gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-12 02:15:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Generate reference docs for Terraform modules (#63314)

Browse Source 
* Generate reference docs for Terraform modules

* Check Terraform module reference docs are updated
This commit is contained in:
Gavin Frazar
2026-02-02 14:59:04 +00:00
committed by GitHub
parent bc86fc4c50
commit a0b1ddb107
11 changed files with 447 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/lint.yaml
+14
View File
@@ -66,10 +66,16 @@ jobs:
- 'integrations/terraform/examples/**'
- 'integrations/terraform/templates/**'
- 'integrations/terraform/provider/**'
# terraform modules generator changes
- 'integrations/terraform-modules/.terraform-docs.yml'
- 'integrations/terraform-modules/Makefile'
- 'integrations/terraform-modules/teleport/**'
- 'integrations/terraform-modules/gen/docs.sh'
# rendered doc changes
- 'docs/pages/reference/infrastructure-as-code/operator-resources/**'
- 'docs/pages/reference/infrastructure-as-code/terraform-provider/**'
- 'docs/pages/reference/infrastructure-as-code/teleport-resources/**'
- 'docs/pages/reference/infrastructure-as-code/terraform-modules/**'
- 'examples/chart/teleport-cluster/charts/teleport-operator/operator-crds'
- 'build.assets/tooling/cmd/resource-ref-generator/**'
has_ui:
@@ -278,6 +284,14 @@ jobs:
# The protoc-gen-terraform version must match the version in integrations/terraform/Makefile
run: git config --global --add safe.directory $(realpath .) && go install github.com/gravitational/protoc-gen-terraform/[email protected] && make terraform-resources-up-to-date
- name: Check if Terraform module reference docs are up to date
# We have to add the current directory as a safe directory or else git commands will not work as expected.
# terraform-docs version must match the version in integrations/terraform-modules/.terraform-docs.yml
run: |
git config --global --add safe.directory $(realpath .)
go install github.com/terraform-docs/[email protected]
make terraform-module-docs-up-to-date
- name: Check if the Access Monitoring reference is up to date
# We have to add the current directory as a safe directory or else git commands will not work as expected.
# The protoc-gen-terraform version must match the version in integrations/terraform/Makefile
Makefile
+9
View File
@@ -1699,6 +1699,15 @@ terraform-resources-up-to-date: must-start-clean/host
exit 1; \
fi
# terraform-module-docs-up-to-date checks if the generated Terraform module documentation is up to date.
.PHONY: terraform-module-docs-up-to-date
terraform-module-docs-up-to-date: must-start-clean/host
$(MAKE) -C integrations/terraform-modules docs
@if ! git diff --quiet; then \
./build.assets/please-run.sh "TF module docs" "make -C integrations/terraform-modules docs"; \
exit 1; \
fi
# icons-up-to-date checks if icons were pre-processed before being added to the repo.
.PHONY: icons-up-to-date
icons-up-to-date: must-start-clean/host
docs/pages/reference/infrastructure-as-code/terraform-modules/teleport-discovery-aws/examples/examples.mdx
+15
View File
@@ -0,0 +1,15 @@
---
title: Teleport AWS discovery examples
sidebar_label: examples
description: Index of all the examples for the teleport-discovery-aws Terraform module.
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit integrations/terraform-modules/gen/docs.sh
Then, regenerate the docs with `make -C integrations/terraform-modules docs`.
*/}
<DocCardList />
docs/pages/reference/infrastructure-as-code/terraform-modules/teleport-discovery-aws/examples/single-account.mdx
+58
View File
@@ -0,0 +1,58 @@
---
title: Example for discovering AWS resources in a single account
sidebar_label: single-account
description: Configure Teleport to discover resources in a AWS account.
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit teleport/discovery/aws/examples/single-account/README.md
Then, regenerate the docs with `make -C integrations/terraform-modules docs`.
*/}
Source Code: [github.com/gravitational/teleport/tree/master/integrations/terraform-modules/teleport/discovery/aws/examples/single-account](https://github.com/gravitational/teleport/tree/master/integrations/terraform-modules/teleport/discovery/aws/examples/single-account)
## Teleport AWS Account Discovery Example
Configuration in this directory creates AWS and Teleport resources necessary for Teleport to discover resources in a single AWS account.
In addition, the example uses a custom AWS IAM policy to narrow the scope of permissions for Teleport Discovery Service instances.
{/* BEGIN_TF_DOCS */}
## Requirements
| Name | Version |
|------|---------|
| terraform | >= 1.0 |
| aws | >= 5.0 |
| teleport | >= 18.5.1 |
| tls | >= 4.0 |
## Providers
| Name | Version |
|------|---------|
| aws | >= 5.0 |
## Modules
| Name | Source | Version |
|------|--------|---------|
| aws\_discovery | ../.. | n/a |
## Resources
| Name | Type |
|------|------|
| [aws_iam_policy_document.teleport_discovery_service_single_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
## Inputs
No inputs.
## Outputs
| Name | Description |
|------|-------------|
| aws\_discovery | n/a |
{/* END_TF_DOCS */}
docs/pages/reference/infrastructure-as-code/terraform-modules/teleport-discovery-aws/teleport-discovery-aws.mdx
+143
View File
@@ -0,0 +1,143 @@
---
title: Reference for the teleport-discovery-aws Terraform module
sidebar_label: teleport-discovery-aws
description: This page describes the Terraform module for discovering resources in AWS.
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit integrations/terraform-modules/teleport/discovery/aws/README.md
Then, regenerate the docs with `make -C integrations/terraform-modules docs`.
*/}
Source Code: [github.com/gravitational/teleport/tree/master/integrations/terraform-modules/teleport/discovery/aws](https://github.com/gravitational/teleport/tree/master/integrations/terraform-modules/teleport/discovery/aws)
## AWS Discovery Terraform module
This Terraform module creates the AWS and Teleport cluster resources necessary for a Teleport cluster to discover resources in AWS.
- AWS IAM role for Teleport Discovery Service to assume.
- AWS IAM policy attached to the IAM role that grants the AWS permissions necessary for Teleport to discover resources in AWS.
- AWS OIDC Provider for Teleport Discovery Service to assume an IAM role using OIDC. This resource is optional - creation can be disabled using `create_aws_iam_openid_connect_provider = false`. This resource is optional to support two scenarios:
- When there is already an AWS IAM OIDC provider in the AWS account configured to use your Teleport cluster's proxy URL. AWS restricts AWS IAM OIDC providers to one per unique URL, so if you are managing that provider already then this module cannot create another one for the same Teleport cluster.
- When AWS IAM OIDC federation is not possible because your Teleport cluster's proxy URL is not reachable. In this case you should configure AWS IAM role credentials for your Teleport Discovery Service instances and set `discovery_service_iam_credential_source` to trust that role.
- Teleport `discovery_config` cluster resource that configures Teleport for AWS resource discovery.
- Teleport `integration` cluster resource for AWS OIDC.
- Teleport `token` cluster resource that allows Teleport nodes to use AWS IAM credentials to join the cluster.
## Prerequisites
{/* lint ignore absolute-docs-links */}
- [Configure Teleport Terraform Provider](https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/)
- [Configure AWS Terraform provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
## Usage
``` hcl
module "aws_discovery" {
source = "terraform.releases.teleport.dev/teleport/discovery/aws"
# Your Teleport cluster public proxy address - host:port format is required.
teleport_proxy_public_addr = "example.teleport.sh:443"
# Teleport Discovery Service instances in this discovery group will be configured to discover AWS resources.
# "cloud-discovery-group" is the group name of the discovery service instances running in Teleport Cloud clusters.
teleport_discovery_group_name = "cloud-discovery-group"
# apply additional tags to the AWS resources created by the module
apply_aws_tags = {
Terraform = "true"
Env = "dev"
}
# Match EC2 instances that have the AWS tag "origin=example"
match_aws_resource_types = ["ec2"]
match_aws_tags = {
origin = ["example"]
}
}
```
## How to get help
If you're having trouble, check out our [GitHub Discussions](https://github.com/gravitational/teleport/discussions).
For bugs related to this code, please [open an issue](https://github.com/gravitational/teleport/issues/new/choose).
{/* BEGIN_TF_DOCS */}
## Requirements
| Name | Version |
|------|---------|
| terraform | >= 1.5.7 |
| aws | >= 5.0 |
| http | >= 3.0 |
| teleport | >= 18.5.1 |
| tls | >= 4.0 |
## Providers
| Name | Version |
|------|---------|
| aws | >= 5.0 |
| http | >= 3.0 |
| teleport | >= 18.5.1 |
| tls | >= 4.0 |
## Modules
No modules.
## Resources
| Name | Type |
|------|------|
| [aws_iam_openid_connect_provider.teleport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
| [aws_iam_policy.teleport_discovery_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_role.teleport_discovery_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy_attachment.teleport_discovery_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| teleport_discovery_config.aws | resource |
| teleport_integration.aws_oidc | resource |
| teleport_provision_token.aws_iam | resource |
| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_policy_document.teleport_discovery_service_iam_role_trust](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.teleport_discovery_service_single_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
| [http_http.teleport_ping](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) | data source |
| [tls_certificate.teleport_proxy](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| apply\_aws\_tags | Additional AWS tags to apply to all created AWS resources. | `map(string)` | `{}` | no |
| apply\_teleport\_resource\_labels | Additional Teleport resource labels to apply to all created Teleport resources. | `map(string)` | `{}` | no |
| aws\_iam\_policy\_document | Override the AWS IAM policy document attached to the AWS IAM role for resource discovery. | `string` | `""` | no |
| aws\_iam\_policy\_name | Name for the AWS IAM policy for discovery. | `string` | `"teleport-discovery"` | no |
| aws\_iam\_policy\_use\_name\_prefix | Determines whether the name of the AWS IAM policy (`aws_iam_policy_name`) is used as a prefix. | `bool` | `true` | no |
| aws\_iam\_role\_name | Name for the AWS IAM role for discovery. | `string` | `"teleport-discovery"` | no |
| aws\_iam\_role\_use\_name\_prefix | Determines whether the name of the AWS IAM role (`aws_iam_role_name`) is used as a prefix. | `bool` | `true` | no |
| create | Toggle creation of all resources. | `bool` | `true` | no |
| create\_aws\_iam\_openid\_connect\_provider | Toggle AWS IAM OIDC provider creation. If false and using OIDC, then the AWS IAM OIDC provider must already exist. | `bool` | `true` | no |
| discovery\_service\_iam\_credential\_source | Configure the AWS credential source for Teleport Discovery Service instances. The default uses AWS OIDC integration. | ```object({ use_oidc_integration = optional(bool) trust_role = optional(object({ role_arn = string external_id = optional(string, "") })) })``` | ```{ "trust_role": null, "use_oidc_integration": true }``` | no |
| match\_aws\_regions | AWS regions to discover. The default matches all AWS regions. | `list(string)` | ```[ "*" ]``` | no |
| match\_aws\_resource\_types | AWS resource types to match when discovering resources with Teleport. Valid values are: `ec2`. | `list(string)` | n/a | yes |
| match\_aws\_tags | AWS resource tags to match when discovering resources with Teleport. The default matches all discovered AWS resources. | `map(list(string))` | ```{ "*": [ "*" ] }``` | no |
| teleport\_discovery\_config\_name | Name for the `teleport_discovery_config` resource. | `string` | `"discovery"` | no |
| teleport\_discovery\_config\_use\_name\_prefix | Determines whether the name of the Teleport discovery config (`teleport_discovery_config_name`) is used as a prefix. | `bool` | `true` | no |
| teleport\_discovery\_group\_name | Teleport discovery group to use. For discovery configuration to apply, this name must match at least one Teleport Discovery Service instance's configured `discovery_group`. For Teleport Cloud clusters, use "cloud-discovery-group". | `string` | n/a | yes |
| teleport\_integration\_name | Name for the `teleport_integration` resource. | `string` | `"discovery"` | no |
| teleport\_integration\_use\_name\_prefix | Determines whether the name of the Teleport integration (`teleport_integration_name`) is used as a prefix. | `bool` | `true` | no |
| teleport\_provision\_token\_name | Name for the `teleport_provision_token` resource. | `string` | `"discovery"` | no |
| teleport\_provision\_token\_use\_name\_prefix | Determines whether the name of the Teleport provision token (`teleport_provision_token_name`) is used as a prefix. | `bool` | `true` | no |
| teleport\_proxy\_public\_addr | Teleport cluster proxy public address `host:port`. | `string` | n/a | yes |
## Outputs
| Name | Description |
|------|-------------|
| aws\_oidc\_provider\_arn | AWS resource name (ARN) of the AWS OpenID Connect (OIDC) provider that allows Teleport Discovery Service to assume an AWS IAM role using OIDC. |
| teleport\_discovery\_config\_name | Name of the Teleport dynamic `discovery_config`. Configuration details can be viewed with `tctl get discovery_config/<name>`. Teleport Discovery Service instances will use this `discovery_config` if they are in the same discovery group as the `discovery_config`. |
| teleport\_discovery\_service\_iam\_policy\_arn | AWS resource name (ARN) of the AWS IAM policy that grants the permissions needed for Teleport to discover resources in AWS. |
| teleport\_discovery\_service\_iam\_role\_arn | AWS resource name (ARN) of the AWS IAM role that Teleport Discovery Service will assume. |
| teleport\_integration\_name | Name of the Teleport `integration` resource. The integration resource configures Teleport Discovery Service instances to assume an AWS IAM role for discovery using AWS OIDC federation. Integration details can be viewed with `tctl get integrations/<name>` or by visiting the Teleport web UI under 'Zero Trust Access' > 'Integrations'. |
| teleport\_provision\_token\_name | Name of the Teleport provision `token` that allows Teleport nodes to join the Teleport cluster using AWS IAM credentials. Token details can be viewed with `tctl get token/<name>`. |
{/* END_TF_DOCS */}
docs/pages/reference/infrastructure-as-code/terraform-modules/terraform-modules.mdx
+20
View File
@@ -0,0 +1,20 @@
---
title: "Teleport Terraform Modules Reference"
sidebar_label: Terraform Modules
description: Reference documentation for the Teleport Terraform modules.
tags:
- infrastructure-as-code
- reference
- platform-wide
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit integrations/terraform-modules/gen/docs.sh
Then, regenerate the docs with `make -C integrations/terraform-modules docs`.
*/}
Teleport publishes the following Terraform modules:
- [`teleport-discovery-aws`](./teleport-discovery-aws/teleport-discovery-aws.mdx)
integrations/terraform-modules/.terraform-docs.yml
+1 -1
View File
@@ -32,4 +32,4 @@ settings:
sort:
enabled: true
by: name
version: ''
version: '0.21.0'
integrations/terraform-modules/Makefile
+5 -4
View File
@@ -15,7 +15,8 @@ MODULE_DIRS := $(shell find . -type f -name '*.tf' -exec dirname {} \; 2>/dev/nu
README_FILES := $(addsuffix /README.md,$(MODULE_DIRS))
.PHONY: docs
docs: $(README_FILES) ;
docs: $(README_FILES)
./gen/docs.sh $(VERSION) $(PUBLISHED_TF_MODULES)
%/README.md: force
terraform-docs markdown table --config .terraform-docs.yml $*
@@ -53,10 +54,10 @@ release: build
PLUGIN_TYPE := terraform-module
# This list controls which modules are actually published.
PUBLISHED_TF_MODULES := $(subst /,_, \
PUBLISHED_TF_MODULES := \
teleport/discovery/aws \
)
MODULE_TARBALLS:=$(addsuffix .tar.gz, $(PUBLISHED_TF_MODULES))
MODULE_TARBALLS:=$(addsuffix .tar.gz, $(subst /,_,$(PUBLISHED_TF_MODULES)))
BUILD_TARGETS:=$(addprefix $(BUILD_DIR)/$(PLUGIN_TYPE)_, $(MODULE_TARBALLS))
.PHONY: build
integrations/terraform-modules/gen/docs.sh
Executable
+149
View File
@@ -0,0 +1,149 @@
#!/bin/bash
# If someone runs a debug GitHub Actions task
if [ -n "$RUNNER_DEBUG" ]; then
set -x
fi
set -euo pipefail
info() {
printf "\e[1;32m%s\e[0m\n" "$1"
}
error() {
printf "\e[1;31m%s\e[0m\n" "$1"
exit 1
}
# convert_tf_docs_comment converts comments like <!-- BEGIN_TF_DOCS --> to an mdx comment like {/* BEGIN_TF_DOCS */}
convert_tf_docs_comment() {
sed 's#<!-- \(.*\) -->#{/\* \1 \*/}#'
}
VERSION="$1"; shift
if [ -z "$VERSION" ]; then
error "Version arg is required"
fi
PUBLISHED_TF_MODULES=( "$@" )
if [[ ${#PUBLISHED_TF_MODULES[@]} -eq 0 ]]; then
error "Published modules args are required"
fi
DOCSDIR="$(pwd)/../../docs/pages/reference/infrastructure-as-code/terraform-modules"
TMPDIR="$(mktemp -d)"
MODULES_DOC_INDEX="${TMPDIR}/terraform-modules.mdx"
MODULES_ROOT_DIR="$(git rev-parse --show-prefix)" # the relative path from the git repo to the modules dir, e.g., "integrations/terraform-modules" at time of writing.
MODULES_ROOT_DIR="${MODULES_ROOT_DIR%%/}" # trim trailing slash
SOURCE_URI="github.com/gravitational/teleport/tree/master/${MODULES_ROOT_DIR}"
info "Rendering modules reference index"
cat <<EOF > "${MODULES_DOC_INDEX}"
---
title: "Teleport Terraform Modules Reference"
sidebar_label: Terraform Modules
description: Reference documentation for the Teleport Terraform modules.
tags:
- infrastructure-as-code
- reference
- platform-wide
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit ${MODULES_ROOT_DIR}/gen/docs.sh
Then, regenerate the docs with \`make -C ${MODULES_ROOT_DIR} docs\`.
*/}
Teleport publishes the following Terraform modules:
EOF
for module in "${PUBLISHED_TF_MODULES[@]}"; do
module_name="${module//\//-}"
# inject a link to the module into the modules index page
info "Adding ${module_name} to modules reference index"
cat <<EOF >> "${MODULES_DOC_INDEX}"
- [\`${module_name}\`](./${module_name}/${module_name}.mdx)
EOF
info "Rendering module ${module_name} reference doc"
module_docs_dir=${TMPDIR}/${module_name}
mkdir -p "${module_docs_dir}"
module_index_doc="${module_docs_dir}/${module_name}.mdx"
remote_system="${module_name##*-}" # trim everything up to the last dash, which is the "system" component, e.g., "aws".
remote_system=$(echo "${remote_system}" | tr '[:lower:]' '[:upper:]') # uppercase it, e.g., "aws" -> "AWS".
# inject a generated docs header
cat <<EOF > "${module_index_doc}"
---
title: Reference for the ${module_name} Terraform module
sidebar_label: ${module_name}
description: This page describes the Terraform module for discovering resources in ${remote_system}.
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit ${MODULES_ROOT_DIR}/${module}/README.md
Then, regenerate the docs with \`make -C ${MODULES_ROOT_DIR} docs\`.
*/}
Source Code: [${SOURCE_URI}/${module}](https://${SOURCE_URI}/${module})
EOF
convert_tf_docs_comment < "${module}/README.md" >> "${module_index_doc}"
# handle examples
module_examples_docs_dir="${module_docs_dir}/examples"
mkdir -p "${module_examples_docs_dir}"
module_examples_index="${module_examples_docs_dir}/examples.mdx"
info "Rendering module ${module_name} examples index"
cat <<EOF > "${module_examples_index}"
---
title: Teleport ${remote_system} discovery examples
sidebar_label: examples
description: Index of all the examples for the ${module_name} Terraform module.
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit ${MODULES_ROOT_DIR}/gen/docs.sh
Then, regenerate the docs with \`make -C ${MODULES_ROOT_DIR} docs\`.
*/}
<DocCardList />
EOF
examples="$(find "${module}/examples" -maxdepth 1 -mindepth 1 -type d)"
for example in ${examples}; do
example_name="$(basename "${example}")"
info "Rendering module ${module_name} example ${example_name} reference doc"
example_doc="${module_examples_docs_dir}/${example_name}.mdx"
# inject header
cat <<EOF > "${example_doc}"
---
title: Example for discovering ${remote_system} resources in a single account
sidebar_label: ${example_name}
description: Configure Teleport to discover resources in a ${remote_system} account.
---
{/*
Auto-generated file.
Do not edit this directly in the docs/pages tree.
Instead, edit ${example}/README.md
Then, regenerate the docs with \`make -C ${MODULES_ROOT_DIR} docs\`.
*/}
Source Code: [${SOURCE_URI}/${example}](https://${SOURCE_URI}/${example})
EOF
convert_tf_docs_comment < "${example}/README.md" >> "${example_doc}"
done
done
rm -rf "${DOCSDIR}"
cp -r "${TMPDIR}" "${DOCSDIR}"
integrations/terraform-modules/teleport/discovery/aws/README.md
+30 -7
View File
@@ -1,9 +1,9 @@
# AWS Discovery Terraform module
## AWS Discovery Terraform module
This Terraform module creates the AWS and Teleport cluster resources necessary for a Teleport cluster to discover resources in AWS:
This Terraform module creates the AWS and Teleport cluster resources necessary for a Teleport cluster to discover resources in AWS.
- AWS IAM role for Teleport Discovery Service to assume.
- AWS IAM policy attached to the IAM role that grants the AWS permissions necessary for Teleport to discover resources in AWS.
- AWS IAM role for Teleport Discovery Service to assume.
- AWS IAM policy attached to the IAM role that grants the AWS permissions necessary for Teleport to discover resources in AWS.
- AWS OIDC Provider for Teleport Discovery Service to assume an IAM role using OIDC. This resource is optional - creation can be disabled using `create_aws_iam_openid_connect_provider = false`. This resource is optional to support two scenarios:
- When there is already an AWS IAM OIDC provider in the AWS account configured to use your Teleport cluster's proxy URL. AWS restricts AWS IAM OIDC providers to one per unique URL, so if you are managing that provider already then this module cannot create another one for the same Teleport cluster.
- When AWS IAM OIDC federation is not possible because your Teleport cluster's proxy URL is not reachable. In this case you should configure AWS IAM role credentials for your Teleport Discovery Service instances and set `discovery_service_iam_credential_source` to trust that role.
@@ -13,11 +13,34 @@ This Terraform module creates the AWS and Teleport cluster resources necessary f
## Prerequisites
- [Install Teleport Terraform Provider](https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/)
<!-- lint ignore absolute-docs-links -->
- [Configure Teleport Terraform Provider](https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/)
- [Configure AWS Terraform provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
## Examples
## Usage
- [Discover resources in a single AWS account](./examples/single-account)
``` hcl
module "aws_discovery" {
source = "terraform.releases.teleport.dev/teleport/discovery/aws"
# Your Teleport cluster public proxy address - host:port format is required.
teleport_proxy_public_addr = "example.teleport.sh:443"
# Teleport Discovery Service instances in this discovery group will be configured to discover AWS resources.
# "cloud-discovery-group" is the group name of the discovery service instances running in Teleport Cloud clusters.
teleport_discovery_group_name = "cloud-discovery-group"
# apply additional tags to the AWS resources created by the module
apply_aws_tags = {
Terraform = "true"
Env = "dev"
}
# Match EC2 instances that have the AWS tag "origin=example"
match_aws_resource_types = ["ec2"]
match_aws_tags = {
origin = ["example"]
}
}
```
## How to get help
integrations/terraform-modules/teleport/discovery/aws/examples/single-account/README.md
+3 -1
View File
@@ -1,7 +1,9 @@
# Teleport AWS Account Discovery Example
## Teleport AWS Account Discovery Example
Configuration in this directory creates AWS and Teleport resources necessary for Teleport to discover resources in a single AWS account.
In addition, the example uses a custom AWS IAM policy to narrow the scope of permissions for Teleport Discovery Service instances.
<!-- BEGIN_TF_DOCS -->
## Requirements