mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 16:38:35 +08:00
Paul Gottschling
127184f0a8
* Break up /database-access/guides/ Closes #17641 Organize the guides to enrolling databases in specific cloud providers (or self-hosted databases) into separate subsections of the "Database Actions" section, organized by cloud provider (or self-hosted). We can later add general information to the index page of each subsection about how Teleport database access works for each cloud provider. The remaining guides in the "Guides" subsection have to do with database-agnostic functionality of the Teleport Database Service. This change also adds a redirect for each page it moves. * Respond to greedy52 feedback - In the "Database Access" intro page, move the self-hosted section first in the list of links to database-specific guides so it's less easy to miss. - Change "AWS" to "Amazon" in product names. * Fix linter issues * Remove redirects added by the DB guide reorg This prevents us from running into Vercel route limit issues, since the number of redirects is large.
1039 lines
31 KiB
Plaintext
1039 lines
31 KiB
Plaintext
---
|
|
title: Database Access AWS IAM Reference
|
|
description: AWS IAM policies for Teleport database access.
|
|
---
|
|
|
|
The Teleport Database Service requires IAM permissions for various tasks
|
|
depending on the database type and setup, such as discovering endpoints and
|
|
metadata of the database servers, generating IAM authentication tokens, and
|
|
assuming IAM roles.
|
|
|
|
You can generate IAM permissions with the [`teleport db configure aws
|
|
print-iam`](../../database-access/reference/cli.mdx#teleport-db-configure-aws-print-iam)
|
|
command. For example, the following command would generate and print the IAM
|
|
policies:
|
|
|
|
```code
|
|
$ teleport db configure aws print-iam --types rds,redshift --role db-service-role
|
|
```
|
|
|
|
To learn more about a specific database, refer to the related section below.
|
|
|
|
## RDS
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="RDS instances, Aurora clusters, and RDS Proxies" !)
|
|
|
|
### RDS auto-discovery
|
|
|
|
The following IAM permissions are required for the Teleport service that
|
|
performs auto-discovery:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"rds:DescribeDBInstances",
|
|
"rds:DescribeDBClusters",
|
|
"rds:DescribeDBProxies",
|
|
"rds:DescribeDBProxyEndpoints",
|
|
"rds:ListTagsForResource",
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/rds-action-notes.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### RDS access
|
|
|
|
The Teleport Database Service can automatically manage IAM policies of the
|
|
attached IAM identity for RDS access. To use this feature, Teleport requires
|
|
`iam:PutRolePolicy` or `iam:PutUserPolicy` permissions to grant itself
|
|
necessary IAM permissions for each registered database.
|
|
|
|
If you prefer to manage IAM identities manually, refer to the [manage IAM
|
|
identities yourself](#manage-iam-identities-yourself-for-rds-access) section
|
|
which outlines the required IAM permissions.
|
|
|
|
#### Teleport-managed IAM identities for RDS access
|
|
|
|
Teleport requires the following IAM permissions depending on the IAM identity
|
|
Teleport is managing:
|
|
|
|
<Tabs>
|
|
<TabItem label="IAM role">
|
|
Use this policy if your Teleport Database Service runs as an IAM role (for
|
|
example, on an EC2 instance with an attached IAM role):
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"rds:DescribeDBInstances",
|
|
"rds:DescribeDBClusters",
|
|
"rds:ModifyDBInstance",
|
|
"rds:ModifyDBCluster",
|
|
"rds:DescribeDBProxies",
|
|
"rds:DescribeDBProxyEndpoints",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="sample-role"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/rds-action-notes.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/reference/rds-action-notes-on-modify.mdx!)
|
|
|
|
For best security, use the following boundary policy that limits Teleport's
|
|
self-granting capability on the IAM user:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"rds:DescribeDBInstances",
|
|
"rds:DescribeDBClusters",
|
|
"rds:ModifyDBInstance",
|
|
"rds:ModifyDBCluster",
|
|
"rds:DescribeDBProxies",
|
|
"rds:DescribeDBProxyEndpoints",
|
|
"rds-db:connect"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="sample-role"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
(!docs/pages/includes/database-access/reference/permissions-boundaries-link.mdx!)
|
|
|
|
</TabItem>
|
|
|
|
<TabItem label="IAM user">
|
|
Use this policy if you're connecting to RDS instances and Aurora clusters,
|
|
and your Teleport Database Service instance runs as an IAM user:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"rds:DescribeDBInstances",
|
|
"rds:DescribeDBClusters",
|
|
"rds:ModifyDBInstance",
|
|
"rds:ModifyDBCluster",
|
|
"rds:DescribeDBProxies",
|
|
"rds:DescribeDBProxyEndpoints",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUserPolicy",
|
|
"iam:PutUserPolicy",
|
|
"iam:DeleteUserPolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:user/<Var name="sample-user"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/rds-action-notes.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/reference/rds-action-notes-on-modify.mdx!)
|
|
|
|
For best security, use the following boundary policy that limits Teleport's
|
|
self-granting capability on the IAM user:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"rds:DescribeDBInstances",
|
|
"rds:DescribeDBClusters",
|
|
"rds:ModifyDBInstance",
|
|
"rds:ModifyDBCluster",
|
|
"rds:DescribeDBProxies",
|
|
"rds:DescribeDBProxyEndpoints",
|
|
"rds-db:connect"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUserPolicy",
|
|
"iam:PutUserPolicy",
|
|
"iam:DeleteUserPolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:user/<Var name="sample-user"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/permissions-boundaries-link.mdx!)
|
|
|
|
</TabItem>
|
|
|
|
</Tabs>
|
|
|
|
#### Manage IAM identities yourself for RDS access
|
|
|
|
To connect to an RDS database, the Database Service instance's IAM identity
|
|
must have `rds-db:connect` permissions for it. Here is a sample policy:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"rds-db:connect"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:rds-db:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbuser:db-ABCDEFGHIJKL01234/*",
|
|
"arn:aws:rds-db:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbuser:cluster-ABCDEFGHIJKL01234/*",
|
|
"arn:aws:rds-db:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbuser:prx-ABCDEFGHIJKL01234/*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The resource ARN in the policy has the following format:
|
|
|
|
```
|
|
arn:aws:rds-db:<region>:<account-id>:dbuser:<resource-id>/<db-user>
|
|
```
|
|
|
|
| Parameter | Description |
|
|
| ------------- | ----------- |
|
|
| `region` | AWS region where the database cluster is deployed. |
|
|
| `account-id` | AWS account ID the database cluster is deployed under. |
|
|
| `resource-id` | Database AWS resource identifier: <br/>- `db-XXX` for RDS instances.<br/>- `cluster-XXX` for Aurora clusters.<br/>- `prx-XXX` for RDS Proxy.<br/>Can be found under Configuration section in the RDS control panel. |
|
|
| `db-user` | Database user to associate with IAM authentication. Can be a wildcard. |
|
|
|
|
See [Creating and using an IAM policy for IAM database access](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html)
|
|
for more information.
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
## Redshift
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="Redshift clusters" !)
|
|
|
|
### Redshift auto-discovery
|
|
|
|
The following IAM permissions are required for the Teleport service that
|
|
performs auto-discovery:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift:DescribeClusters",
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### Redshift access
|
|
As mentioned in the [Redshift
|
|
guide](../enroll-aws-databases/postgres-redshift.mdx#step-36-create-an-iam-role-for-user-access-optional),
|
|
Teleport supports IAM authentication as either an existing database user or an IAM
|
|
role for Redshift.
|
|
|
|
When authenticating as an existing database user, the Teleport Database Service
|
|
can automatically manage IAM policies of the attached IAM identity for Redshift
|
|
access. To use this feature, Teleport requires `iam:PutRolePolicy` or
|
|
`iam:PutUserPolicy` permissions to grant itself necessary IAM permissions for
|
|
each registered database. If you prefer to manage IAM identities manually,
|
|
refer to the [manage IAM identities
|
|
yourself](#manage-iam-identities-yourself-for-redshift-access) section which
|
|
outlines the required IAM permissions.
|
|
|
|
When authenticating as an IAM role, use the IAM permissions outlined in the
|
|
[IAM authentication as IAM
|
|
role](#iam-authentication-as-iam-role-for-redshift-access) section.
|
|
|
|
#### Teleport-managed IAM identities for Redshift access
|
|
|
|
Teleport requires the following IAM permissions depending on the IAM identity
|
|
Teleport is managing:
|
|
|
|
<Tabs>
|
|
<TabItem label="IAM role">
|
|
Use this policy if your Teleport Database Service instance runs as an IAM
|
|
role (for example, on an EC2 instance with an attached IAM role):
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift:DescribeClusters",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="sample-role"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
For best security, use the following boundary policy that limits Teleport's
|
|
self-granting capability on the IAM role:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift:DescribeClusters",
|
|
"redshift:GetClusterCredentials",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="sample-role"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/permissions-boundaries-link.mdx!)
|
|
|
|
</TabItem>
|
|
<TabItem label="IAM user">
|
|
Use this policy if your Teleport Database Service runs as an IAM user:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift:DescribeClusters",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUserPolicy",
|
|
"iam:PutUserPolicy",
|
|
"iam:DeleteUserPolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:user/<Var name="sample-user"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
For best security, use the following boundary policy that limits Teleport's
|
|
self-granting capability on the IAM user:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift:DescribeClusters",
|
|
"redshift:GetClusterCredentials"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUserPolicy",
|
|
"iam:PutUserPolicy",
|
|
"iam:DeleteUserPolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:user/<Var name="sample-user"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/permissions-boundaries-link.mdx!)
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
#### Manage IAM identities yourself for Redshift access
|
|
|
|
In order to authorize Teleport to generate temporary IAM tokens, create an IAM
|
|
role with the `GetClusterCredentials` permission. Here is a sample policy:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "redshift:GetClusterCredentials",
|
|
"Resource": [
|
|
"arn:aws:redshift:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbuser:<Var name="cluster_id"/>/*",
|
|
"arn:aws:redshift:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbname:<Var name="cluster_id"/>/*",
|
|
"arn:aws:redshift:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbgroup:<Var name="cluster_id"/>/*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The resource ARN string has the following format:
|
|
|
|
```
|
|
arn:aws:redshift:<region>:<account-id>:<resource>:<cluster-id>/<name>
|
|
```
|
|
|
|
Parameters:
|
|
| Parameter | Description |
|
|
| ------------- | ----------- |
|
|
| `region` | AWS region where your Redshift cluster is deployed, or a wildcard. |
|
|
| `account-id` | ID of the AWS account where the Redshift cluster is deployed. |
|
|
| `resource` | One of `dbuser`, `dbname` or `dbgroup` to restrict access to database accounts, names or groups respectively. |
|
|
| `cluster-id` | Redshift cluster identifier, or a wildcard. |
|
|
| `name` | Name of a particular database account, name or group (depending on the `resource`), or a wildcard. |
|
|
|
|
See [Create an IAM role or user with permissions to call
|
|
GetClusterCredentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-iam-credentials-role-permissions.html)
|
|
for more information.
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### IAM authentication as IAM role for Redshift access
|
|
|
|
When authenticating Redshift as an IAM role, the Teleport Database Service must
|
|
be able to assume this IAM role.
|
|
|
|
(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="db-service-role" role2="redshift-access-role"!)
|
|
|
|
The Redshift "access" IAM role requires the following permissions:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "redshift:GetClusterCredentialsWithIAM",
|
|
"Resource": "arn:aws:redshift:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:dbname:<Var name="cluster-id"/>/*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The resource ARN string has the following format:
|
|
|
|
```
|
|
arn:aws:redshift:<region>:<account-id>:db-name:<cluster-id>/*
|
|
```
|
|
|
|
Parameters:
|
|
| Parameter | Description |
|
|
| ------------- | ----------- |
|
|
| `region` | AWS region where your Redshift cluster is deployed, or a wildcard. |
|
|
| `account-id` | ID of the AWS account where the Redshift cluster is deployed. |
|
|
| `cluster-id` | Redshift cluster identifier, or a wildcard. |
|
|
|
|
## Redshift Serverless
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="Redshift Serverless workgroups" !)
|
|
|
|
### Redshift Serverless auto-discovery
|
|
|
|
The following IAM permissions are required for the Teleport service that
|
|
performs auto-discovery:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift-serverless:ListWorkgroups",
|
|
"redshift-serverless:ListEndpointAccess",
|
|
"redshift-serverless:ListTagsForResource"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### Redshift Serverless access
|
|
|
|
Redshift Serverless maps IAM roles to database users. The Teleport Database
|
|
Service must be able to assume these "access" IAM roles which are granted IAM
|
|
permissions to generate IAM authentication tokens.
|
|
|
|
(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="db-service-role" role2="redshift-serverless-access-role"!)
|
|
|
|
In addition to assuming IAM roles, heres is a list of IAM permissions used by
|
|
Database Service to gather information about the registered Redshift Serverless
|
|
workgroups and VPC endpoints:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"redshift-serverless:GetWorkgroup",
|
|
"redshift-serverless:GetEndpointAccess"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
The Redshift Serverless "access" IAM role requires the following permissions:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "redshift-serverless:GetCredentials",
|
|
"Resource": "arn:aws:redshift-serverless:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:workgroup:<Var name="workgroup-id"/>/*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The resource ARN string has the following format:
|
|
|
|
```
|
|
arn:aws:redshift-serverless:<region>:<account-id>:workgroup:<workgroup-id>/*
|
|
```
|
|
|
|
Parameters:
|
|
| Parameter | Description |
|
|
| ------------- | ----------- |
|
|
| `region` | AWS region where your Redshift Serverless workgroup is deployed, or a wildcard. |
|
|
| `account-id` | ID of the AWS account where the Redshift Serverless workgroup is deployed. |
|
|
| `workgroup-id`| Redshift Serverless workgroup identifier, or a wildcard. |
|
|
|
|
|
|
## ElastiCache/MemoryDB
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="ElastiCache and MemoryDB for Redis" !)
|
|
|
|
### ElastiCache/MemoryDB auto-discovery
|
|
|
|
The following IAM permissions are required for the Teleport service that
|
|
performs auto-discovery:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:ListTagsForResource",
|
|
"elasticache:DescribeReplicationGroups",
|
|
"elasticache:DescribeCacheClusters",
|
|
"elasticache:DescribeCacheSubnetGroups",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:ListTags",
|
|
"memorydb:DescribeClusters",
|
|
"memorydb:DescribeSubnetGroups",
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### ElastiCache/MemoryDB access
|
|
|
|
ElastiCache and MemoryDB supports IAM authentication for Redis engine version
|
|
7.0 or above. The Teleport Database Service can automatically manage IAM
|
|
policies of the attached IAM identity for ElastiCache and MemoryDB that use IAM
|
|
authentication. To use this feature, Teleport requires `iam:PutRolePolicy` or
|
|
`iam:PutUserPolicy` permissions to grant itself necessary IAM permissions for
|
|
each registered database. If you prefer to manage IAM identities on your own,
|
|
refer to the [manage IAM identities
|
|
yourself](#manage-iam-identities-yourself-for-elasticachememorydb-access)
|
|
section which outlines the required IAM permissions.
|
|
|
|
Teleport also supports automatic password rotations for ElastiCache and
|
|
MemoryDB users using secrets manager, when IAM authentication is not available.
|
|
Please use the IAM permissions outlined in the [auto-password
|
|
rotation](#auto-password-rotation-for-elasticachememorydb) section.
|
|
|
|
### Teleport-managed IAM identities for ElastiCache/MemoryDB access
|
|
|
|
The required IAM permissions are slightly different depending on the IAM
|
|
identity Teleport is managing:
|
|
|
|
<Tabs>
|
|
<TabItem label="IAM role">
|
|
Use this policy if your Teleport Database Service instance runs as an IAM
|
|
role (for example, on an EC2 instance with an attached IAM role):
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:DescribeReplicationGroups",
|
|
"elasticache:DescribeUsers"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:DescribeSubnetGroups",
|
|
"memorydb:DescribeUsers"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="sample-role"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
For best security, use the following boundary policy that limits Teleport's
|
|
self-granting capability on the IAM role:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:DescribeReplicationGroups",
|
|
"elasticache:DescribeUsers",
|
|
"elasticache:Connect",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:DescribeSubnetGroups",
|
|
"memorydb:DescribeUsers",
|
|
"memorydb:Connect"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="sample-role"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/permissions-boundaries-link.mdx!)
|
|
|
|
</TabItem>
|
|
<TabItem label="IAM user">
|
|
Use this policy if your Teleport Database Service runs as an IAM user (for
|
|
example, it uses an AWS credentials file):
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:DescribeReplicationGroups",
|
|
"elasticache:DescribeUsers"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:DescribeSubnetGroups",
|
|
"memorydb:DescribeUsers"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUserPolicy",
|
|
"iam:PutUserPolicy",
|
|
"iam:DeleteUserPolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:user/<Var name="sample-user"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
For best security, use the following boundary policy that limits Teleport's
|
|
self-granting capability on the IAM user:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:DescribeReplicationGroups",
|
|
"elasticache:DescribeUsers",
|
|
"elasticache:Connect",
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:DescribeClusters",
|
|
"memorydb:DescribeUsers",
|
|
"memorydb:Connect"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUserPolicy",
|
|
"iam:PutUserPolicy",
|
|
"iam:DeleteUserPolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::<Var name="aws-account-id"/>:user/<Var name="sample-user"/>"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/permissions-boundaries-link.mdx!)
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
### Manage IAM identities yourself for ElastiCache/MemoryDB access
|
|
|
|
In order to authorize Teleport to generate temporary IAM tokens, create an IAM
|
|
role with the `Connect` permission. Here is a sample policy:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:DescribeUsers"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:DescribeUsers"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "elasticache:Connect",
|
|
"Resource": [
|
|
"arn:aws:elasticache:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:replicationgroup:<Var name="replication-group"/>",
|
|
"arn:aws:elasticache:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:user:*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "memorydb:Connect",
|
|
"Resource": [
|
|
"arn:aws:memorydb:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:cluster/<Var name="cluster-name"/>",
|
|
"arn:aws:memorydb:<Var name="us-east-2"/>:<Var name="aws-account-id"/>:user/*"
|
|
],
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
See [Authenticating with IAM for
|
|
ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html)
|
|
and [Authenticating with IAM for
|
|
MemoryDB](https://docs.aws.amazon.com/memorydb/latest/devguide/auth-iam.html)
|
|
for more information.
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### Auto-password rotation for ElastiCache/MemoryDB
|
|
|
|
If any ElastiCache or MemoryDB users are tagged to be managed by Teleport,
|
|
below are the IAM permissions required for managing the ElastiCache or MemoryDB
|
|
users:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticache:DescribeUsers",
|
|
"elasticache:ModifyUser"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"memorydb:DescribeUsers",
|
|
"memorydb:UpdateUser"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"secretsmanager:DescribeSecret",
|
|
"secretsmanager:CreateSecret",
|
|
"secretsmanager:UpdateSecret",
|
|
"secretsmanager:DeleteSecret",
|
|
"secretsmanager:GetSecretValue",
|
|
"secretsmanager:PutSecretValue",
|
|
"secretsmanager:TagResource"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:secretsmanager:*:<Var name="aws-account-id"/>:secret:teleport/*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
If a custom Secrets Manager key prefix or a custom KMS key ID is used in the
|
|
static configuration, add the following to the IAM policy:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"secretsmanager:DescribeSecret",
|
|
"secretsmanager:CreateSecret",
|
|
"secretsmanager:UpdateSecret",
|
|
"secretsmanager:DeleteSecret",
|
|
"secretsmanager:GetSecretValue",
|
|
"secretsmanager:PutSecretValue",
|
|
"secretsmanager:TagResource"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:secretsmanager:*:<Var name="aws-account-id"/>:secret:<Var name="my-prefix"/>/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:GenerateDataKey",
|
|
"kms:Decrypt"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:kms:*:<Var name="aws-account-id"/>:key/<Var name="my-kms-id"/>",
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
## OpenSearch
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="OpenSearch domains" !)
|
|
|
|
### OpenSearch auto-discovery
|
|
|
|
The following IAM permissions are required for the Teleport service that
|
|
performs auto-discovery:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"es:ListDomainNames",
|
|
"es:DescribeDomains",
|
|
"es:ListTags"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
### OpenSearch access
|
|
|
|
OpenSearch maps IAM roles to OpenSearch backend roles. Teleport Database
|
|
Service must be able to assume these "access" IAM roles to sign the OpenSearch
|
|
API requests.
|
|
|
|
(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="db-service-role" role2="opensearch-access-role"!)
|
|
|
|
In addition to assuming IAM roles, heres is a list of IAM permissions used by
|
|
Database Service to gather information about the registered OpenSearch domains:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"es:DescribeDomains",
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
## DynamoDB
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="DynamoDB" !)
|
|
|
|
Note that auto-discovery is not available for DynamoDB.
|
|
|
|
DynamoDB access is provided by IAM roles with corresponding DynamoDB-related
|
|
IAM permissions. The Teleport Database Service must be able to assume these
|
|
"access" IAM roles.
|
|
|
|
(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="db-service-role" role2="dynamodb-access-role"!)
|
|
|
|
If session tags are used for DynamoDB access, the following IAM permissions is
|
|
also required:
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"sts:TagSession",
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|
|
|
|
## Keyspaces
|
|
|
|
(!docs/pages/includes/database-access/reference/aws-db-brief.mdx db="Keyspaces (Apache Cassandra)" !)
|
|
|
|
Note that auto-discovery is not available for Keyspaces.
|
|
|
|
Keyspaces access is provided by IAM roles with corresponding Keyspaces-related
|
|
IAM permissions. The Teleport Database Service must be able to assume these
|
|
"access" IAM roles.
|
|
|
|
(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="db-service-role" role2="keyspaces-access-role"!)
|
|
|
|
(!docs/pages/includes/database-access/reference/boundary-policy-note.mdx!)
|