mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
Paul Gottschling
95df3ec2ae
* Add more info re: AWS credentials to the docs Closes #2781 - Add a partial for how to provide credentials to Teleport's AWS client. Since this includes adding environment variables to the file used by our systemd service, I also created a partial re: how to configure Teleport's systemd service and added these two partials to the relevant guides. - Removed `Admonition`s that link to the docs re: AWS credentials in favor of the partial above. (The partial links to the Go SDK for AWS docs for situations where users have a specific use case.) - Remove mentions of the AWS credential-related config settings from the Backends reference. The example config snippets don't actually include the `access_key` and `secret_key` settings, so these are left over from an earlier version of the guide. While you can still add these settings to a config file, I thought it would make sense to leave them undocumented since using an EC2 instance, environment variables, etc. is the recommended approach. - Split the S3/DynamoDB sections of the Backends reference into subsections so the extra authentication info fits a bit better. * Respond to PR feedback * Add new partials to the RDS Proxy guide
203 lines
6.5 KiB
Plaintext
203 lines
6.5 KiB
Plaintext
---
|
|
title: Database Access with AWS RDS Proxy
|
|
description: How to configure Teleport Database Access with AWS RDS Proxy.
|
|
---
|
|
|
|
This guide will help you to set up Teleport to access your AWS RDS proxies.
|
|
|
|
<ScopedBlock scope={["oss", "enterprise"]}>
|
|
|
|
</ScopedBlock>
|
|
<ScopedBlock scope={["cloud"]}>
|
|
|
|
</ScopedBlock>
|
|
|
|
<Admonition type="note" title="Supported Engine Family">
|
|
Teleport currently supports RDS Proxy instances with engine family
|
|
**PostgreSQL** or **MariaDB and MySQL**.
|
|
</Admonition>
|
|
|
|
## Prerequisites
|
|
|
|
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
|
|
|
|
- AWS account with RDS Proxy instances and permissions to create and attach IAM policies.
|
|
- Any RDS Proxy instances intended for connection through Teleport must have TLS enabled.
|
|
- A host, e.g., an EC2 instance, where you will run the Teleport Database
|
|
Service.
|
|
|
|
(!docs/pages/includes/tctl.mdx!)
|
|
|
|
## Step 1/5. Create a Database Service configuration
|
|
|
|
(!docs/pages/includes/database-access/token.mdx!)
|
|
|
|
Install Teleport on the host where you will run the Teleport Database Service:
|
|
|
|
(!docs/pages/includes/install-linux.mdx!)
|
|
|
|
(!docs/pages/includes/aws-credentials.mdx service="the Teleport Database Service"!)
|
|
|
|
Create the Database Service configuration. Replace <Var name="teleport.example.com" /> with
|
|
your Teleport Proxy address or Teleport Cloud tenant (e.g. `mytenant.teleport.sh`),
|
|
and replace <Var name="us-west-1" /> with your preferred region:
|
|
|
|
```code
|
|
$ teleport db configure create \
|
|
-o file \
|
|
--proxy=<Var name="teleport.example.com"/>:443 \
|
|
--token=/tmp/token \
|
|
--rdsproxy-discovery=<Var name="us-west-1" />
|
|
```
|
|
|
|
The command will generate a Database Service configuration with RDS Proxy
|
|
instances auto-discovery enabled on the <Var name="us-west-1" /> region and
|
|
place it at the `/etc/teleport.yaml` location.
|
|
|
|
## Step 2/5. Create an IAM policy for Teleport
|
|
|
|
Teleport needs AWS IAM permissions to be able to discover and register RDS
|
|
Proxy instances.
|
|
|
|
(!docs/pages/includes/database-access/aws-bootstrap.mdx!)
|
|
|
|
## Step 3/5. Start the Database Service
|
|
|
|
(!docs/pages/includes/start-teleport.mdx service="the Teleport Database Service"!)
|
|
|
|
The Database Service will discover all RDS Proxy instances according to the
|
|
configuration and register them in the cluster. In addition to the primary
|
|
endpoints of the RDS Proxy instances, their custom endpoints will also be
|
|
registered.
|
|
|
|
## Step 4/5. Configure database user credentials
|
|
|
|
The Database Service connects to an RDS Proxy instance using IAM
|
|
authentication. In addition, the RDS Proxy instance must also be able to
|
|
connect to the RDS DB instance or Aurora DB cluster using pre-configured
|
|
database user credentials.
|
|
|
|
First, use Secrets Manager to store sets of user name and password credentials.
|
|
You create a separate Secrets Manager secret for each database user account
|
|
that RDS Proxy connects to on the RDS DB instance or Aurora DB cluster. The
|
|
password associated with the secret must match the database password for that
|
|
user in the target database.
|
|
|
|
For example, the following AWS CLI command creates a Secrets Manager secret for
|
|
database user `alice`:
|
|
|
|
```code
|
|
$ aws secretsmanager create-secret \
|
|
--name rdsproxy_alice --description "database user alice" \
|
|
--secret-string '{"username":"alice","password":"password_for_alice"}'
|
|
```
|
|
|
|
Next, create an IAM role with a policy that can access these secrets, for
|
|
example:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "secretsmanager:GetSecretValue",
|
|
"Resource": [
|
|
"arn:aws:secretsmanager:us-west-1:account_id:secret:rdsproxy_alice",
|
|
"arn:aws:secretsmanager:us-west-1:account_id:secret:rdsproxy_anotheruser"
|
|
]
|
|
},
|
|
{
|
|
"Action": "kms:Decrypt",
|
|
"Resource": "arn:aws:kms:us-west-1:account_id:key/key_id",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"kms:ViaService": "secretsmanager.us-east-2.amazonaws.com"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The IAM role should have the following trust policy:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Service": "rds.amazonaws.com"
|
|
},
|
|
"Action": "sts:AssumeRole"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
Lastly, modify the RDS Proxy authentication settings to use the created IAM
|
|
role and Secrets Manager secrets. Make sure IAM authentication is set to
|
|
**Required**:
|
|
|
|
|
|
|
|
<Admonition type="tip" title="IAM authentication per database user">
|
|
If you need to disable IAM authentication for some database users that are not
|
|
intended for Teleport access, use the following AWS CLI command to set
|
|
**IAMAuth** *per secret*:
|
|
|
|
```code
|
|
$ aws rds modify-db-proxy --db-proxy-name my-rds-proxy --auth AuthScheme=SECRETS,SecretArn=arn-of-teleport-access-user,\
|
|
IAMAuth=REQUIRED AuthScheme=SECRETS,SecretArn=arn-of-non-teleport-user,IAMAuth=DISABLED ...
|
|
```
|
|
|
|
See `aws rds modify-db-proxy help` for more information.
|
|
</Admonition>
|
|
|
|
## Step 5/5. Connect
|
|
|
|
Once the Database Service has started and joined the cluster, log in to see the
|
|
registered databases:
|
|
|
|
```code
|
|
$ tsh login --proxy=<Var name="teleport.example.com" /> --user=alice
|
|
$ tsh db ls
|
|
Name Description Labels
|
|
---------------------------- ------------------------------- -------
|
|
rds-proxy RDS Proxy in us-west-1 ...
|
|
rds-proxy-my-reader-endpoint RDS Proxy endpoint in us-west-1 ...
|
|
```
|
|
|
|
To retrieve credentials for a database and connect to it:
|
|
|
|
```code
|
|
$ tsh db connect --db-user=alice --db-name=dev rds-proxy
|
|
```
|
|
|
|
<Admonition type="note" title="Note">
|
|
The appropriate database command-line client (`psql`, `mysql`, `mariadb`) should be
|
|
available in `PATH` in order to connect.
|
|
</Admonition>
|
|
|
|
To log out of the database and remove credentials:
|
|
|
|
```code
|
|
$ tsh db logout rds-proxy
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
|
|
|
|
## Next steps
|
|
|
|
(!docs/pages/includes/database-access/guides-next-steps.mdx!)
|
|
- Learn more on [Setting up database credentials in AWS Secrets
|
|
Manager](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-setup.html)
|
|
and [Setting up AWS Identity and Access Management (IAM)
|
|
policies](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-setup.html)
|
|
for RDS Proxy
|