Skip to content

Script to configure IAM for the DeployService#28436

Merged
marcoandredinis merged 3 commits intomasterfrom
marco/oneoff_configure_deployservice_iam
Jul 4, 2023
Merged

Script to configure IAM for the DeployService#28436
marcoandredinis merged 3 commits intomasterfrom
marco/oneoff_configure_deployservice_iam

Conversation

@marcoandredinis
Copy link
Copy Markdown
Contributor

@marcoandredinis marcoandredinis commented Jun 28, 2023 •
edited
Loading

Demo:

$ bash -c "$(curl 'https://marcodinis.teleportdemo.net/webapi/scripts/integrations/configure/deployservice-iam.sh?integrationName=teleportdev&awsRegion=eu-west-1&taskRole=MarcoNewTaskRole&role=MarcoCloudStageAWSOIDC')"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1523  100  1523    0     0   6247      0 --:--:-- --:--:-- --:--:--  6267
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  126M  100  126M    0     0  5449k      0  0:00:23  0:00:23 --:--:-- 5577k
> ./bin/teleport integration configure deployservice-iam --cluster="lenix" --name="teleportdev" --aws-region="eu-west-1" --role="MarcoCloudStageAWSOIDC" --task-role="MarcoNewTaskRole"
...


marcodinis@MarcoM1 ~/s/teleport (master) > bash -c "$(curl 'https://marcodinis.teleportdemo.net/webapi/scripts/integrations/configure/deployservice-iam.sh?integrationName=teleportdev&awsRegion=eu-west-1&taskRole=MarcoNewTaskRole&role=MarcoCloudStageAWSOIDC')"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1523  100  1523    0     0   4090      0 --:--:-- --:--:-- --:--:--  4127
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  253M  100  253M    0     0   727k      0  0:05:57  0:05:57 --:--:--  748k
> ./bin/teleport integration configure deployservice-iam --cluster="lenix" --name="teleportdev" --aws-region="eu-west-1" --role="MarcoCloudStageAWSOIDC" --task-role="MarcoNewTaskRole"
2023/07/03 17:58:23 TaskRole: Boundary Policy "MarcoNewTaskRoleBoundary" created.
2023/07/03 17:58:23 TaskRole: Role "MarcoNewTaskRole" created with Boundary "arn:aws:iam::278576220453:policy/MarcoNewTaskRoleBoundary".
2023/07/03 17:58:23 TaskRole: IAM Policy "MarcoNewTaskRole" added to Role "MarcoNewTaskRole".
2023/07/03 17:58:24 IntegrationRole: IAM Policy "DeployService" added to Role "MarcoCloudStageAWSOIDC"

Requires #28088

@marcoandredinis marcoandredinis force-pushed the marco/oneoff_configure_deployservice_iam branch from f131b68 to 81099f7 Compare June 29, 2023 08:12
kimlisa
kimlisa reviewed Jul 3, 2023
View reviewed changes
Comment thread lib/web/apiserver.go Outdated
// AWS OIDC Integration Actions
h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/databases", h.WithClusterAuth(h.awsOIDCListDatabases))
h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/deployservice", h.WithClusterAuth(h.awsOIDCDeployService))
h.GET("/webapi/sites/:site/integrations/:name/configure-deployservice-iam", h.WithLimiter(h.awsOIDCConfigureDeployServiceIAM))
Copy link
Copy Markdown
Contributor

@kimlisa kimlisa Jul 3, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think we should make the endpoint look similar to these scripts endpoint as

teleport/lib/web/apiserver.go

Line 593 in 81099f7

h.GET("/webapi/scripts/desktop-access/configure/:token/configure-ad.ps1", h.WithLimiter(h.desktopAccessScriptConfigureHandle))

Copy link
Copy Markdown
Contributor Author

@marcoandredinis marcoandredinis Jul 3, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trying to adapt, it would be something like:
/webapi/scripts/integration/configure/deployservice-iam.sh
We can do that 👍
We'll need to add the integration name as query param

@marcoandredinis marcoandredinis force-pushed the marco/oneoff_configure_deployservice_iam branch 3 times, most recently from 950338d to 8a5d4d8 Compare July 3, 2023 16:50
@marcoandredinis marcoandredinis marked this pull request as ready for review July 3, 2023 17:07
@github-actions github-actions Bot requested review from gabrielcorado and jakule July 3, 2023 17:07
@marcoandredinis marcoandredinis force-pushed the marco/oneoff_configure_deployservice_iam branch from 8a5d4d8 to 6a91796 Compare July 3, 2023 17:12
jakule
jakule approved these changes Jul 3, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@jakule jakule left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Few minor things.

Comment thread api/utils/aws/identifiers_test.go Outdated
Comment thread lib/web/integrations_awsoidc.go Outdated
Comment thread lib/web/integrations_awsoidc.go Outdated
Comment thread lib/web/integrations_awsoidc_test.go Outdated
@kimlisa kimlisa mentioned this pull request Jul 4, 2023
Merged
1 task
@marcoandredinis marcoandredinis force-pushed the marco/oneoff_configure_deployservice_iam branch from 6a91796 to a3ea539 Compare July 4, 2023 07:32
@marcoandredinis marcoandredinis requested a review from kimlisa July 4, 2023 07:33
@marcoandredinis marcoandredinis added discover Issues related to Teleport Discover backport/branch/v13 labels Jul 4, 2023
kimlisa
kimlisa approved these changes Jul 4, 2023
View reviewed changes
Comment thread api/utils/aws/identifiers_test.go Outdated
@marcoandredinis marcoandredinis force-pushed the marco/oneoff_configure_deployservice_iam branch from a3ea539 to 4d42a81 Compare July 4, 2023 14:52
@marcoandredinis marcoandredinis enabled auto-merge July 4, 2023 14:54
@marcoandredinis marcoandredinis added this pull request to the merge queue Jul 4, 2023
Merged via the queue into master with commit 37243f8 Jul 4, 2023
@marcoandredinis marcoandredinis deleted the marco/oneoff_configure_deployservice_iam branch July 4, 2023 15:28
@public-teleport-github-review-bot
Copy link
Copy Markdown

public-teleport-github-review-bot Bot commented Jul 4, 2023

@marcoandredinis See the table below for backport results.

Branch Result
branch/v13 Failed

@marcoandredinis marcoandredinis mentioned this pull request Jul 4, 2023
Merged
marcoandredinis added a commit that referenced this pull request Jul 4, 2023
@marcoandredinis
Script to configure IAM for the DeployService (#28436)
9f2a315 
* Script to configure IAM for the DeployService

* use any instead of interface{}

* fix test typo
github-merge-queue Bot pushed a commit that referenced this pull request Jul 5, 2023
@marcoandredinis
Script to configure IAM for the DeployService (#28436) (#28643)
14c767f 
* Script to configure IAM for the DeployService

* use any instead of interface{}

* fix test typo
@r0mant r0mant mentioned this pull request Jul 14, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kimlisa kimlisa kimlisa approved these changes

+1 more reviewer

@jakule jakule jakule approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

discover Issues related to Teleport Discover size/md

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@marcoandredinis @jakule @kimlisa