mirror of https://github.com/gravitational/teleport.git synced 2026-09-19 01:58:44 +08:00

Files

T

Tiago Silva 4d68ca8df1 Migrate S3 upload/download to feature/s3/transfermanager (#65565 )

Replace deprecated github.com/aws/aws-sdk-go-v2/feature/s3/manager
(Uploader/Downloader) with the new transfermanager package across all
call sites. The old manager types were superceded per
https://github.com/aws/aws-sdk-go-v2/discussions/3306.

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>

2026-04-12 09:04:43 +00:00

cmd

Convert examples/dynamoathenamigration to use slog (#50802 )

2025-01-07 15:44:32 +00:00

dynamo_deserializer.go

Modernize tool/, examples/, and e2e/ (#55881 )

2025-06-19 01:38:35 +00:00

migration_test.go

Migrate S3 upload/download to feature/s3/transfermanager (#65565 )

2026-04-12 09:04:43 +00:00

migration.go

Migrate S3 upload/download to feature/s3/transfermanager (#65565 )

2026-04-12 09:04:43 +00:00

README.md

…

README.md

Dynamomigration tool

Dynamomigration tool allows to export Teleport audit events logs from DynamoDB table into Athena Audit log. It's using DynamoDB export to S3 to export data.

Requirements:

Point-in-time recovery (PITR) on DynamoDB table
Writable filesystem on machine where script will be executed
IAM permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowDynamoExportAndList",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ExportTableToPointInTime"
            ],
            "Resource": "arn:aws:dynamodb:region:account:table/tablename"
        },
        {
            "Sid": "AllowDynamoExportDescribe",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeExport"
            ],
            "Resource": "arn:aws:dynamodb:region:account:table/tablename/*"
        },
        {
            "Sid": "AllowWriteReadDestinationBucket",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::export-bucket/*"
        },
        {
            "Sid": "AllowWriteLargePayloadsBucket",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::large-payloads-bucket/*"
        },
        {
            "Sid": "AllowPublishToAthenaTopic",
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "arn:aws:sns:region:account:topicname"
        }
    ]
}

Example usage

Build: cd examples/dynamoathenamigration/cmd && go build -o dynamoathenamigration.

It is recommended to test export first using -dryRun flag. DryRun does not emit any events, it makes sure that export is in valid format and events can be parsed.

Dry run example:

./dynamoathenamigration -dynamoARN='arn:aws:dynamodb:region:account:table/tablename' \
  -exportPath='s3://bucket/prefix' \
  -dryRun

Full migration:

./dynamoathenamigration -dynamoARN='arn:aws:dynamodb:region:account:table/tablename' \
  -exportPath='s3://bucket/prefix' \
  -snsTopicARN=arn:aws:sns:region:account:topicname \
  -largePayloadsPath=s3://bucket/prefix

To reuse existing export without triggering new one, use -exportARN=xxx.