mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 05:55:42 +08:00
STeve (Xin) Huang
da6646287b
* [docs] AWS management console duration troubleshoot, DB fixes * fix spell * review comments
128 lines
4.1 KiB
Plaintext
128 lines
4.1 KiB
Plaintext
---
|
|
title: Database Access with Redshift on AWS
|
|
description: How to configure Teleport database access with AWS Redshift PostgreSQL.
|
|
videoBanner: UFhT52d5bYg
|
|
---
|
|
|
|
(!docs/pages/includes/database-access/db-introduction.mdx dbType="AWS Redshift" dbConfigure="AWS Redshift database with IAM authentication" dbName="AWS Redshift" !)
|
|
|
|
<Tabs>
|
|
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
|
|
|
|
</TabItem>
|
|
<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
|
|
|
|
</TabItem>
|
|
|
|
</Tabs>
|
|
|
|
## Prerequisites
|
|
|
|
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
|
|
|
|
- AWS account with a Redshift cluster and permissions to create and attach IAM
|
|
policies.
|
|
- Command-line client `psql` installed and added to your system's `PATH` environment variable.
|
|
- A host, e.g., an EC2 instance, where you will run the Teleport Database
|
|
Service.
|
|
- (!docs/pages/includes/database-access/aws-auto-discovery-prerequisite.mdx!)
|
|
- (!docs/pages/includes/tctl.mdx!)
|
|
|
|
## Step 1/5. Create a Teleport user
|
|
|
|
(!docs/pages/includes/database-access/create-user.mdx!)
|
|
|
|
## Step 2/5. Create a Database Service configuration
|
|
|
|
(!docs/pages/includes/database-access/token.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/aws-create-db-configuration.mdx type="Redshift" matcher="redshift" protocol="postgres" example="redshift-cluster-1.abcdefghijklm.us-west-1.redshift.amazonaws.com:5438"!)
|
|
|
|
## Step 3/5. Create an IAM policy for Teleport
|
|
|
|
Teleport needs AWS IAM permissions to be able to:
|
|
|
|
- Manage IAM user or IAM role policies.
|
|
|
|
Before you can generate IAM permissions, you must provide the Teleport Database
|
|
Service access to AWS credentials.
|
|
|
|
(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
|
|
|
|
(!docs/pages/includes/database-access/aws-bootstrap.mdx type="redshift" !)
|
|
|
|
## Step 4/5. Start the Database Service
|
|
|
|
(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
|
|
|
|
The Database Service will also attempt to configure IAM access policies for the
|
|
registered databases. Keep in mind that AWS IAM changes may not propagate
|
|
immediately and can take a few minutes to come into effect.
|
|
|
|
## Step 5/5. Connect
|
|
|
|
<Tabs>
|
|
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
|
|
|
|
Once the Database Service has started and joined the cluster, log in to see the
|
|
registered databases. Replace `--proxy` with the address of your Teleport Proxy
|
|
Service.
|
|
|
|
```code
|
|
$ tsh login --proxy=teleport.example.com --user=alice
|
|
$ tsh db ls
|
|
# Name Description Labels
|
|
# ----------- ------------------------------ --------
|
|
# my-redshift Redshift cluster in us-east-1 ...
|
|
```
|
|
|
|
</TabItem>
|
|
<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
|
|
|
|
Once the Database Service has started and joined the cluster, log in to see the
|
|
registered databases. Replace `--proxy` with the address of your Teleport Cloud
|
|
tenant.
|
|
|
|
```code
|
|
$ tsh login --proxy=mytenant.teleport.sh --user=alice
|
|
$ tsh db ls
|
|
# Name Description Labels
|
|
# ----------- ------------------------------ --------
|
|
# my-redshift Redshift cluster in us-east-1 ...
|
|
```
|
|
|
|
</TabItem>
|
|
|
|
</Tabs>
|
|
|
|
To retrieve credentials for a database and connect to it:
|
|
|
|
```code
|
|
$ tsh db connect --db-user=awsuser --db-name=dev my-redshift
|
|
```
|
|
|
|
<Admonition type="note" title="Database users must exist">
|
|
Teleport does not currently use the auto-create option when generating
|
|
tokens for Redshift databases. Users must exist in the database.
|
|
</Admonition>
|
|
|
|
To log out of the database and remove credentials:
|
|
|
|
```code
|
|
$ tsh db logout my-redshift
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx!)
|
|
|
|
## Next steps
|
|
|
|
(!docs/pages/includes/database-access/guides-next-steps.mdx!)
|
|
- Learn more about [using IAM authentication to generate database user
|
|
credentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html) for AWS Redshift.
|