mirror of https://github.com/gravitational/teleport.git synced 2026-11-02 23:31:08 +08:00

Files

T

rosstimothy b7318b5c7e Enable errorlint via golangci-lint (#37669 )

Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.

2024-02-02 15:59:24 +00:00

cmd

Athena: migration: sort events before publishing (#29627 )

2023-08-07 08:19:14 +00:00

dynamo_deserializer.go

athena audit logs - add migration script (#27099 )

2023-06-22 10:45:47 +00:00

migration_test.go

Move lib/utils/prompt to api/utils/prompt (#32334 )

2023-09-25 19:31:37 +00:00

migration.go

Enable errorlint via golangci-lint (#37669 )

2024-02-02 15:59:24 +00:00

README.md

athena audit logs - add migration script (#27099 )

2023-06-22 10:45:47 +00:00

README.md

Dynamomigration tool

Dynamomigration tool allows to export Teleport audit events logs from DynamoDB table into Athena Audit log. It's using DynamoDB export to S3 to export data.

Requirements:

Point-in-time recovery (PITR) on DynamoDB table
Writable filesystem on machine where script will be executed
IAM permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowDynamoExportAndList",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ExportTableToPointInTime"
            ],
            "Resource": "arn:aws:dynamodb:region:account:table/tablename"
        },
        {
            "Sid": "AllowDynamoExportDescribe",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeExport"
            ],
            "Resource": "arn:aws:dynamodb:region:account:table/tablename/*"
        },
        {
            "Sid": "AllowWriteReadDestinationBucket",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::export-bucket/*"
        },
        {
            "Sid": "AllowWriteLargePayloadsBucket",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::large-payloads-bucket/*"
        },
        {
            "Sid": "AllowPublishToAthenaTopic",
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "arn:aws:sns:region:account:topicname"
        }
    ]
}

Example usage

Build: cd examples/dynamoathenamigration/cmd && go build -o dynamoathenamigration.

It is recommended to test export first using -dryRun flag. DryRun does not emit any events, it makes sure that export is in valid format and events can be parsed.

Dry run example:

./dynamoathenamigration -dynamoARN='arn:aws:dynamodb:region:account:table/tablename' \
  -exportPath='s3://bucket/prefix' \
  -dryRun

Full migration:

./dynamoathenamigration -dynamoARN='arn:aws:dynamodb:region:account:table/tablename' \
  -exportPath='s3://bucket/prefix' \
  -snsTopicARN=arn:aws:sns:region:account:topicname \
  -largePayloadsPath=s3://bucket/prefix

To reuse existing export without triggering new one, use -exportARN=xxx.