No More Backdoors: Know Who Has Access to What, Right Now
Jun 13
Virtual
Register Today
Teleport logoTry For Free
Fork me on GitHub

Teleport

Database Access with Azure Cache for Redis

Teleport can provide secure access to Azure Cache for Redis via the Teleport Database Service. This allows for fine-grained access control through Teleport's RBAC.

In this guide, you will:

  1. Configure your Azure Cache for Redis database with Microsoft Entra ID-based authentication.
  2. Add the database to your Teleport cluster.
  3. Connect to the database via Teleport

How it works

The Teleport Database Service proxies traffic between Teleport users and Azure Cache for Redis. When a user connects to the database via Teleport, the Database Service obtains an access token from Microsoft Entra ID (formerly Azure AD) and authenticates to Azure as a principal with permissions to manage the database.

Prerequisites

  • A running Teleport cluster version 16.0.0 or above. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

  • The tctl admin tool and tsh client tool.

    Visit Installation for instructions on downloading tctl and tsh.

  • Deployed Azure Redis server or Azure Redis Enterprise cluster.
  • Azure administrative privileges to manage service principals and access controls.
  • A host, e.g., an Azure VM instance, where you will run the Teleport Database Service.
  • redis-cli version 6.2 or newer installed and added to your system's PATH environment variable.
  • To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials. tctl is supported on macOS and Linux machines. For example:
    tsh login --proxy=teleport.example.com --user=[email protected]
    tctl status

    Cluster teleport.example.com

    Version 16.0.0

    CA pin sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678

    If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

Step 1/5. Create a Teleport user

Tip

To modify an existing user to provide access to the Database Service, see Database Access Access Controls

Create a local Teleport user with the built-in access role:

tctl users add \ --roles=access \ --db-users="*" \ --db-names="*" \ alice

Create a local Teleport user with the built-in access and requester roles:

tctl users add \ --roles=access,requester \ --db-users="*" \ --db-names="*" \ alice
FlagDescription
--rolesList of roles to assign to the user. The builtin access role allows them to connect to any database server registered with Teleport.
--db-usersList of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.
--db-namesList of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database.
Warning

Database names are only enforced for PostgreSQL, MongoDB, and Cloud Spanner databases.

For more detailed information about database access controls and how to restrict access see RBAC documentation.

Step 2/5. Create a Database Service configuration

Install Teleport on the host where you will run the Teleport Database Service:

Install Teleport on your Linux server:

  1. Assign edition to one of the following, depending on your Teleport edition:

    EditionValue
    Teleport Enterprise Cloudcloud
    Teleport Enterprise (Self-Hosted)enterprise
    Teleport Community Editionoss
  2. Get the version of Teleport to install. If you have automatic agent updates enabled in your cluster, query the latest Teleport version that is compatible with the updater:

    TELEPORT_DOMAIN=example.teleport.com
    TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"

    Otherwise, get the version of your Teleport cluster:

    TELEPORT_DOMAIN=example.teleport.com
    TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/ping | jq -r '.server_version')"
  3. Install Teleport on your Linux server:

    curl https://goteleport.com/static/install.sh | bash -s ${TELEPORT_VERSION} edition

    The installation script detects the package manager on your Linux server and uses it to install Teleport binaries. To customize your installation, learn about the Teleport package repositories in the installation guide.

Create the Database Service configuration, specifying a region like this:

sudo teleport db configure create \ -o file \ --proxy=tele.example.com:443 \ --token=/tmp/token \ --azure-redis-discovery=eastus
sudo teleport db configure create \ -o file \ --proxy=teleport.example.com:3080 \ --token=/tmp/token \ --azure-redis-discovery=eastus

The command will generate a Database Service configuration with Azure Cache for Redis auto-discovery enabled in the eastus region and place it at the /etc/teleport.yaml location.

Tip

Use --azure-redis-discovery=* to discover databases in all regions. In addition to the region, you can optionally specify --azure-resource-group=<resource-group-name>, --azure-subscription=<subscription-id>, or --labels=<key>=<value> to further customize the scopes of the auto-discovery.

Step 3/5. Configure IAM permissions for Teleport

The Teleport Database Service needs Azure IAM permissions to:

  • Discover and register Azure Cache for Redis databases.
  • Retrieve Redis access keys to authenticate with the databases.

Configure an Azure service principal

There are a couple of ways for the Teleport Database Service to access Azure resources:

  • The Database Service can run on an Azure VM with attached managed identity. This is the recommended way of deploying the Database Service in production since it eliminates the need to manage Azure credentials.
  • The Database Service can be registered as an Azure AD application (via AD's "App registrations") and configured with its credentials. This is only recommended for development and testing purposes since it requires Azure credentials to be present in the Database Service's environment.

Go to the Managed Identities page in your Azure portal and click Create to create a new user-assigned managed identity:

Managed identities

Pick a name and resource group for the new identity and create it:

Take note of the created identity's Client ID:

Next, navigate to the Azure VM that will run your Database Service instance and add the identity you've just created to it:

VM identity

Attach this identity to all Azure VMs that will be running the Database Service.

Note

Registering the Database Service as Azure AD application is suitable for test and development scenarios, or if your Database Service does not run on an Azure VM. For production scenarios prefer to use the managed identity approach.

Go to the App registrations page of your Azure Active Directory and click on New registration:

App registrations

Pick a name (e.g. DatabaseService) and register a new application. Once the app has been created, take note of its Application (client) ID and click on Add a certificate or secret:

Create a new client secret that the Database Service agent will use to authenticate with the Azure API:

Registered app secrets

The Teleport Database Service uses Azure SDK's default credential provider chain to look for credentials. Refer to Azure SDK Authorization to pick a method suitable for your use-case. For example, to use environment-based authentication with a client secret, the Database Service should have the following environment variables set:

export AZURE_TENANT_ID=export AZURE_CLIENT_ID=export AZURE_CLIENT_SECRET=

Create a custom role

Teleport requires <resource-type>/read permissions for discovery and <resource-type>/listKeys/action permissions for authentication with the Redis servers, but Teleport only needs permissions for the resource types you have.

Here is a sample role definition allowing Teleport to read and list keys for both Azure Redis and Azure Redis Enterprise:

{
    "properties": {
        "roleName": "TeleportDiscovery",
        "description": "Allows Teleport to discover Azure Cache For Redis databases and list keys",
        "assignableScopes": [
            "/subscriptions/11111111-2222-3333-4444-555555555555"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Cache/redis/read",
                    "Microsoft.Cache/redis/listKeys/action",
                    "Microsoft.Cache/redisEnterprise/read",
                    "Microsoft.Cache/redisEnterprise/databases/read",
                    "Microsoft.Cache/redisEnterprise/databases/listKeys/action"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

The assignableScopes field above includes a subscription /subscriptions/<subscription>, allowing the role to be assigned at any resource scope within that subscription or the subscription scope itself. If you want to further limit the assignableScopes, you can use a resource group /subscriptions/<subscription>/resourceGroups/<group> or a management group /providers/Microsoft.Management/managementGroups/<group> instead.

Now go to the Subscriptions page and select a subscription.

Click on Access control (IAM) in the subscription and select Add > Add custom role:

IAM custom role

In the custom role creation page, click the JSON tab and click Edit, then paste the JSON example and replace the subscription in assignableScopes with your own subscription id:

Create a role assignment for the Teleport Database Service principal

To grant Teleport permissions, the custom role you created must be assigned to the Teleport service principal - either the managed identity or the app registration you created earlier.

Navigate to the resource scope where you want to make the role assignment. Click Access control (IAM) and select Add > Add role assignment. Choose the custom role you created as the role and the Teleport service principal as a member.

Assign role
Azure Role Assignments

The role assignment should be at a high enough scope to allow the Teleport Database Service to discover all matching databases. See Identify the needed scope for more information about Azure scopes and creating role assignments.

Step 4/5. Start the Database Service

Configure the Teleport Database Service to start automatically when the host boots up by creating a systemd service for it. The instructions depend on how you installed the Teleport Database Service.

On the host where you will run the Teleport Database Service, enable and start Teleport:

sudo systemctl enable teleport
sudo systemctl start teleport

On the host where you will run the Teleport Database Service, create a systemd service configuration for Teleport, enable the Teleport service, and start Teleport:

sudo teleport install systemd -o /etc/systemd/system/teleport.service
sudo systemctl enable teleport
sudo systemctl start teleport

You can check the status of the Teleport Database Service with systemctl status teleport and view its logs with journalctl -fu teleport.

Step 5/5. Connect

Log in to your Teleport cluster. Your Azure Cache for Redis databases should appear in the list of available databases:

tsh login --proxy=teleport.example.com --user=alice
tsh db ls
Name Description Allowed Users Labels Connect ------------------------- ---------------------------------------- ------------- ------- ------- my-azure-redis Azure Redis server in East US [*] ...my-azure-redis-enterprise Azure Redis Enterprise server in East US [*] ...
tsh login --proxy=mytenant.teleport.sh --user=alice
tsh db ls
Name Description Allowed Users Labels Connect ------------------------- ---------------------------------------- ------------- ------- ------- my-azure-redis Azure Redis server in East US [*] ...my-azure-redis-enterprise Azure Redis Enterprise server in East US [*] ...
Override default database name

By default, Teleport uses the name of the Azure Cache for Redis resource as the database name. You can override the database name by applying the TeleportDatabaseName Azure tag to the resource. The value of the tag will be used as the database name.

To retrieve credentials for a database and connect to it:

tsh db connect my-azure-redis

Note that the Teleport Database Service will retrieve the access key and authenticate with the Redis server on the backend automatically. Therefore, the AUTH <access-key> command is not required here once connected.

To log out of the database and remove credentials:

tsh db logout my-azure-redis

Troubleshooting

No credential providers error

If you see the error DefaultAzureCredential: failed to acquire a token. in Database Service logs then Teleport is not detecting the required credentials to connect to the Azure SDK. Check whether the credentials have been applied in the machine running the Teleport Database Service and restart the Teleport Database Service. Refer to Azure SDK Authorization for more information.

Timeout errors

The Teleport Database Service needs connectivity to your database endpoints. That may require enabling inbound traffic on the database from the Database Service on the same VPC or routing rules from another VPC. Using the nc program you can verify connections to databases:

nc -zv server-name.postgres.database.azure.com 5432

Connection to server-name.postgres.database.azure.com 5432 port [tcp/postgresql] succeeded!

Next steps

  • Take a look at the YAML configuration reference.

Further reading