy │ │ AWS │
│ │ 3.1. Get OIDC Config │ │
│ │◄─────────────────────────────────┤ │
│ │ 3.2. Get RSA Public Key │ │
│ │◄─────────────────────────────────┤ ├─────────┐ 3.3.
│ │ │ │ │Validates token signature
│ │ │ │ │with received public key
│ │ 3.4 Returns list of DBs │ │◄────────┘
│ │◄─────────────────────────────────┤ │
└─┬──────────────┘ └─────────┘
│
│ 2. Sign Token
│
▼
┌───────────────────┐
│ │
│ Teleport Auth │
│ RSA Private Key │
└───────────────────┘
```
* add resource and account ids to DB resource
* move api namespaces
* use types.Database instead of custom database format
* add database uri
* fix comments and rate limiter
* test name override when converting RDS V2 DBs
* fix webapi database URI field
* TestClusterDatabasesGet: add parallel
* fix iam statements for AWS assumed-role identity
* configurator tries to convert assumed-role to role
* revert IAM semaphore to use identity name
* hide the unused --attach flag, fix typo
* godoc reminder for databases with IAM db users
* add AWS Keyspaces and DynamoDB to AWS configurator
* relax constraint on external id in fileconfig
* add fileconf test for externalid w/o assume role
* check for actions before prompting to confirm
* fix teleport discovery bootstrap --confirm
When the AWS Account ID is provided, we must check that it is a valid
one.
AWS Account ID is a well documented field: 12-digit string
This check is meant to prevent typos when creating Databases mainly from
the Web UI in the context of Teleport Discover.
When testing the "not available" case, this test closed the server
and waited for the AWS SDK to make several attempts before finally
giving up.
Instead of shutting down the server, return an error. This triggers
the same error handling branches, but doesn't require multiple
attempts by the SDK.
Before:
$ go test -run TestEC2IsInstanceMetadataAvailable ./lib/cloud/aws -count=1
ok github.com/gravitational/teleport/lib/cloud/aws 4.272s
After:
$ go test -run TestEC2IsInstanceMetadataAvailable ./lib/cloud/aws -count=1
ok github.com/gravitational/teleport/lib/cloud/aws 0.262s
