Skip to content

Latest commit

 

History

History
167 lines (118 loc) · 5.07 KB

postgres-redshift.mdx

File metadata and controls

167 lines (118 loc) · 5.07 KB
title description videoBanner
Database Access with Redshift on AWS
How to configure Teleport Database Access with AWS Redshift PostgreSQL.
UFhT52d5bYg

This guide will help you to:

  • Install Teleport (=teleport.version=).
  • Set up Teleport to access your AWS Redshift instances.
  • Connect to your databases through Teleport.

<ScopedBlock scope={["oss", "enterprise"]}> Teleport Database Access Redshift Self-Hosted <ScopedBlock scope={["cloud"]}> Teleport Database Access Redshift Cloud

Prerequisites

(!docs/pages/includes/edition-prereqs-tabs.mdx!)

  • AWS account with a Redshift cluster and permissions to create and attach IAM policies.
  • Command-line client psql installed and added to your system's PATH environment variable.
  • A host, e.g., an EC2 instance, where you will run the Teleport Database Service.

(!docs/pages/includes/tctl.mdx!)

Step 1/5. Create a Teleport user

(!docs/pages/includes/database-access/create-user.mdx!)

Step 2/5. Create a Database Service configuration

(!docs/pages/includes/database-access/token.mdx!)

Install Teleport on the host where you will run the Teleport Database Service:

(!docs/pages/includes/install-linux.mdx!)

On the node that is running the Database Service, create a configuration file:

<ScopedBlock scope={["oss", "enterprise"]}>

$ teleport db configure create \
   -o file \
   --proxy=teleport.example.com:3080 \
   --token=/tmp/token \
   --redshift-discovery=us-west-1

$ teleport db configure create \
   -o file \
   --proxy=mytenant.teleport.sh:443 \
   --token=/tmp/token \
   --redshift-discovery=us-west-1

The command will generate a Database Service configuration with Redshift database auto-discovery enabled on the us-west-1 region and place it at the /etc/teleport.yaml location.

Step 3/5. Create an IAM policy for Teleport

Teleport needs AWS IAM permissions to be able to:

  • Discover and register Redshift databases.
  • Manage IAM user or IAM role policies.

Before you can generate IAM permissions, you must provide the Teleport Database Service access to AWS credentials.

(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)

(!docs/pages/includes/database-access/aws-bootstrap.mdx!)

Step 4/5. Start the Database Service

(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)

The Database Service will discover all Redshift databases according to the configuration and register them in the cluster. The Database Service will also attempt to configure IAM access policies for the discovered databases. Keep in mind that AWS IAM changes may not propagate immediately and can take a few minutes to come into effect.

Step 5/5. Connect

<ScopedBlock scope={["oss", "enterprise"]}>

Once the Database Service has started and joined the cluster, log in to see the registered databases. Replace --proxy with the address of your Teleport Proxy Service.

$ tsh login --proxy=teleport.example.com --user=alice
$ tsh db ls
# Name        Description                    Labels
# ----------- ------------------------------ --------
# my-redshift Redshift cluster in us-east-1  ...

Once the Database Service has started and joined the cluster, log in to see the registered databases. Replace --proxy with the address of your Teleport Cloud tenant.

$ tsh login --proxy=mytenant.teleport.sh --user=alice
$ tsh db ls
# Name        Description                    Labels
# ----------- ------------------------------ --------
# my-redshift Redshift cluster in us-east-1  ...
You can override the database name by applying the `teleport.dev/database_name` AWS tag to the resource. The value of the tag will be used as the database name.

To retrieve credentials for a database and connect to it:

$ tsh db connect my-redshift

You can optionally specify the database name and the user to use by default when connecting to the database instance:

$ tsh db connect --db-user=awsuser --db-name=dev my-redshift
Teleport does not currently use the auto-create option when generating tokens for Redshift databases. Users must exist in the database.

To log out of the database and remove credentials:

$ tsh db logout my-redshift

Troubleshooting

(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)

Next steps