Teleport Database Service Example

Report an Issue

Is this page helpful?

How can we improve this page?

View as Markdown

This page lists the configuration fields in a usage example of the teleport-agent-aws Terraform module: db-service.

Deploy Teleport Database Service to ECS

This example deploys the Teleport Database Service to AWS ECS and joins it to an example Teleport cluster using an IAM join token.

Requirements

Name	Version
terraform	>= 1.5.7
aws	~> 6.0
http	~> 3.0
teleport	~> 18.5

Providers

Name	Version
aws	~> 6.0
teleport	~> 18.5

Modules

Name	Source	Version
teleport_database_service	../..	n/a
vpc	terraform-aws-modules/vpc/aws	6.6.0

Resources

Name	Type
teleport_provision_token.iam	resource
aws_availability_zones.this	data source

Inputs

Name	Description	Type	Default	Required
teleport_proxy_addr	The address of the Teleport Proxy Service in host:port form.	string	n/a	yes

Outputs

Name	Description
teleport_database_service	n/a

Source Code

View the db-service example source code for the teleport-agent-aws module on GitHub.

################################################################################
# teleport/agent/aws/examples/db-service/data.tf
################################################################################

data "aws_availability_zones" "this" {}

################################################################################
# teleport/agent/aws/examples/db-service/main.tf
################################################################################

locals {
  namespace = "example"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "6.6.0"

  azs  = slice(data.aws_availability_zones.this.names, 0, 3)
  cidr = "10.0.0.0/16"
  name = "${local.namespace}-vpc"

  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
}

module "teleport_database_service" {
  source  = "terraform.releases.teleport.dev/teleport/agent/aws"
  version = "~> 19.0"

  # Enable managed updates
  managed_updates_enabled = true
  managed_updates_group   = "default"

  apply_aws_tags         = { "example" = "true" }
  assign_public_ip       = true # must be true when using public subnets
  ecs_cluster_name       = "${local.namespace}-cluster"
  ecs_service_name       = "${local.namespace}-svc"
  ecs_service_subnets    = module.vpc.public_subnets
  ecs_task_desired_count = 1
  environment_vars       = { EXAMPLE_VAR = "EXAMPLE_VALUE" }
  vpc_id                 = module.vpc.vpc_id

  teleport_config = {
    version = "v3"
    teleport = {
      join_params = {
        token_name = "${local.namespace}-iam"
        method     = "iam"
      }
      proxy_server = var.teleport_proxy_addr
      log = {
        severity = "DEBUG"
      }
    }
    auth_service = {
      enabled = "no"
    }
    proxy_service = {
      enabled = "no"
    }
    ssh_service = {
      enabled = "no"
    }
    discovery_service = {
      enabled = "no"
    }
    db_service = {
      enabled = "yes"
      resources = [
        {
          labels = {
            "env" = "example"
          }
        }
      ]
    }
  }
}

resource "teleport_provision_token" "iam" {
  metadata = {
    name        = "${local.namespace}-iam"
    description = "Allow the Teleport ECS agent to join the cluster using AWS IAM credentials."
  }
  spec = {
    allow = [{
      aws_arn = module.teleport_database_service.teleport_provision_token_allow_aws_arn
    }]
    join_method = "iam"
    roles       = ["Db"]
  }
  version = "v2"
}

################################################################################
# teleport/agent/aws/examples/db-service/outputs.tf
################################################################################

output "teleport_database_service" {
  value = module.teleport_database_service
}

################################################################################
# teleport/agent/aws/examples/db-service/providers.tf
################################################################################

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = {
      env = "example"
    }
  }
}

provider "teleport" {
  addr         = var.teleport_proxy_addr
  profile_name = replace(var.teleport_proxy_addr, "/:[0-9]+.*/", "")
}

################################################################################
# teleport/agent/aws/examples/db-service/variables.tf
################################################################################

variable "teleport_proxy_addr" {
  description = "The address of the Teleport Proxy Service in host:port form."
  type        = string
}

################################################################################
# teleport/agent/aws/examples/db-service/versions.tf
################################################################################

terraform {
  required_version = ">= 1.5.7"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
    http = {
      source  = "hashicorp/http"
      version = "~> 3.0"
    }
    teleport = {
      source  = "terraform.releases.teleport.dev/gravitational/teleport"
      version = "~> 18.5"
    }
  }
}