Database Access with Amazon Keyspaces (Apache Cassandra)

Teleport can provide secure access to Amazon Keyspaces via the Teleport Database Service. This allows for fine-grained access control through Teleport's RBAC.

In this guide, you will:

1. Configure an Amazon Keyspaces database with IAM authentication.
2. Join the Amazon Keyspaces database to your Teleport cluster.
3. Connect to the Amazon Keyspaces database via the Teleport Database Service.

How it works

The Teleport Database Service uses IAM authentication to communicate with Amazon Keyspaces. When a user connects to the database via Teleport, the Database Service obtains AWS credentials and authenticates to AWS as an IAM principal with permissions to manage the database.

• Self-Hosted
• Teleport Enterprise Cloud

Prerequisites

• A running Teleport cluster version 15.2.4 or above. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

• The tctl admin tool and tsh client tool.

  On Teleport Enterprise, you must use the Enterprise version of tctl, which you can download from your Teleport account workspace. Otherwise, visit Installation for instructions on downloading tctl and tsh for Teleport Community Edition.

• AWS Account with Amazon Keyspaces database and permissions to create and attach IAM policies
• The cqlsh Cassandra client installed and added to your system's PATH environment variable.
• A host, e.g., an Amazon EC2 instance, where you will run the Teleport Database Service.
• To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials. tctl is supported on macOS and Linux machines. For example:

  tsh login --proxy=teleport.example.com --user=[email protected]
  tctl status
  Cluster  teleport.example.com
  Version  15.2.4
  CA pin   sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678

  If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

Step 1/5. Set up the Teleport Database Service

The Database Service requires a valid auth token to connect to the cluster. Generate one by running the following command against your Teleport Auth Service and save it in /tmp/token on the node that will run the Database Service:

tctl tokens add --type=db

Install Teleport on the host where you will run the Teleport Database Service:

Install Teleport on your Linux server:

1. Assign edition to one of the following, depending on your Teleport edition:

   Edition	Value
   Teleport Enterprise Cloud	cloud
   Teleport Enterprise (Self-Hosted)	enterprise
   Teleport Community Edition	oss

2. Get the version of Teleport to install. If you have automatic agent updates enabled in your cluster, query the latest Teleport version that is compatible with the updater:

   TELEPORT_DOMAIN=example.teleport.com
   TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"

   Otherwise, get the version of your Teleport cluster:

   TELEPORT_DOMAIN=example.teleport.com
   TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/ping | jq -r '.server_version')"

3. Install Teleport on your Linux server:

   curl https://goteleport.com/static/install.sh | bash -s ${TELEPORT_VERSION} edition

   The installation script detects the package manager on your Linux server and uses it to install Teleport binaries. To customize your installation, learn about the Teleport package repositories in the installation guide.

sudo teleport db configure create \   -o file \  --token=/tmp/token \  --proxy=teleport.example.com:443 \  --name=keyspaces \  --protocol=cassandra \  --aws-account-id=12345678912 \  --aws-region=us-east-1 \  --labels=env=dev

sudo teleport db configure create \   -o file \  --token=/tmp/token \  --proxy=mytenant.teleport.sh:443 \  --name=keyspaces \  --protocol=cassandra \  --aws-account-id=12345678912 \  --aws-region=us-east-1 \  --labels=env=dev

Grant the Teleport Database Service access to credentials that it can use to authenticate to AWS. If you are running the Teleport Database Service on an EC2 instance, you may use the EC2 Instance Metadata Service method. Otherwise, you must use environment variables:

AWS_ACCESS_KEY_ID=00000000000000000000
AWS_SECRET_ACCESS_KEY=0000000000000000000000000000000000000000
AWS_DEFAULT_REGION=<YOUR_REGION>

Configure the Teleport Database Service to start automatically when the host boots up by creating a systemd service for it. The instructions depend on how you installed the Teleport Database Service.

sudo systemctl enable teleport
sudo systemctl start teleport

sudo teleport install systemd -o /etc/systemd/system/teleport.service
sudo systemctl enable teleport
sudo systemctl start teleport

You can check the status of the Teleport Database Service with systemctl status teleport and view its logs with journalctl -fu teleport.

Step 2/5. Create a Teleport user

tctl users add \  --roles=access \  --db-users=\* \  --db-names=\* \  alice

tctl users add \  --roles=access,requester \  --db-users=\* \  --db-names=\* \  alice

For more detailed information about database access controls and how to restrict access see RBAC documentation.

Step 3/5. Create an Amazon Keyspaces role

Create an AWS IAM Role that will be used as your Keyspaces user. Go to the IAM -> Access Management -> Roles. Press Create Role.

AWS provides the AmazonKeyspacesReadOnlyAccess and AmazonKeyspacesFullAccess IAM policies that you can incorporate into your Keyspaces user's role. You can choose AmazonKeyspacesReadOnlyAccess for read-only access to Amazon Keyspaces or AmazonKeyspacesFullAccess for full access.

Enter a role name and press "Create role".

Step 4/5. Give Teleport permissions to assume roles

Next, attach the following policy to the IAM role or IAM user the Teleport Database Service instance is using, which allows the Database Service to assume the IAM roles:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "*"
    }
  ]
}

Step 5/5. Connect

Once the Database Service has joined the cluster, log in to see the available databases:

tsh login --proxy=teleport.example.com --user=alice
tsh db ls
Name      Description Allowed Users Labels  Connect
--------- ----------- ------------- ------- -------
keyspaces             [*]           env=dev

tsh login --proxy=mytenant.teleport.sh --user=alice
tsh db ls
Name      Description Allowed Users Labels  Connect
--------- ----------- ------------- ------- -------
keyspaces             [*]           env=dev

To connect to a particular database instance using the KeyspacesReader AWS IAM Keyspaces role as a database user:

tsh db connect --db-user=KeyspacesReader keyspaces
Connected to Amazon Keyspaces at localhost:55084
[cqlsh 6.0.0 | Cassandra 3.11.2 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
KeyspacesReader@cqlsh>

To log out of the database and remove credentials:

Remove credentials for a particular database instance.
tsh db logout keyspaces
Remove credentials for all database instances.
tsh db logout

Further reading

• How Amazon Keyspaces works with IAM
• What is Amazon Keyspaces (for Apache Cassandra)?

Next steps

• Learn how to restrict access to certain users and databases.

• View the High Availability (HA) guide.

• Take a look at the YAML configuration reference.

• See the full CLI reference.