mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-05 03:33:24 +08:00
Paul Gottschling
95df3ec2ae
* Add more info re: AWS credentials to the docs Closes #2781 - Add a partial for how to provide credentials to Teleport's AWS client. Since this includes adding environment variables to the file used by our systemd service, I also created a partial re: how to configure Teleport's systemd service and added these two partials to the relevant guides. - Removed `Admonition`s that link to the docs re: AWS credentials in favor of the partial above. (The partial links to the Go SDK for AWS docs for situations where users have a specific use case.) - Remove mentions of the AWS credential-related config settings from the Backends reference. The example config snippets don't actually include the `access_key` and `secret_key` settings, so these are left over from an earlier version of the guide. While you can still add these settings to a config file, I thought it would make sense to leave them undocumented since using an EC2 instance, environment variables, etc. is the recommended approach. - Split the S3/DynamoDB sections of the Backends reference into subsections so the extra authentication info fits a bit better. * Respond to PR feedback * Add new partials to the RDS Proxy guide
58 lines
1.9 KiB
Plaintext
58 lines
1.9 KiB
Plaintext
{{ service="your Teleport instance" }}
|
|
|
|
Grant {{ service }} access to credentials that it can use to authenticate to
|
|
AWS. If you are running {{ service }} on an EC2 instance, you should use the EC2
|
|
Instance Metadata Service method. Otherwise, you must use environment variables:
|
|
|
|
<Tabs>
|
|
<TabItem label="Instance Metadata Service">
|
|
|
|
Teleport will detect when it is running on an EC2 instance and use the Instance
|
|
Metadata Service to fetch credentials.
|
|
|
|
</TabItem>
|
|
<TabItem label="Environment Variables">
|
|
|
|
Teleport's built-in AWS client reads credentials from the following environment
|
|
variables:
|
|
|
|
- `AWS_ACCESS_KEY_ID`
|
|
- `AWS_SECRET_ACCESS_KEY`
|
|
- `AWS_DEFAULT_REGION`
|
|
|
|
When you start {{ service }}, the service reads environment variables from a
|
|
file at the path `/etc/default/teleport`. Obtain these credentials from your
|
|
organization. Ensure that `/etc/default/teleport` has the following content,
|
|
replacing the values of each variable:
|
|
|
|
```text
|
|
AWS_ACCESS_KEY_ID=00000000000000000000
|
|
AWS_SECRET_ACCESS_KEY=0000000000000000000000000000000000000000
|
|
AWS_DEFAULT_REGION=<YOUR_REGION>
|
|
```
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
<Details title="Have multiple sources of AWS credentials?">
|
|
|
|
Teleport's AWS client loads credentials from different sources in the following
|
|
order:
|
|
|
|
- Environment Variables
|
|
- Shared credentials file
|
|
- Shared configuration file (Teleport always enables shared configuration)
|
|
- EC2 Instance Metadata (credentials only)
|
|
|
|
While you can provide AWS credentials via a shared credentials file or shared
|
|
configuration file, you will need to run {{ service }} with the `AWS_PROFILE`
|
|
environment variable assigned to the name of your profile of choice.
|
|
|
|
If you have a specific use case that the instructions above do not account for,
|
|
consult the documentation for the [AWS SDK for
|
|
Go](https://docs.aws.amazon.com/sdk-for-go/api/aws/session/) for a detailed
|
|
description of credential loading behavior.
|
|
|
|
</Details>
|
|
|
|
|