Access Requests with Opsgenie
- Available for:
With Teleport's Opsgenie integration, engineers can access the infrastructure they need to resolve alerts quickly, without longstanding admin permissions that can become a vector for attacks.
Teleport's Opsgenie integration allows you to treat Teleport Role Access Requests as Opsgenie alerts, notify the appropriate on-call team, and approve or deny the requests via Teleport. You can also configure the plugin to approve Role Access Requests automatically if the user making the request is on the on-call team for a service affected by an alert.
This guide will explain how to set up Teleport's Access Request plugin for Opsgenie.
A Teleport Enterprise Cloud account.
tctladmin tool and
tshclient tool version >= 15.0.2.
You can verify the tools you have installed by running the following commands:tctl version
Teleport Enterprise v15.0.2 go1.21tsh version
Teleport v15.0.2 go1.21
You can download these tools by following the appropriate Installation instructions for your environment and Teleport edition.
An Opsgenie account with the ability to create API keys with the 'read' and 'create and update' access rights.
To check that you can connect to your Teleport cluster, sign in with
tsh login, then verify that you can run
tctlcommands using your current credentials.
tctlis supported on macOS and Linux machines.
For example:tsh login --proxy=teleport.example.com --user=[email protected]tctl status
CA pin sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678
If you can connect to the cluster and run the
tctl statuscommand, you can use your current credentials to run subsequent
tctlcommands from your workstation. If you host your own Teleport cluster, you can also run
tctlcommands on the computer that hosts the Teleport Auth Service for full permissions.
Create an Opsgenie team named
We will configure the Opsgenie plugin to create an alert for the
teleport-access-request-notifications team when certain users
create an Access Request.
The Teleport Opsgenie plugin works by receiving Access Request events from the Teleport Auth Service and, based on these events, interacting with the Opsgenie API.
To create a user first navigate to Management -> Access -> Roles
Then select 'Create New Role' and create the requester role.
- approve: 1
teleport.dev/schedules annotation specifies the schedule the alert will be be created for.
Create a user called
myuser who has the
requester role. Later in this
guide, you will create an Access Request as this user to test the Opsgenie
To create a user first navigate to Management -> Access -> Users
Then select 'Create New User' and create a user with the requester role.
Generate an API key that the Opsgenie plugin will use to create and modify alerts as well as list users, services, and on-call policies.
In your Opsgenie dashboard, go to SETTINGS → INTEGRATIONS
See https://support.atlassian.com/opsgenie/docs/create-a-default-api-integration/ for more details.
At this point, you have generated credentials that the Opsgenie plugin will use to connect to the Opsgenie API. To configure the plugin to use this API key navigate to Management -> Integrations -> Enroll New Integration.
As the Teleport user
myuser, create an Access Request for the
In Opsgenie, you will see a new alert containing information about the
Access Request in either the default schedule specified when enrolling the plugin,
or in the schedules specified by
teleport.dev/schedules annotation in the requester's role.
Once you receive an Access Request message, click the link to visit Teleport and approve or deny the request:
You can also review an Access Request from the command line:
When the Opsgenie plugin sends a notification, anyone who receives the notification can follow the enclosed link to an Access Request URL. While users must be authorized via their Teleport roles to review Access Request, you should still check the Teleport audit log to ensure that the right users are reviewing the right requests.
When auditing Access Request reviews, check for events with the type
Access Request Reviewed in the Teleport Web UI.