mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
Paul Gottschling
95df3ec2ae
* Add more info re: AWS credentials to the docs Closes #2781 - Add a partial for how to provide credentials to Teleport's AWS client. Since this includes adding environment variables to the file used by our systemd service, I also created a partial re: how to configure Teleport's systemd service and added these two partials to the relevant guides. - Removed `Admonition`s that link to the docs re: AWS credentials in favor of the partial above. (The partial links to the Go SDK for AWS docs for situations where users have a specific use case.) - Remove mentions of the AWS credential-related config settings from the Backends reference. The example config snippets don't actually include the `access_key` and `secret_key` settings, so these are left over from an earlier version of the guide. While you can still add these settings to a config file, I thought it would make sense to leave them undocumented since using an EC2 instance, environment variables, etc. is the recommended approach. - Split the S3/DynamoDB sections of the Backends reference into subsections so the extra authentication info fits a bit better. * Respond to PR feedback * Add new partials to the RDS Proxy guide
168 lines
5.1 KiB
Plaintext
168 lines
5.1 KiB
Plaintext
---
|
|
title: Database Access with Redshift on AWS
|
|
description: How to configure Teleport Database Access with AWS Redshift PostgreSQL.
|
|
videoBanner: UFhT52d5bYg
|
|
---
|
|
|
|
This guide will help you to:
|
|
|
|
- Install Teleport `(=teleport.version=)`.
|
|
- Set up Teleport to access your AWS Redshift instances.
|
|
- Connect to your databases through Teleport.
|
|
|
|
<ScopedBlock scope={["oss", "enterprise"]}>
|
|
|
|
</ScopedBlock>
|
|
<ScopedBlock scope={["cloud"]}>
|
|
|
|
</ScopedBlock>
|
|
|
|
## Prerequisites
|
|
|
|
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
|
|
|
|
- AWS account with a Redshift cluster and permissions to create and attach IAM
|
|
policies.
|
|
- Command-line client `psql` installed and added to your system's `PATH` environment variable.
|
|
- A host, e.g., an EC2 instance, where you will run the Teleport Database
|
|
Service.
|
|
|
|
(!docs/pages/includes/tctl.mdx!)
|
|
|
|
## Step 1/5. Create a Teleport user
|
|
|
|
(!docs/pages/includes/database-access/create-user.mdx!)
|
|
|
|
## Step 2/5. Create a Database Service configuration
|
|
|
|
(!docs/pages/includes/database-access/token.mdx!)
|
|
|
|
Install Teleport on the host where you will run the Teleport Database Service:
|
|
|
|
(!docs/pages/includes/install-linux.mdx!)
|
|
|
|
On the node that is running the Database Service, create a configuration file:
|
|
|
|
<ScopedBlock scope={["oss", "enterprise"]}>
|
|
|
|
```code
|
|
$ teleport db configure create \
|
|
-o file \
|
|
--proxy=teleport.example.com:3080 \
|
|
--token=/tmp/token \
|
|
--redshift-discovery=us-west-1
|
|
```
|
|
|
|
</ScopedBlock>
|
|
<ScopedBlock scope={["cloud"]}>
|
|
|
|
```code
|
|
$ teleport db configure create \
|
|
-o file \
|
|
--proxy=mytenant.teleport.sh:443 \
|
|
--token=/tmp/token \
|
|
--redshift-discovery=us-west-1
|
|
```
|
|
|
|
</ScopedBlock>
|
|
|
|
The command will generate a Database Service configuration with Redshift
|
|
database auto-discovery enabled on the `us-west-1` region and place it at the
|
|
`/etc/teleport.yaml` location.
|
|
|
|
## Step 3/5. Create an IAM policy for Teleport
|
|
|
|
Teleport needs AWS IAM permissions to be able to:
|
|
|
|
- Discover and register Redshift databases.
|
|
- Manage IAM user or IAM role policies.
|
|
|
|
Before you can generate IAM permissions, you must provide the Teleport Database
|
|
Service access to AWS credentials.
|
|
|
|
(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
|
|
|
|
(!docs/pages/includes/database-access/aws-bootstrap.mdx!)
|
|
|
|
## Step 4/5. Start the Database Service
|
|
|
|
(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
|
|
|
|
The Database Service will discover all Redshift databases according to the configuration
|
|
and register them in the cluster. The Database Service will also attempt to configure IAM
|
|
access policies for the discovered databases. Keep in mind that AWS IAM changes
|
|
may not propagate immediately and can take a few minutes to come into effect.
|
|
|
|
## Step 5/5. Connect
|
|
|
|
<ScopedBlock scope={["oss", "enterprise"]}>
|
|
|
|
Once the Database Service has started and joined the cluster, log in to see the
|
|
registered databases. Replace `--proxy` with the address of your Teleport Proxy
|
|
Service.
|
|
|
|
```code
|
|
$ tsh login --proxy=teleport.example.com --user=alice
|
|
$ tsh db ls
|
|
# Name Description Labels
|
|
# ----------- ------------------------------ --------
|
|
# my-redshift Redshift cluster in us-east-1 ...
|
|
```
|
|
|
|
</ScopedBlock>
|
|
<ScopedBlock scope={["cloud"]}>
|
|
|
|
Once the Database Service has started and joined the cluster, log in to see the
|
|
registered databases. Replace `--proxy` with the address of your Teleport Cloud
|
|
tenant.
|
|
|
|
```code
|
|
$ tsh login --proxy=mytenant.teleport.sh --user=alice
|
|
$ tsh db ls
|
|
# Name Description Labels
|
|
# ----------- ------------------------------ --------
|
|
# my-redshift Redshift cluster in us-east-1 ...
|
|
```
|
|
|
|
</ScopedBlock>
|
|
|
|
<Admonition type="note" title="Note">
|
|
You can override the database name by applying the `teleport.dev/database_name` AWS tag to the resource. The value of the tag will be used as the database name.
|
|
</Admonition>
|
|
|
|
To retrieve credentials for a database and connect to it:
|
|
|
|
```code
|
|
$ tsh db connect my-redshift
|
|
```
|
|
|
|
You can optionally specify the database name and the user to use by default
|
|
when connecting to the database instance:
|
|
|
|
```code
|
|
$ tsh db connect --db-user=awsuser --db-name=dev my-redshift
|
|
```
|
|
|
|
<Admonition type="note" title="Database users must exist">
|
|
Teleport does not currently use the auto-create option when generating
|
|
tokens for Redshift databases. Users must exist in the database.
|
|
</Admonition>
|
|
|
|
To log out of the database and remove credentials:
|
|
|
|
```code
|
|
$ tsh db logout my-redshift
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
|
|
|
|
## Next steps
|
|
|
|
- Learn more about [using IAM authentication to generate database user
|
|
credentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html) for AWS Redshift.
|
|
- Learn how to [restrict access](../rbac.mdx) to certain users and databases.
|
|
- View the [High Availability (HA)](../guides/ha.mdx) guide.
|
|
- Take a look at the YAML configuration [reference](../reference/configuration.mdx).
|