Database Labels Reference
Teleport assigns system-defined labels to protected databases. This guide describes the system-defined labels and how Teleport uses them.
Origin
All registered databases have a predefined teleport.dev/origin label with one
of the following values:
| Label Value | Description |
|---|---|
cloud | database resources created by auto-discovery. |
config | database resources manually defined in the database_service.databases section of teleport.yaml. |
dynamic | database resources created through dynamic registration like tcl create command. |
Auto-discovery
The labels of auto-discovered databases primarily come from the tags that are assigned to the original cloud resources, such as the resources tags of an Amazon RDS instance.
The following tags will override Teleport's default behavior if assigned to the original cloud resources:
| Tag name | Description |
|---|---|
TeleportDatabaseName | Overrides the name of the discovered database. |
teleport.dev/database_name | (AWS only, legacy) Overrides the name of the discovered database. TeleportDatabaseName is preferred. |
teleport.dev/db-admin | (AWS only) Specifies the name of the admin user for Automatic User Provisioning. |
teleport.dev/db-admin-default-database | (AWS only) Overrides the default database the admin user logs into for Automatic User Provisioning. |
Additionally, Teleport will generate certain labels derived from the cloud resource attributes:
| Label name | Description |
|---|---|
account-id | ID of the AWS account the resource resides in. |
endpoint-type | Type of the endpoint. See section below for more details. |
engine | Amazon RDS: engine type of the RDS instance or Aurora cluster. Amazon RDS Proxy: engine family of the proxy. Azure-hosted databases: resource type of the resource ID. |
engine-version | Database engine version, if available. |
namespace | Amazon Redshift Serverless namespace name. |
region | AWS region or Azure location. |
replication-role | The replication role of an Azure DB Flexible server. |
source-server | The source server of an Azure DB Flexible server replica. |
vpc-id | ID of the Amazon VPC the resource resides in, if available. |
workgroup | Amazon Redshift Serverless workgroup name. |
teleport.dev/discovery-type | Specifies the type of resource matched by the Teleport Discovery Service, e.g. "rds", "redshift", etc. |
endpoint-type
The following values are used to indicate the type of the database endpoint:
| Database Type | Values |
|---|---|
| Amazon RDS instance | instance |
| Amazon RDS Aurora cluster | one of primary, reader, custom |
| Amazon RDS Proxy | one of READ_WRITE, READ_ONLY (custom endpoints only) |
| Amazon Redshift Serverless | one of workgroup, vpc-endpoint |
| Amazon ElastiCache | one of configuration, primary, reader, node |
| Amazon MemoryDB | one of cluster, node |
| Amazon OpenSearch | one of default, custom, vpc |
| Azure Redis Enterprise | one of EnterpriseCluster, OSSCluster |
Manual and dynamic registration
Static labels and dynamic labels can be specified in labels and
dynamic_labels fields respectively in database definition. See
Configuration for reference.
Database Service on Amazon EC2
All registered databases can inherit the labels converted from the tags of the
EC2 instance running the Teleport Database Service. Labels created this way
will have the aws/ prefix. See Sync EC2
Tags for more details.