

Setting up Teleport Database Access with MongoDB Atlas
Length: 08:15
In this guide you will:
- Configure Teleport for accessing your MongoDB Atlas cluster.
- Configure self-managed X.509 authentication on your Atlas cluster.
- Connect to your Atlas cluster via Teleport.

Prerequisites
(!docs/pages/includes/edition-prereqs-tabs.mdx)
- MongoDB Atlas cluster.
- A host, e.g., an Amazon EC2 instance, where you will run the Teleport Database Service.
To connect to Teleport, log in to your cluster using tsh
, then use tctl
remotely:
tsh login --proxy=teleport.example.com [email protected]tctl statusCluster teleport.example.com
Version 12.1.1
CA pin sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678
You can run subsequent tctl
commands in this guide on your local machine.
For full privileges, you can also run tctl
commands on your Auth Service host.
To connect to Teleport, log in to your cluster using tsh
, then use tctl
remotely:
tsh login --proxy=myinstance.teleport.sh [email protected]tctl statusCluster myinstance.teleport.sh
Version 12.1.2
CA pin sha256:sha-hash-here
You must run subsequent tctl
commands in this guide on your local machine.
Step 1/4. Set up the Teleport Database Service
The Database Service requires a valid auth token to connect to the cluster. Generate
one by running the following command against your Teleport Auth Service and save
it in /tmp/token
on the node that will run the Database Service:
tctl tokens add --type=db
Install Teleport on the host where you will run the Teleport Database Service:
Use the appropriate commands for your environment to install your package.
Teleport Edition
Add the Teleport repository to your repository list:
Download Teleport's PGP public key
sudo curl https://apt.releases.teleport.dev/gpg \-o /usr/share/keyrings/teleport-archive-keyring.ascSource variables about OS version
source /etc/os-releaseAdd the Teleport APT repository for v12. You'll need to update this
file for each major release of Teleport.
Note: if using a fork of Debian or Ubuntu you may need to use '$ID_LIKE'
and the codename your distro was forked from instead of '$ID' and '$VERSION_CODENAME'.
Supported versions are listed here: https://github.com/gravitational/teleport/blob/master/build.assets/tooling/cmd/build-os-package-repos/runners.go#L42-L67
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v12" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/nullsudo apt-get updatesudo apt-get install teleport
Source variables about OS version
source /etc/os-releaseAdd the Teleport YUM repository for v12. You'll need to update this
file for each major release of Teleport.
Note: if using a fork of RHEL/CentOS or Amazon Linux you may need to use '$ID_LIKE'
and the codename your distro was forked from instead of '$ID'
Supported versions are listed here: https://github.com/gravitational/teleport/blob/master/build.assets/tooling/cmd/build-os-package-repos/runners.go#L133-L153
sudo yum-config-manager --add-repo $(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v12/teleport.repo")sudo yum install teleportTip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
echo "Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
Optional: Use DNF on newer distributions
$ sudo dnf config-manager --add-repo https://rpm.releases.teleport.dev/teleport.repo
$ sudo dnf install teleport
In the example commands below, update $SYSTEM-ARCH
with the appropriate
value (amd64
, arm64
, or arm
). All example commands using this variable
will update after one is filled out.
curl https://get.gravitational.com/teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz.sha256<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gzshasum -a 256 teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gzVerify that the checksums match
tar -xvf teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gzcd teleportsudo ./install
In the example commands below, update $SYSTEM-ARCH
with the appropriate
value (amd64
, arm64
, or arm
). All example commands using this variable
will update after one is filled out.
After Downloading the .deb
file for your system architecture, install it with
dpkg
. The example below assumes the root
user:
dpkg -i ~/Downloads/teleport-ent_12.1.1_$SYSTEM-ARCH.debSelecting previously unselected package teleport-ent.
(Reading database ... 30810 files and directories currently installed.)
Preparing to unpack teleport-ent_12.1.1_$SYSTEM_ARCH.deb ...
Unpacking teleport-ent 12.1.1 ...
Setting up teleport-ent 12.1.1 ...
After Downloading the .rpm
file for your system architecture, install it with rpm
:
rpm -i ~/Downloads/teleport-ent-12.1.1.$SYSTEM-ARCH.rpmwarning: teleport-ent-12.1.1.$SYSTEM-ARCH.rpm: Header V4 RSA/SHA512 Signature, key ID 6282c411: NOKEY
curl https://get.gravitational.com/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz.sha256<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gzshasum -a 256 teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gzVerify that the checksums match
tar -xvf teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gzcd teleport-entsudo ./install
For FedRAMP/FIPS-compliant installations of Teleport Enterprise, package URLs will be slightly different:
curl https://get.gravitational.com/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gz.sha256<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gzshasum -a 256 teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gzVerify that the checksums match
tar -xvf teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gzcd teleport-entsudo ./install
Please use the latest version of Teleport Enterprise documentation.
Next, start the Database Service.
On the node where you will run the Database Service, start Teleport, pointing
the --auth-server
flag at the address of your Teleport Proxy Service:
teleport db start \ --token=/tmp/token \ --auth-server=teleport.example.com:443 \ --name=mongodb-atlas \ --protocol=mongodb \ --uri=mongodb+srv://cluster0.abcde.mongodb.net \ --ca-cert=/path/to/letsencrypt/isrgrootx1.pem \ --labels=env=dev
The --auth-server
flag must point to the Teleport cluster's Proxy Service endpoint
because the Database Service always connects back to the cluster over a reverse
tunnel.
On the node where you will run the Teleport Database Service, run
teleport start
with the following in /etc/teleport.yaml
:
version: v3
teleport:
auth_token: "/tmp/token"
proxy_server: teleport.example.com:443
# disable services that are on by default
ssh_service: { enabled: no }
proxy_service: { enabled: no }
auth_service: { enabled: no }
db_service:
enabled: "yes"
databases:
- name: "mongodb-atlas"
protocol: "mongodb"
uri: "mongodb+srv://cluster0.abcde.mongodb.net"
ca_cert_file: "/path/to/letsencrypt/isrgrootx1.pem"
static_labels:
env: "dev"
See the full YAML reference for details.
See below for details on how to configure the Teleport Database Service.
Connection endpoint
You will need to provide your Atlas cluster's connection endpoint for the db_service.databases[*].uri
configuration option or --uri
CLI flag. You can find this via the Connect dialog on the Database Deployments overview page:

Go through the "Setup connection security" step and select "Connect with the MongoDB shell" to view the connection string:

Use only the scheme and hostname parts of the connection string in the URI:
--uri=mongodb+srv://cluster0.abcde.mongodb.net
Atlas CA certificate
MongoDB Atlas uses certificates signed by Let's Encrypt.
Download the Let's Encrypt root certificate and use it as a CA in the Database Service configuration:
curl -o /tmp/isrgrootx1.pem https://letsencrypt.org/certs/isrgrootx1.pem.txt
You can then use /tmp/isrgrootx1.pem
as the value of the db_service.databases[*].ca_cert_file
configuration option or --ca-cert
CLI flag.
Step 2/4. Create a Teleport user
To modify an existing user to provide access to the Database Access service, see Database Access Access Controls
Create a local Teleport user with the built-in access
role:
tctl users add \ --roles=access \ --db-users=\* \ --db-names=\* \ alice
Flag | Description |
---|---|
--roles | List of roles to assign to the user. The builtin access role allows them to connect to any database server registered with Teleport. |
--db-users | List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user. |
--db-names | List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database. |
Database names are only enforced for PostgreSQL and MongoDB databases.
For more detailed information about database access controls and how to restrict access see RBAC documentation.
Step 3/4. Configure Atlas
Enable self-managed X.509 authentication
Teleport will authenticate with MongoDB Atlas using self-managed X.509 authentication.
First, obtain Teleport CA certificate by running the following tctl auth sign
command against your Teleport cluster:
tctl auth sign --format=mongodb --host=mongo --out=mongo
The --host
and --ttl
flag value doesn't matter in this case since you'll
only use the CA certificate which this command will output to mongo.cas
file.
You can discard the other mongo.crt
file.
Go to the Security / Advanced configuration section of your Atlas cluster and toggle "Self-managed X.509 Authentication" on:

Paste the contents of mongo.cas
file in the Certificate Authority edit box and
click Save.
Create MongoDB user
On the Security / Database Access page add a new database user with Certificate authentication method:

Make sure to specify the user as CN=<user>
as shown above since MongoDB
treats the entire certificate subject as a username. When connecting to a
MongoDB cluster, say, as a user alice
, Teleport will sign an ephemeral
certificate with CN=alice
subject.
Case matters so make sure to specify Common Name in the username with capital
letters CN=
.
Step 4/4. Connect
Log into your Teleport cluster and see available databases:
tsh login --proxy=teleport.example.com --user=alicetsh db lsName Description Labels
------------- ----------- --------
mongodb-atlas env=dev
Please use the latest version of Teleport Enterprise documentation.
To retrieve credentials for a database and connect to it:
tsh db connect mongodb-atlas
You can optionally specify the database name and the user to use by default when connecting to the database instance:
tsh db connect --db-user=alice mongodb-atlas
Either the mongosh
or mongo
command-line clients should be available in PATH
in order to be
able to connect. The Database Service attempts to run mongosh
first and, if mongosh
is not in PATH
, runs mongo
.
Teleport 9.0 added support for mongosh
and made it the default Mongo DB client.
To log out of the database and remove credentials:
Remove credentials for a particular database instance.
tsh db logout mongodb-atlasRemove credentials for all database instances.
tsh db logout
Next steps
- Learn how to restrict access to certain users and databases.
- View the High Availability (HA) guide.
- Take a look at the YAML configuration reference.
- See the full CLI reference.