WebDiscover: Hookup AWS RDS Flow

[kimlisa]

part of #22130

• Implement logic for resuming discover flow from where user left of
• Replaces the old aws rds flow with the new rds flow (connect aws integration and enroll rds databases)
• Enabled integration resource access
• Fixed a db agent label matching bug

[marcoandredinis]

We are listing RDS DB Instances and RDS DB Clusters, so the role must include the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters"
            ]
            "Resource": "*"
        }
    ]
}

[marcoandredinis]

When setting up the Integration we should strip out the :443 from the Provider URL
I think it gives us a better UX
If the port is anything != then :443 then we should add it 👍
If we decide to keep the :443, then we must change this method to not strip it

teleport/lib/web/oidcidp.go

Lines 96 to 114 in 8f80db4

	func (h *Handler) issuerFromPublicAddr() (string, error) {
	addr := h.cfg.PublicProxyAddr
	// Add protocol if not present.
	if !strings.HasPrefix(addr, "https://") {
	addr = "https://" + addr
	}
	result, err := url.Parse(addr)
	if err != nil {
	return "", trace.Wrap(err)
	}
	if result.Port() == "443" {
	// Cut off redundant :443
	result.Host = result.Hostname()
	}
	return result.String(), nil
	}

[kimlisa]

@ryanclark friendly ping

[kimlisa]

@avatus friendly ping

[avatus]

Didn't get to test locally yet but the code looks great. Just a few nits

[avatus]

Suggested change

	You can define your own labels that this database service will use
	to identify your registered database. The labels you define must
	match with the labels that was defined for the registered database
	(from previous step):
	You can define your own labels that this database service will use
	to identify your registered database. The labels you define must
	match the labels that were defined for the registered database
	(from previous step):

[avatus]

Suggested change

	The matcher labels must be able to match with the labels defined for
	the registered database. Use wildcards to match by any labels.
	The matcher labels must be able to match with the labels defined for
	the registered database. Use wildcards to match with any labels.

[avatus]

I know this said "a" rds_iam role previously, and "a" is correct if we removed the role name and just said "a role". But it reads weird and if this will always be rds_iam here, I think we should change to Users must have an rds_iam role". However, feel free to skip this as i can see it working both ways

[avatus]

Suggested change

	// the flow from where user left of.
	// the flow from where user left off.

[avatus]

I think we should change this to DiscoverUrlLocationState, just to be more clear. When we are working with it and setting it above, it's called locationState so makes more sense to keep it that way.

[public-teleport-github-review-bot]

@kimlisa See the table below for backport results.

Branch	Result
branch/v13	Failed