mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
Paul Gottschling
95df3ec2ae
* Add more info re: AWS credentials to the docs Closes #2781 - Add a partial for how to provide credentials to Teleport's AWS client. Since this includes adding environment variables to the file used by our systemd service, I also created a partial re: how to configure Teleport's systemd service and added these two partials to the relevant guides. - Removed `Admonition`s that link to the docs re: AWS credentials in favor of the partial above. (The partial links to the Go SDK for AWS docs for situations where users have a specific use case.) - Remove mentions of the AWS credential-related config settings from the Backends reference. The example config snippets don't actually include the `access_key` and `secret_key` settings, so these are left over from an earlier version of the guide. While you can still add these settings to a config file, I thought it would make sense to leave them undocumented since using an EC2 instance, environment variables, etc. is the recommended approach. - Split the S3/DynamoDB sections of the Backends reference into subsections so the extra authentication info fits a bit better. * Respond to PR feedback * Add new partials to the RDS Proxy guide
45 lines
1.6 KiB
Plaintext
45 lines
1.6 KiB
Plaintext
Teleport can bootstrap IAM permissions for the Database Service based on its
|
|
configuration using the `teleport db configure bootstrap` command. You can use
|
|
this command in automatic or manual mode:
|
|
|
|
- In automatic mode, Teleport will attempt to create appropriate IAM policies
|
|
and attach them to the specified IAM identity (user or role). This requires
|
|
IAM permissions to create and attach IAM policies.
|
|
- In manual mode, Teleport will print required IAM policies. You can then create
|
|
and attach them manually using the AWS management console.
|
|
|
|
Run one of the following commands on your Database Service node:
|
|
|
|
<Tabs>
|
|
<TabItem label="Automatic / IAM User">
|
|
Use this command to bootstrap the permissions automatically when
|
|
your Teleport Database Service runs as an IAM user (for example, uses an AWS
|
|
credentials file).
|
|
|
|
```code
|
|
$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
|
|
```
|
|
</TabItem>
|
|
|
|
<TabItem label="Automatic / IAM Role">
|
|
Use this command to bootstrap the permissions automatically when
|
|
your Teleport Database Service runs as an IAM role (for example, on an EC2
|
|
instance with an attached IAM role).
|
|
|
|
```code
|
|
$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
|
|
```
|
|
</TabItem>
|
|
|
|
<TabItem label="Manual">
|
|
Use this command to display required IAM policies which you will then create in your AWS console:
|
|
|
|
```code
|
|
$ teleport db configure bootstrap -c /etc/teleport.yaml --manual
|
|
```
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
See the full `bootstrap` command
|
|
[reference](../../database-access/reference/cli.mdx#teleport-db-configure-bootstrap).
|