Reference for the teleport-agent-aws Terraform module

Report an Issue

Is this page helpful?

How can we improve this page?

View as Markdown

This page lists the input fields and output values of the teleport-agent-aws Terraform module.

Source Code: github.com/gravitational/teleport/tree/master/integrations/terraform-modules/teleport/agent/aws

Teleport Agent Services Deployment on AWS ECS

This module deploys one or more Teleport services to AWS as an ECS task. It is not intended to deploy a Teleport cluster or its Auth Service and Proxy Service control plane. This module does not provision the persistent backend and audit event storage, load balancing, DNS, or TLS certificates required to operate a self-hosted Teleport cluster.

Any of the following services may be registered with an existing Teleport cluster using this module:

• Teleport Application Service
• Teleport Database Service
• Teleport Discovery Service
• Teleport Jamf Service
• Teleport Kubernetes Service

Prerequisites

• An existing Teleport cluster with Auth Service and Proxy Service
• A reachable Teleport Proxy Service endpoint

• A supported join method and credentials that the agent can use to join the cluster. The example creates an IAM join token using the Teleport Terraform provider. See the Join Methods and Token Reference for supported join methods and creating tokens.

• Configure Teleport Terraform Provider
• Configure AWS Terraform provider

Examples

Refer to the examples for example usage of this module.

How to get help

If you're having trouble, check out our GitHub Discussions.

For bugs related to this code, please open an issue.

Requirements

Name	Version
terraform	>= 1.5.7
aws	>= 6.0
http	>= 3.0
random	>= 3.0

Providers

Name	Version
aws	>= 6.0
http	>= 3.0
random	>= 3.0

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_log_group.this	resource
aws_ecs_cluster.teleport_agent	resource
aws_ecs_service.teleport_agent	resource
aws_ecs_task_definition.teleport_agent	resource
aws_iam_role.ecs_execution	resource
aws_iam_role.ecs_task	resource
aws_iam_role_policy.ecs_execution	resource
aws_iam_role_policy.ecs_task	resource
aws_security_group.teleport_agent	resource
aws_vpc_security_group_egress_rule.allow_all_outbound_from_teleport_agent	resource
random_string.name_suffix	resource
aws_caller_identity.this	data source
aws_iam_policy_document.ecs_execution	data source
aws_iam_policy_document.ecs_execution_trust	data source
aws_iam_policy_document.ecs_task_inline_policy	data source
aws_iam_policy_document.ecs_task_trust	data source
aws_partition.this	data source
aws_region.this	data source
aws_subnet.teleport_agent	data source
http_http.managed_updates	data source

Inputs

Name	Description	Type	Default	Required
apply_aws_tags	Additional AWS tags to apply to all created AWS resources.	map(string)	{}	no
assign_public_ip	Whether to assign public IP addresses to Teleport ECS tasks. If this is set to true, then var.ecs_service_subnets must be public subnets (route to an internet gateway). Otherwise, var.ecs_service_subnets must be private subnets (route to a NAT gateway).	bool	false	no
create	Toggle creation of all resources.	bool	true	no
create_security_group	Whether to create a security group for the Teleport ECS tasks.	bool	true	no
ecs_cluster_name	Name of the ECS cluster.	string	"teleport"	no
ecs_cluster_use_name_prefix	Determines whether var.ecs_cluster_name is used as a prefix of the ECS cluster name.	bool	true	no
ecs_service_name	Name of the ECS service.	string	"teleport"	no
ecs_service_subnets	Subnet IDs where Teleport will be deployed. If var.assign_public_ip is true, then all of these subnets must be public subnets (route to an internet gateway). If var.assign_public_ip is false, then all of these subnets must be private subnets (route to a NAT gateway).	list(string)	n/a	yes
ecs_task_cloudwatch_log_group_kms_key_id	KMS key ID or ARN used to encrypt the ECS task CloudWatch log group. When null, CloudWatch Logs uses its default encryption key.	string	null	no
ecs_task_cloudwatch_log_group_name	Name for the ECS task CloudWatch log group.	string	"ecs-teleport"	no
ecs_task_cloudwatch_log_group_region	AWS region for the ECS task CloudWatch log group. Defaults to the AWS provider region.	string	null	no
ecs_task_cloudwatch_log_group_retention_days	Number of days to retain logs in the ECS task CloudWatch log group.	number	30	no
ecs_task_cloudwatch_log_group_skip_destroy	Whether to preserve the ECS task CloudWatch log group when destroying module resources. Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state.	bool	false	no
ecs_task_cloudwatch_log_group_use_name_prefix	Determines whether var.ecs_task_cloudwatch_log_group_name is used as a prefix of the ECS task CloudWatch log group name.	bool	true	no
ecs_task_cpu	Number of cpu units used by the ECS task.	number	2048	no
ecs_task_definition_name	Name of the ECS task.	string	"teleport"	no
ecs_task_definition_use_name_prefix	Determines whether var.ecs_task_definition_name is used as a prefix of the ECS task definition name.	bool	true	no
ecs_task_desired_count	Desired number of Teleport ECS tasks to run.	number	2	no
ecs_task_force_new_deployment	Set to true to force the ECS service to redeploy tasks without configuration changes.	bool	false	no
ecs_task_memory	Amount (in MiB) of memory used by the ECS task.	number	4096	no
ecs_task_role_inline_policy	Optional JSON policy document to merge into the inline policy attached to the ECS task IAM role.	string	null	no
ecs_task_role_self_assumption_allowed	Whether the ECS task IAM role can assume itself.	bool	true	no
environment_vars	Environment variables to set on the Teleport ECS container.	map(string)	{}	no
managed_updates_enabled	Whether to resolve the Teleport version from the configured Managed Updates endpoint when applying this module.	bool	true	no
managed_updates_group	Update group to query through the v2 Managed Updates endpoint.	string	"default"	no
security_group_ids	Additional security group IDs to attach to the Teleport ECS tasks.	list(string)	[]	no
teleport_config	Teleport configuration. Write the configuration using native Terraform syntax. Warning: sensitive data, such as static join tokens, is visible to anyone who can read the task definition.	any	n/a	yes
teleport_container_image	Container image used for Teleport ECS tasks.	string	"public.ecr.aws/gravitational/teleport-ent-distroless"	no
teleport_version_override	teleport_version_override is intended for development and MUST NOT be used to control the Teleport version in a typical deployment. This module is designed to run a specific Teleport version. You will face compatibility issues trying to run a different Teleport version with it. If you want to run Teleport version X.Y.Z, you should adjust the module version to X.Y.Z instead.	string	null	no
vpc_id	VPC ID where Teleport will be deployed.	string	n/a	yes

Outputs

Name	Description
ecs_cluster_arn	ARN of the ECS cluster for the Teleport ECS service.
ecs_cluster_name	Name of the ECS cluster for the Teleport ECS service.
ecs_execution_role_arn	The ARN of the execution IAM role for the Teleport ECS task.
ecs_execution_role_name	The name of the execution IAM role for the Teleport ECS task.
ecs_service_arn	ARN of the Teleport ECS service.
ecs_service_name	Name of the Teleport ECS service.
ecs_task_cloudwatch_log_group_arn	ARN of the CloudWatch log group for the Teleport ECS task.
ecs_task_cloudwatch_log_group_name	Name of the CloudWatch log group for the Teleport ECS task.
ecs_task_definition_arn	ARN of the Teleport ECS task definition.
ecs_task_role_arn	The ARN of the task IAM role for the Teleport ECS task.
ecs_task_role_name	The name of the task IAM role for the Teleport ECS task.
security_group_id	Security group ID created for the Teleport ECS service.
teleport_provision_token_allow_aws_arn	A value that can be used with a Teleport IAM join token to allow the ECS cluster to join the Teleport cluster using its IAM credentials.