title | description |
---|---|
Configure Teleport to Automatically Enroll EC2 instances (Preview) |
How to configure Teleport to automatically enroll EC2 instances. |
The Teleport Discovery Service can connect to Amazon EC2 and automatically discover and enroll EC2 instances matching configured labels. It will then execute an install script on these discovered instances using AWS Systems Manager that will install Teleport, start it and join the cluster.
In this scenario, Teleport Discovery Service uses an IAM invite token with a long time-to-live (TTL), so that new instances can be discovered and added to the Teleport cluster for the lifetime of the token.
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
- AWS account with EC2 instances and permissions to create and attach IAM policies.
- EC2 instances running Ubuntu/Debian/RHEL/Amazon Linux 2 and SSM agent version 3.1 or greater if making use of the default Teleport install script. (For other Linux distributions, you can install Teleport manually.)
- (!docs/pages/includes/tctl.mdx!)
When discovering EC2 instances, Teleport makes use of IAM invite tokens for authenticating joining Nodes.
Create a file called token.yaml
:
# token.yaml
kind: token
version: v2
metadata:
# the token name is not a secret because instances must prove that they are
# running in your AWS account to use this token
name: aws-discovery-iam-token
# set a long expiry time, as the default for tokens is only 30 minutes
expires: "3000-01-01T00:00:00Z"
spec:
# use the minimal set of roles required
roles: [Node]
# set the join method allowed for this token
join_method: iam
allow:
# specify the AWS account which Nodes may join from
- aws_account: "123456789"
Assign the aws_account
field to your AWS account number.
Add the token to the Teleport cluster with:
$ tctl create -f token.yaml
The teleport discovery bootstrap
command will automate the process of
defining and implementing IAM policies required to make auto-discovery work. It
requires only a single pre-defined policy, attached to the EC2 instance running
the command:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetPolicy",
"iam:TagPolicy",
"iam:ListPolicyVersions",
"iam:CreatePolicyVersion",
"iam:CreatePolicy",
"ssm:CreateDocument",
"iam:DeletePolicyVersion",
"iam:AttachRolePolicy",
"iam:PutRolePermissionsBoundary"
],
"Resource": "*"
}
]
}
Create this policy and apply it to the Node (EC2 instance) that will run the Discovery Service.
If you plan on running the Discovery Service on the same Node already running another Teleport service (Auth or Proxy, for example), you can skip this step.
Install Teleport on the EC2 instance that will run the Discovery Service:
(!docs/pages/includes/install-linux.mdx!)
If you are running the Discovery Service on its own host, the service requires a valid invite token to connect to the cluster. Generate one by running the following command against your Teleport Auth Service:
$ tctl tokens add --type=discovery
Save the generated token in /tmp/token
on the Node (EC2 instance) that will
run the Discovery Service.
In order to enable EC2 instance discovery the discovery_service.aws
section
of teleport.yaml
must include at least one entry:
version: v2
teleport:
join_params:
token_name: "/tmp/token"
method: token
auth_servers:
- "teleport.example.com:3080"
auth_service:
enabled: off
proxy_service:
enabled: off
ssh_service:
enabled: off
discovery_service:
enabled: "yes"
aws:
- types: ["ec2"]
regions: ["us-east-1","us-west-1"]
tags:
"env": "prod" # Match EC2 instances where tag:env=prod
- Edit the
teleport.auth_servers
key to match your Auth Service or Proxy Service's URI and port. - Adjust the keys under
discovery_service.aws
to match your EC2 environment, specifically the regions and tags you want to associate with the Discovery Service.
On the same Node as above, run teleport discovery bootstrap
. This command
will generate and display the additional IAM policies and AWS Systems Manager (SSM) documents
required to enable the Discovery Service:
$ sudo teleport discovery bootstrap
Reading configuration at "/etc/teleport.yaml"...
AWS
1. Create IAM Policy "TeleportEC2Discovery":
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ssm:GetCommandInvocation",
"ssm:SendCommand"
],
"Resource": [
"*"
]
}
]
}
2. Create IAM Policy "TeleportEC2DiscoveryBoundary":
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ssm:GetCommandInvocation",
"ssm:SendCommand"
],
"Resource": [
"*"
]
}
]
}
3. Create SSM Document "TeleportDiscoveryInstaller":
schemaVersion: '2.2'
description: aws:runShellScript
parameters:
token:
type: String
description: "(Required) The Teleport invite token to use when joining the cluster."
scriptName:
type: String
description: "(Required) The Teleport installer script to use when joining the cluster."
mainSteps:
- action: aws:downloadContent
name: downloadContent
inputs:
sourceType: "HTTP"
destinationPath: "/tmp/installTeleport.sh"
sourceInfo:
url: "https://teleport.example.com:443/webapi/scripts/installer/{{ scriptName }}"
- action: aws:runShellScript
name: runShellScript
inputs:
timeoutSeconds: '300'
runCommand:
- /bin/sh /tmp/installTeleport.sh "{{ token }}"
4. Attach IAM policies to "yourUser-discovery-role".
Confirm? [y/N]: y
Review the policies and confirm:
Confirm? [y/N]: y
✅[AWS] Create IAM Policy "TeleportEC2Discovery"... done.
✅[AWS] Create IAM Policy "TeleportEC2DiscoveryBoundary"... done.
✅[AWS] Create IAM SSM Document "TeleportDiscoveryInstaller"... done.
✅[AWS] Attach IAM policies to "alex-discovery-role"... done.
All EC2 instances that are to be added to the Teleport cluster by the
Discovery Service must include the AmazonSSMManagedInstanceCore
IAM policy
in order to receive commands from the Discovery Service.
This policy includes the following permissions:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:DescribeAssociation",
"ssm:GetDeployablePatchSnapshotForInstance",
"ssm:GetDocument",
"ssm:DescribeDocument",
"ssm:GetManifest",
"ssm:GetParameter",
"ssm:GetParameters",
"ssm:ListAssociations",
"ssm:ListInstanceAssociations",
"ssm:PutInventory",
"ssm:PutComplianceItems",
"ssm:PutConfigurePackageResult",
"ssm:UpdateAssociationStatus",
"ssm:UpdateInstanceAssociationStatus",
"ssm:UpdateInstanceInformation"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssmmessages:CreateControlChannel",
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenControlChannel",
"ssmmessages:OpenDataChannel"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2messages:AcknowledgeMessage",
"ec2messages:DeleteMessage",
"ec2messages:FailMessage",
"ec2messages:GetEndpoint",
"ec2messages:GetMessages",
"ec2messages:SendReply"
],
"Resource": "*"
}
]
}
To customize the default installer script, execute the following command on your workstation:
$ tctl get installer/default-installer > teleport-default-installer.yaml
The resulting teleport-default-installer.yaml
can the be edited to
change what gets executed when enrolling discovered EC2 instances.
After making the desired changes to the default installer, the resource can be updated by executing:
$ tctl create -f teleport-default-installer.yaml
Multiple installer
resources can exist and be specified in the
aws.install.script_name
section of a discovery_service.aws
list item in
teleport.yaml
:
discovery_service:
aws:
- types: ["ec2"]
tags:
- "env": "prod"
install: # optional section when default-installer is used.
script_name: "default-installer"
- types: ["ec2"]
tags:
- "env": "devel"
install:
script_name: "devel-installer"
The installer
resource has the following templating options:
{{ .MajorVersion }}
: the major version of Teleport to use when installing from the repository.{{ .PublicProxyAddr }}
: the public address of the Teleport Proxy Service to connect to.{{ .RepoChannel }}
: Optional package repository (apt/yum) channel name. Has format<channel>/<version>
e.g. stable/v12. See installation for more details.
These can be used as follows:
kind: installer
metadata:
name: default-installer
spec:
script: |
echo {{ .PublicProxyAddr }}
echo Teleport-{{ .MajorVersion }}
echo Repository Channel: {{ .RepoChannel }}
version: v1
Which, when retrieved by the Systems Manager document will evaluate to a script with the following contents:
echo teleport.example.com
echo Teleport-(=teleport.version=)
echo Repository Channel: stable/v(=teleport.version=)
The default installer will take the following actions:
- Add an official Teleport repository to supported Linux distributions.
- Install Teleport via
apt
oryum
. - Generate the Teleport config file and write it to
/etc/teleport.yaml
. - Enable and start the Teleport service.
(!docs/pages/includes/aws-credentials.mdx service="the Discovery Service"!)
(!docs/pages/includes/start-teleport.mdx service="the Discovery Service"!)
Once you have started the Discovery Service, EC2 instances matching the tags you specified earlier will begin to be added to the Teleport cluster automatically.
If Installs are showing failed or instances are failing to appear check the Command history in AWS System Manager -> Node Management -> Run Command. Select the instance-id of the Target to review Errors.
- Read Joining Nodes via AWS IAM Role for more information on IAM Invite Tokens.
- Information on IAM best practices on EC2 instances managed by Systems Manager can be found for in the AWS Cloud Operations & Migrations Blog .
- Full documentation on EC2 discovery configuration can be found through the config file reference documentation.
- The complete default installer can be found with the Teleport source .