AWS EC2 Discovery: discover in all enabled regions

api/types/matchers_aws.go

@@ -131,6 +131,11 @@ func isAlphanumericIncluding(s string, extraChars ...rune) bool {
 	return true
 }
 
+// IsRegionWildcard returns true if the matcher is configured to discover resources in all regions.
+func (m *AWSMatcher) IsRegionWildcard() bool {
+	return len(m.Regions) == 1 && m.Regions[0] == Wildcard
+}
+
 // CheckAndSetDefaults that the matcher is correct and adds default values.
 func (m *AWSMatcher) CheckAndSetDefaults() error {
 	for _, matcherType := range m.Types {
@@ -145,10 +150,17 @@ func (m *AWSMatcher) CheckAndSetDefaults() error {
 	}
 
 	if len(m.Regions) == 0 {
-		return trace.BadParameter("discovery service requires at least one region")
+		return trace.BadParameter("discovery service requires at least one region, for EC2 you can also set the region to %q to iterate over all regions (requires account:ListRegions IAM permission)", Wildcard)
 	}
 
 	for _, region := range m.Regions {
+		if region == Wildcard {
+			if len(m.Regions) > 1 {
+				return trace.BadParameter("when using %q as region, no other regions can be specified", Wildcard)
+			}
+			break
+		}
+
 		if err := awsapiutils.IsValidRegion(region); err != nil {
 			return trace.BadParameter("discovery service does not support region %q", region)
 		}

api/types/matchers_aws_test.go

@@ -136,12 +136,12 @@ func TestAWSMatcherCheckAndSetDefaults(t *testing.T) {
 			errCheck: isBadParameterErr,
 		},
 		{
-			name: "wildcard is invalid for regions",
+			name: "wildcard is valid for the ec2 type",
 			in: &AWSMatcher{
-				Types:   []string{"ec2", "rds"},
+				Types:   []string{"ec2"},
 				Regions: []string{"*"},
 			},
-			errCheck: isBadParameterErr,
+			errCheck: require.NoError,
 		},
 		{
 			name: "invalid type",
@@ -178,6 +178,14 @@ func TestAWSMatcherCheckAndSetDefaults(t *testing.T) {
 			},
 			errCheck: isBadParameterErr,
 		},
+		{
+			name: "wildcard region is valid for ec2 type",
+			in: &AWSMatcher{
+				Types:   []string{"ec2"},
+				Regions: []string{"*"},
+			},
+			errCheck: require.NoError,
+		},
 		{
 			name: "no region",
 			in: &AWSMatcher{

go.mod

@@ -62,6 +62,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13
 	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.13
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.5
+	github.com/aws/aws-sdk-go-v2/service/account v1.29.3
 	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2
 	github.com/aws/aws-sdk-go-v2/service/athena v1.55.10
 	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.42.2

go.sum

@@ -823,6 +823,8 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEG
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 h1:eg/WYAa12vqTphzIdWMzqYRVKKnCboVPRlvaybNCqPA=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13/go.mod h1:/FDdxWhz1486obGrKKC1HONd7krpk38LBt+dutLcN9k=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3 h1:EqpyKDfuTQZFL6Cr1dutmyUx+Z9eDN2oFR1hoMXbmCs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3/go.mod h1:3LbGl+sLnaiyCVp2LJXj0gEoeV2Uw0QOsDpP1gDMBVA=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2 h1:zZ6TJ93crR09QVPxqoFJnlioltKejaPLxY1dCcBjU20=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2/go.mod h1:BDzrZs53Hsb5MyAICN2dmtFWaeLONzMaseXyF9Bagt0=
 github.com/aws/aws-sdk-go-v2/service/athena v1.55.10 h1:lhHg2H2XeRix8Zk2UKxsJXKk93066CAZCw0x5pMRvDw=

integrations/terraform-mwi/go.mod

@@ -96,6 +96,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/account v1.29.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/athena v1.55.10 // indirect
 	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.42.2 // indirect

integrations/terraform-mwi/go.sum

@@ -828,6 +828,8 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEG
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 h1:eg/WYAa12vqTphzIdWMzqYRVKKnCboVPRlvaybNCqPA=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13/go.mod h1:/FDdxWhz1486obGrKKC1HONd7krpk38LBt+dutLcN9k=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3 h1:EqpyKDfuTQZFL6Cr1dutmyUx+Z9eDN2oFR1hoMXbmCs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3/go.mod h1:3LbGl+sLnaiyCVp2LJXj0gEoeV2Uw0QOsDpP1gDMBVA=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2 h1:zZ6TJ93crR09QVPxqoFJnlioltKejaPLxY1dCcBjU20=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2/go.mod h1:BDzrZs53Hsb5MyAICN2dmtFWaeLONzMaseXyF9Bagt0=
 github.com/aws/aws-sdk-go-v2/service/athena v1.55.10 h1:lhHg2H2XeRix8Zk2UKxsJXKk93066CAZCw0x5pMRvDw=

integrations/terraform/go.mod

@@ -100,6 +100,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/account v1.29.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/athena v1.55.10 // indirect
 	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.42.2 // indirect

integrations/terraform/go.sum

@@ -848,6 +848,8 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEG
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 h1:eg/WYAa12vqTphzIdWMzqYRVKKnCboVPRlvaybNCqPA=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13/go.mod h1:/FDdxWhz1486obGrKKC1HONd7krpk38LBt+dutLcN9k=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3 h1:EqpyKDfuTQZFL6Cr1dutmyUx+Z9eDN2oFR1hoMXbmCs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3/go.mod h1:3LbGl+sLnaiyCVp2LJXj0gEoeV2Uw0QOsDpP1gDMBVA=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2 h1:zZ6TJ93crR09QVPxqoFJnlioltKejaPLxY1dCcBjU20=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.2/go.mod h1:BDzrZs53Hsb5MyAICN2dmtFWaeLONzMaseXyF9Bagt0=
 github.com/aws/aws-sdk-go-v2/service/athena v1.55.10 h1:lhHg2H2XeRix8Zk2UKxsJXKk93066CAZCw0x5pMRvDw=

lib/auth/discoveryconfig/discoveryconfigv1/service.go

@@ -20,21 +20,26 @@ package discoveryconfigv1
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/gravitational/teleport"
 	discoveryconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	conv "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/aws"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // ServiceConfig holds configuration options for the DiscoveryConfig gRPC service.
@@ -124,7 +129,11 @@ func (s *Service) ListDiscoveryConfigs(ctx context.Context, req *discoveryconfig
 
 	dcs := make([]*discoveryconfigv1.DiscoveryConfig, len(results))
 	for i, r := range results {
-		dcs[i] = conv.ToProto(r)
+		downgraded, err := MaybeDowngradeDiscoveryConfig(ctx, r)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		dcs[i] = conv.ToProto(downgraded)
 	}
 
 	return &discoveryconfigv1.ListDiscoveryConfigsResponse{
@@ -149,7 +158,12 @@ func (s *Service) GetDiscoveryConfig(ctx context.Context, req *discoveryconfigv1
 		return nil, trace.Wrap(err)
 	}
 
-	return conv.ToProto(dc), nil
+	downgraded, err := MaybeDowngradeDiscoveryConfig(ctx, dc)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return conv.ToProto(downgraded), nil
 }
 
 // CreateDiscoveryConfig creates a new DiscoveryConfig resource.
@@ -377,3 +391,67 @@ func (s *Service) UpdateDiscoveryConfigStatus(ctx context.Context, req *discover
 		return conv.ToProto(resp), nil
 	}
 }
+
+// MaybeDowngradeDiscoveryConfig tests the client version passed through the gRPC metadata,
+// and if necessary downgrades the Discovery Config resource for compatibility with the older client.
+// The following rules are applied:
+//   - if version is lower than 18.5.0, the AWS wildcard region is replaced with "aws-global" sentinel region
+//     this ensures the client can still discover other resources without erroring out.
+func MaybeDowngradeDiscoveryConfig(ctx context.Context, dc *discoveryconfig.DiscoveryConfig) (*discoveryconfig.DiscoveryConfig, error) {
+	clientVersionString, ok := metadata.ClientVersionFromContext(ctx)
+	if !ok {
+		// This client is not reporting its version via gRPC metadata, which means it's a client really old or a third-party client.
+		// For those, downgrading the resource will do more harm than good, so the resource is returned as is.
+		return dc, nil
+	}
+
+	clientVersion, err := semver.NewVersion(clientVersionString)
+	if err != nil {
+		return nil, trace.BadParameter("unrecognized client version: %s is not a valid semver", clientVersionString)
+	}
+
+	dc = maybeDowngradeDiscoveryConfigAWSWildcardRegion(dc, clientVersion)
+	return dc, nil
+}
+
+var minSupportedDiscoveryConfigAWSWildcardRegionVersion = semver.Version{Major: 18, Minor: 5, Patch: 0}
+
+// For Auth Server v20.0.0, the expected minimum supported client version is v19.0.0, which supports the AWS wildcard region.
+// This function should be deleted at that time.
+//
+// TODO(@marco): DELETE IN v20.0.0.
+func maybeDowngradeDiscoveryConfigAWSWildcardRegion(dc *discoveryconfig.DiscoveryConfig, clientVersion *semver.Version) *discoveryconfig.DiscoveryConfig {
+	if supported, err := utils.MinVerWithoutPreRelease(
+		clientVersion.String(),
+		minSupportedDiscoveryConfigAWSWildcardRegionVersion.String()); supported || err != nil {
+		return dc
+	}
+
+	var changed bool
+
+	originalDiscoveryConfig := dc
+
+	dc = dc.Clone()
+	awsMatchers := dc.Spec.AWS
+	awsMatchersWithoutRegionWildcard := make([]types.AWSMatcher, 0, len(awsMatchers))
+	for _, awsMatcher := range awsMatchers {
+		if len(awsMatcher.Regions) == 1 && awsMatcher.Regions[0] == types.Wildcard {
+			awsMatcher.Regions = []string{aws.AWSGlobalRegion}
+			changed = true
+		}
+		awsMatchersWithoutRegionWildcard = append(awsMatchersWithoutRegionWildcard, awsMatcher)
+	}
+
+	if !changed {
+		return originalDiscoveryConfig
+	}
+
+	dc.Spec.AWS = awsMatchersWithoutRegionWildcard
+	reason := fmt.Sprintf(`Client version %q does not support discovering all regions. Either update the Discovery Service agent to at least %s or enumerate all the regions in %q discovery config.`,
+		clientVersion, minSupportedDiscoveryConfigAWSWildcardRegionVersion, dc.GetName())
+	if dc.Metadata.Labels == nil {
+		dc.Metadata.Labels = make(map[string]string, 1)
+	}
+	dc.Metadata.Labels[types.TeleportDowngradedLabel] = reason
+	return dc
+}

lib/auth/discoveryconfig/discoveryconfigv1/service_test.go

@@ -29,6 +29,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	discoveryconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	convert "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
@@ -559,3 +560,94 @@ func initSvc(t *testing.T, clusterName string) (context.Context, localClient, *S
 		DiscoveryConfigService: localResourceService,
 	}, resourceSvc
 }
+
+func TestDowngrade(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		clientVersion string
+		input         *discoveryconfig.DiscoveryConfig
+		expected      *discoveryconfig.DiscoveryConfig
+	}{
+		{
+			name:          "no downgrade for recent client",
+			clientVersion: "18.5.0",
+			input: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+			expected: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+		},
+		{
+			name:          "downgrade for old client",
+			clientVersion: "18.4.2",
+			input: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+			expected: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := metadata.AddMetadataToContext(t.Context(), map[string]string{
+				metadata.VersionKey: tc.clientVersion,
+			})
+			downgraded, err := MaybeDowngradeDiscoveryConfig(ctx, tc.input)
+			require.NoError(t, err)
+			require.Equal(t, tc.expected, downgraded)
+		})
+	}
+}

lib/auth/grpcserver.go

@@ -90,6 +90,7 @@ import (
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/installers"
 	"github.com/gravitational/teleport/api/types/wrappers"
@@ -585,6 +586,13 @@ func WatchEvents(watch *authpb.Watch, stream WatchEvent, componentName string, a
 			}
 			event.Resource = downgraded
 		}
+		if dc, ok := event.Resource.(*discoveryconfig.DiscoveryConfig); ok {
+			downgraded, err := discoveryconfigv1.MaybeDowngradeDiscoveryConfig(stream.Context(), dc)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			event.Resource = downgraded
+		}
 		out, err := client.EventToGRPC(event)
 		if err != nil {
 			return trace.Wrap(err)

lib/cloud/awsconfig/awsconfig.go

@@ -203,6 +203,17 @@ func (o *options) checkIntegrationCredentials() error {
 // when getting an AWS config.
 type OptionsFn func(*options)
 
+// AssumedRoles extracts the assumed roles from the provided options.
+// Only used in testing.
+func AssumedRoles(opts ...OptionsFn) []AssumeRole {
+	var options options
+	for _, optFn := range opts {
+		optFn(&options)
+	}
+
+	return options.assumeRoles
+}
+
 // WithAssumeRole configures options needed for assuming an AWS role.
 func WithAssumeRole(roleARN, externalID string) OptionsFn {
 	return func(options *options) {

lib/config/configuration.go

@@ -1575,6 +1575,10 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		}
 
 		for _, region := range matcher.Regions {
+			if region == types.Wildcard {
+				continue
+			}
+
 			if !awsregion.IsKnownRegion(region) {
 				const message = "AWS matcher uses unknown region" +
 					"This is either a typo or a new AWS region that is unknown to the AWS SDK used to compile this binary. "