From aedecec3e3f0f986c15c0a9032fbe22ee659d616 Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Wed, 25 Mar 2026 11:40:02 -0400 Subject: [PATCH] [v18] docs: fixes for grammar and references (#64932) * docs: fixes for grammar and references * docs: fix link to auto provisioning --- .../cloud-apis/awsoidc-integration-rds.mdx | 4 ++-- .../application-access/cloud-apis/azure.mdx | 2 +- .../application-access/cloud-apis/google-cloud.mdx | 2 +- .../application-access/getting-started.mdx | 2 +- .../auto-discovery/databases/aws.mdx | 2 +- .../auto-discovery/databases/databases.mdx | 2 +- .../kubernetes-applications/reference.mdx | 4 ++-- .../servers/ec2-discovery/ec2-discovery-guided.mdx | 2 +- .../servers/ec2-discovery/ec2-discovery-manual.mdx | 2 +- .../database-access/database-access.mdx | 2 +- .../database-access/enrollment/aws/aws-docdb.mdx | 2 +- .../database-access/getting-started.mdx | 2 +- .../enroll-resources/kubernetes-access/controls.mdx | 3 ++- .../kubernetes-access/health-checks.mdx | 2 +- .../kubernetes-access/manage-access.mdx | 2 +- .../register-clusters/static-kubeconfig.mdx | 2 +- .../kubernetes-access/troubleshooting.mdx | 2 +- .../mcp-access/enrolling-mcp-servers/sse.mdx | 2 +- .../mcp-access/enrolling-mcp-servers/stdio.mdx | 2 +- .../enrolling-mcp-servers/streamable-http.mdx | 4 ++-- .../enroll-resources/mcp-access/getting-started.mdx | 2 +- .../integration-guides/aws-bedrock-gateway.mdx | 2 +- .../mcp-access/integration-guides/github.mdx | 2 +- .../server-access/getting-started.mdx | 2 +- .../enroll-resources/server-access/guides/auditd.mdx | 2 +- docs/pages/identity-governance/access-monitoring.mdx | 2 +- .../access-requests/access-request-configuration.mdx | 6 +++--- .../access-requests/plugins/datadog-hosted.mdx | 2 +- .../access-requests/plugins/how-to-build.mdx | 2 +- .../access-requests/plugins/opsgenie.mdx | 2 +- .../access-requests/plugins/pagerduty.mdx | 2 +- .../access-requests/plugins/servicenow.mdx | 2 +- .../access-requests/role-requests.mdx | 2 +- docs/pages/identity-governance/idps/saml-guide.mdx | 6 +++--- .../pages/identity-governance/idps/saml-idp-rbac.mdx | 2 +- .../identity-governance/idps/usage/saml-grafana.mdx | 2 +- .../idps/usage/saml-microsoft-entra-external-id.mdx | 12 ++++++------ .../aws-iam-identity-center/advanced-options.mdx | 2 +- .../integrations/aws-iam-identity-center/guide.mdx | 2 +- ...grating-identity-center-from-okta-to-teleport.mdx | 6 +++--- .../aws-iam-identity-center/using-aws-cli.mdx | 2 +- .../integrations/entra-id/entra-id.mdx | 2 +- .../entra-id/setup/manual-installation.mdx | 4 ++-- .../integrations/entra-id/setup/terraform.mdx | 6 +++--- .../integrations/okta/app-and-group-sync.mdx | 4 ++-- .../integrations/okta/guided-sso.mdx | 6 +++--- .../integrations/okta/user-sync.mdx | 4 ++-- .../identity-governance/integrations/scim/scim.mdx | 6 +++--- docs/pages/identity-governance/locking.mdx | 2 +- .../access-graph/identity-activity-center.mdx | 2 +- .../identity-security/integrations/aws-sync.mdx | 6 +++--- docs/pages/identity-security/integrations/netiq.mdx | 4 ++-- .../identity-security/integrations/ssh-keys-scan.mdx | 4 ++-- docs/pages/identity-security/session-summaries.mdx | 4 ++-- docs/pages/identity-security/usage/dashboard.mdx | 2 +- .../pages/identity-security/usage/graph-explorer.mdx | 2 +- docs/pages/identity-security/usage/investigate.mdx | 2 +- .../application-access/aws-database-access-cli.mdx | 2 +- .../aws-database-start-app-service.mdx | 2 +- .../database-access/tctl-auth-sign-3-files.mdx | 2 +- .../includes/discovery/aws-db-discovery-config.mdx | 2 +- docs/pages/includes/discovery/discovery-config.yaml | 2 +- .../includes/mcp-access/configure-app-service.mdx | 2 +- .../includes/mcp-access/integration-teleport-app.mdx | 6 +++--- docs/pages/includes/mcp-access/integration-tsh.mdx | 2 +- docs/pages/includes/provision-token/gitlab-spec.mdx | 2 +- .../includes/provision-token/spacelift-spec.mdx | 4 ++-- docs/pages/includes/provision-token/tpm-spec.mdx | 4 ++-- docs/pages/includes/role-spec.mdx | 4 ++-- .../server-access/azure-join-managed-identity.mdx | 2 +- docs/pages/includes/tpm-joining-background.mdx | 2 +- .../access-guides/applications.mdx | 2 +- .../deployment/github-actions.mdx | 2 +- docs/pages/machine-workload-identity/faq.mdx | 2 +- .../workload-identity/aws-oidc-federation.mdx | 6 +++--- .../workload-identity/aws-roles-anywhere.mdx | 4 ++-- .../workload-identity/tsh.mdx | 2 +- docs/pages/reference/architecture/authorization.mdx | 2 +- docs/pages/reference/cli/tctl.mdx | 4 ++-- .../workload-identity/workload-identity-resource.mdx | 2 +- .../terraform-provider/spacelift.mdx | 2 +- .../management/security/restrict-privileges.mdx | 2 +- .../resources/plugins/teleport-msteams-helm.yaml | 2 +- 83 files changed, 121 insertions(+), 120 deletions(-) diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx index fe31bd43f87..61365d308e2 100644 --- a/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx +++ b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx @@ -66,9 +66,9 @@ When you click "Deploy Teleport Service" the wizard creates an ECS task definition that includes various settings for configuring and starting a Teleport Database Service instance. The task definition uses the IAM role created in the first step as both the -[ECS task execution role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html). +[ECS task execution role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html) and the -[ECS task role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) +[ECS task role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html). The wizard then creates an ECS deployment in the same AWS VPC as your RDS databases, configured to use the subnets and security groups you chose. diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx index 356f410dce4..e46d4bd19f0 100644 --- a/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx +++ b/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx @@ -14,7 +14,7 @@ tags: In this guide, you will: -1. Create an Azure managed identity for user access and attach it your VM. +1. Create an Azure managed identity for user access and attach it to your VM. 1. Deploy the Teleport Application Service with an Azure app in your Teleport cluster. 1. Assume the managed identity and run `az` commands via `tsh`. diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx index 72323a6c1f0..9b916bc3782 100644 --- a/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx +++ b/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx @@ -404,7 +404,7 @@ service accounts you have assigned to the user. Create the role: ```code -$ tctl create -f google-cloud-cli-access +$ tctl create -f google-cloud-cli-access.yaml ``` (!docs/pages/includes/create-role-using-web.mdx!) diff --git a/docs/pages/enroll-resources/application-access/getting-started.mdx b/docs/pages/enroll-resources/application-access/getting-started.mdx index 2c1152e3ad5..799fb09a0e3 100644 --- a/docs/pages/enroll-resources/application-access/getting-started.mdx +++ b/docs/pages/enroll-resources/application-access/getting-started.mdx @@ -32,7 +32,7 @@ joins your Teleport cluster with a secure token. You configure the Application Service to protect a web application using a configuration file. After the Application Service joins the cluster, the Teleport Proxy Service routes requests from end users to the Teleport Application Service, and responses from -the Application Serve back to end users. +the Application Service back to end users. The Application Service authenticates user requests by validating a JSON web token (JWT) in the request against a CA maintained by the Teleport Auth Service. diff --git a/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx b/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx index c3fefec31a1..5688f8bfc8f 100644 --- a/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx +++ b/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx @@ -57,7 +57,7 @@ role: ### Create a Teleport config file -Create a `teleport.yaml` config file on the host that will run the Discovery +Create a `teleport.yaml` config file on the host that will run the Database Service. You can leave the `discovery_group` value as-is or change it to something you find more descriptive. diff --git a/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx b/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx index a8d0b5226d6..e7720739fe7 100644 --- a/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx +++ b/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx @@ -95,7 +95,7 @@ discovery_service: # 'elasticache' - Amazon ElastiCache Redis and Valkey databases. # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases. # 'memorydb' - Amazon MemoryDB Redis databases. - # 'opensearch' - Amazon OpenSearch Redis databases. + # 'opensearch' - Amazon OpenSearch databases. # 'docdb' - Amazon DocumentDB databases. - types: ["rds"] # AWS regions to search for resources from diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx index f8c79637a66..77ecb4268d4 100644 --- a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx +++ b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx @@ -67,8 +67,8 @@ app_service: enabled: true resources: - labels: - "teleport.dev/kubernetes-cluster": "main-cluster" - "teleport.dev/origin": "discovery-kubernetes" + "teleport.dev/kubernetes-cluster": "main-cluster" + "teleport.dev/origin": "discovery-kubernetes" ``` Label `teleport.dev/kubernetes-cluster` should match value of `discovery_group` field in the Discovery Service config. diff --git a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx index b887e710dfe..ab6459ecfc6 100644 --- a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx +++ b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx @@ -234,7 +234,7 @@ $ sudo teleport discovery bootstrap Restart the Teleport service to start discovering new instances: ```code -$ sudo systemd restart teleport +$ sudo systemctl restart teleport ``` You can check the status of the Discovery Service with `systemctl status teleport` diff --git a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx index 1659a2d3acb..a67005a7731 100644 --- a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx +++ b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx @@ -217,7 +217,7 @@ mainSteps: Restart the Teleport service to start discovering new instances: ```code -$ sudo systemd restart teleport +$ sudo systemctl restart teleport ``` You can check the status of the Discovery Service with `systemctl status teleport` diff --git a/docs/pages/enroll-resources/database-access/database-access.mdx b/docs/pages/enroll-resources/database-access/database-access.mdx index 89bbc1d681f..c5cbd293443 100644 --- a/docs/pages/enroll-resources/database-access/database-access.mdx +++ b/docs/pages/enroll-resources/database-access/database-access.mdx @@ -1,6 +1,6 @@ --- title: Databases -description: Provide secure connections to database by improving access control and visibility +description: Provide secure connections to databases by improving access control and visibility template: doc-page tags: - zero-trust diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx index 1953bdd9439..221829a04e0 100644 --- a/docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx +++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx @@ -211,7 +211,7 @@ $ tsh db connect --db-user=teleport-docdb-user --db-name=test my-docdb Log out of the database and remove credentials: ```code -$ tsh db logout rds-example +$ tsh db logout my-docdb ``` ## Troubleshooting diff --git a/docs/pages/enroll-resources/database-access/getting-started.mdx b/docs/pages/enroll-resources/database-access/getting-started.mdx index d5ddbbbfd22..8ce6b7f32ad 100644 --- a/docs/pages/enroll-resources/database-access/getting-started.mdx +++ b/docs/pages/enroll-resources/database-access/getting-started.mdx @@ -92,7 +92,7 @@ GRANT rds_iam TO alice; For more information about connecting to the PostgreSQL instance directly, see the AWS [documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ConnectToPostgreSQLInstance.html). -See the [Automatic User Provisioning](./rbac.mdx) guide for how to configure Teleport to create accounts for your PostgreSQL users on demand. +See the [Automatic User Provisioning](./auto-user-provisioning/postgres.mdx) guide for how to configure Teleport to create accounts for your PostgreSQL users on demand. ## Step 2/5. Configure the Teleport Database Service diff --git a/docs/pages/enroll-resources/kubernetes-access/controls.mdx b/docs/pages/enroll-resources/kubernetes-access/controls.mdx index 88a92dab44e..43ef5b286a6 100644 --- a/docs/pages/enroll-resources/kubernetes-access/controls.mdx +++ b/docs/pages/enroll-resources/kubernetes-access/controls.mdx @@ -1291,4 +1291,5 @@ spec: - kind: pod namespace: "default" name: "*" -``` # ... + # ... +``` diff --git a/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx b/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx index 4b773df7598..b98f6d29076 100644 --- a/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx +++ b/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx @@ -211,7 +211,7 @@ metadata: name: default-kube spec: match: - disable: true + disabled: true kubernetes_labels: - name: '*' values: diff --git a/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx b/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx index 2dc23551c16..bf80a142733 100644 --- a/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx +++ b/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx @@ -13,7 +13,7 @@ and one or more Kubernetes clusters. In this guide, we will use a local Kubernetes cluster to show you how to configure Teleport's role-based access control (RBAC) system to manage access to -Kubernetes clusers, groups, users, and resources. +Kubernetes clusters, groups, users, and resources. ## How it works diff --git a/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx b/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx index 4b186351b9e..1b29cc8988d 100644 --- a/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx +++ b/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx @@ -52,7 +52,7 @@ Use this command to switch to the cluster assigned to ```code # e.g., my-context -$ kubectl config use-context } +$ kubectl config use-context ``` ### Run the script diff --git a/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx b/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx index efdba174ff3..cfec92b81fe 100644 --- a/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx +++ b/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx @@ -125,7 +125,7 @@ another group is used instead. Per the description above, the solution is to configure a different group for impersonation in Teleport. This can be done by setting the role's -`kubernetes_group` parameter to a Group that the Autopilot cluster allows to +`kubernetes_groups` parameter to a Group that the Autopilot cluster allows to impersonate. The `teleport-kube-agent` chart configures a Kubernetes Group with the same access diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx index cf83505622c..8d813b9ba84 100644 --- a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx +++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx @@ -10,7 +10,7 @@ tags: Teleport can provide secure access to MCP servers with SSE transport. -This guides shows you how to: +This guide shows you how to: - Enroll a MCP server with SSE transport in your Teleport cluster. - Connect to the SSE MCP server via Teleport. diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx index a671f0e41d3..08c263b3099 100644 --- a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx +++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx @@ -10,7 +10,7 @@ tags: Teleport can provide secure access to MCP servers with stdio transport. -This guides shows you how to: +This guide shows you how to: - Enroll a MCP server with stdio transport in your Teleport cluster. - Connect to the stdio MCP server via Teleport. diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx index 22978552dea..3691f6b93a3 100644 --- a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx +++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx @@ -10,10 +10,10 @@ tags: Teleport can provide secure access to MCP servers with streamable-HTTP transport. -This guides shows you how to: +This guide shows you how to: - Enroll a MCP server with streamable-HTTP transport in your Teleport cluster. -- Connect to the stdio MCP server via Teleport. +- Connect to the streamable-HTTP MCP server via Teleport. ## How it works diff --git a/docs/pages/enroll-resources/mcp-access/getting-started.mdx b/docs/pages/enroll-resources/mcp-access/getting-started.mdx index eb27b96e1dc..4602466b4bd 100644 --- a/docs/pages/enroll-resources/mcp-access/getting-started.mdx +++ b/docs/pages/enroll-resources/mcp-access/getting-started.mdx @@ -12,7 +12,7 @@ tags: Teleport can provide secure connections to your MCP (Model Context Protocol) servers while improving both access control and visibility. -This guides shows you how to: +This guide shows you how to: - Enroll the Teleport demo MCP server in your Teleport cluster. - Connect to the MCP server via Teleport. diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/aws-bedrock-gateway.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/aws-bedrock-gateway.mdx index ccd483f52c2..43e707e36d2 100644 --- a/docs/pages/enroll-resources/mcp-access/integration-guides/aws-bedrock-gateway.mdx +++ b/docs/pages/enroll-resources/mcp-access/integration-guides/aws-bedrock-gateway.mdx @@ -103,7 +103,7 @@ spec: Create the `app` resource with: ```code -$ tctl create -f app-bedrock-app.yaml +$ tctl create -f app-bedrock-mcp.yaml ``` diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx index b57359b7b1c..1ff04301e77 100644 --- a/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx +++ b/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx @@ -88,7 +88,7 @@ spec: (!docs/pages/includes/mcp-access/integration-tsh.mdx service="github" serviceName="GitHub" !) -![Grafana Claude](../../../../img/mcp-access/github-claude.png) +![GitHub Claude](../../../../img/mcp-access/github-claude.png) ## Connect to GitHub without service account diff --git a/docs/pages/enroll-resources/server-access/getting-started.mdx b/docs/pages/enroll-resources/server-access/getting-started.mdx index 621f7610278..f22706f6b0d 100644 --- a/docs/pages/enroll-resources/server-access/getting-started.mdx +++ b/docs/pages/enroll-resources/server-access/getting-started.mdx @@ -12,7 +12,7 @@ tags: You can protect a server with Teleport by running the Teleport SSH Service on the server and enrolling it in your Teleport cluster. -This guides shows you how to: +This guide shows you how to: - Enroll a server in your Teleport cluster. - SSH into a server using Teleport. diff --git a/docs/pages/enroll-resources/server-access/guides/auditd.mdx b/docs/pages/enroll-resources/server-access/guides/auditd.mdx index 97da1e682d6..483bb0d4a66 100644 --- a/docs/pages/enroll-resources/server-access/guides/auditd.mdx +++ b/docs/pages/enroll-resources/server-access/guides/auditd.mdx @@ -76,7 +76,7 @@ ssh_service: service_name: "sshd" ``` -PAM-generated events depend on your `sshd` configuration when the integration is enabled. Most system generates events +PAM-generated events depend on your `sshd` configuration when the integration is enabled. Most system generate events like `USER_ACCT` or `USER_START`. Additionally, TTY input can be logged by enabling the `pam_tty_audit.so` module. For more details please refer to [PAM](ssh-pam.mdx#set-up-pam-on-a-linux-machine-running-teleport) or your operating system diff --git a/docs/pages/identity-governance/access-monitoring.mdx b/docs/pages/identity-governance/access-monitoring.mdx index 4f06de297ff..4ad87b26c10 100644 --- a/docs/pages/identity-governance/access-monitoring.mdx +++ b/docs/pages/identity-governance/access-monitoring.mdx @@ -94,7 +94,7 @@ Below, you can find the IAM permissions that allow the Auth Service to execute A ], "Effect": "Allow", "Resource": [ - "arn:aws:s3::::audit-transient/results/*", + "arn:aws:s3:::audit-transient/results/*", "arn:aws:s3:::audit-long-term/report_results/*" ] }, diff --git a/docs/pages/identity-governance/access-requests/access-request-configuration.mdx b/docs/pages/identity-governance/access-requests/access-request-configuration.mdx index a53dcfaeeef..396c2592c0a 100644 --- a/docs/pages/identity-governance/access-requests/access-request-configuration.mdx +++ b/docs/pages/identity-governance/access-requests/access-request-configuration.mdx @@ -55,7 +55,7 @@ roles—by using the following configuration options: - `deny.request.claims_to_roles` Here is an example, which allows the `employee` user to request the `dev` and -`dba` role, and specifies some more complex restrictions that we will explain +`dba` roles, and specifies some more complex restrictions that we will explain below: ```yaml @@ -436,7 +436,7 @@ Each threshold includes the following fields: In the `devops` role above, there are two thresholds associated with the `dbadmin` role. As a result, one of the following conditions must obtain before -the request is approved is denied: +the request is approved or denied: 1. Three users must approve the request, and two users must deny it, as long as those users do not have a `team` trait with the value `dev`. @@ -764,7 +764,7 @@ func getMyAnnotation(req types.AccessRequest) ([]string, error) { This function uses the `GetSystemAnnotations` method of the `types.AccessRequest` type to get all the annotation values of an Access -Requests with the key `my-annotation`. +Request with the key `my-annotation`. ## Further reading diff --git a/docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx b/docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx index 9bfee73efa7..46a6e4b3d48 100644 --- a/docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx +++ b/docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx @@ -208,7 +208,7 @@ approve or deny the request: When the Datadog plugin sends a notification, anyone who receives the notification can follow the enclosed link to an Access Request URL. While users -must be authorized via their Teleport roles to review Access Request, you +must be authorized via their Teleport roles to review Access Requests, you should still check the Teleport audit log to ensure that the right users are reviewing the right requests. diff --git a/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx b/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx index 18ab0b65d4a..74a8ab2fea8 100644 --- a/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx +++ b/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx @@ -265,7 +265,7 @@ the spreadsheet ID, visit your spreadsheet in Google Drive. The ID will be in the URL path segment called `SPREADSHEET_ID` below: ```text -https://docs.google.com/spreadsheets/d/SPREADHSEET_ID/edit#gid=0 +https://docs.google.com/spreadsheets/d/SPREADSHEET_ID/edit#gid=0 ``` ### The `AccessRequestPlugin` type diff --git a/docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx b/docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx index afac3a4e4e0..8b224cc65a5 100644 --- a/docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx +++ b/docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx @@ -120,7 +120,7 @@ or in the schedules specified by `teleport.dev/notify-services` annotation in th When the Opsgenie plugin sends a notification, anyone who receives the notification can follow the enclosed link to an Access Request URL. While users -must be authorized via their Teleport roles to review Access Request, you +must be authorized via their Teleport roles to review Access Requests, you should still check the Teleport audit log to ensure that the right users are reviewing the right requests. diff --git a/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx b/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx index 9b1ed06e06a..4c83ba423c4 100644 --- a/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx +++ b/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx @@ -540,7 +540,7 @@ $ kubectl logs deploy/teleport-plugin-pagerduty ``` Debug logs can be enabled by setting `log.severity` to `DEBUG` in -`teleport-pagerduty-helm.yaml` and executing the `helm upgrade ...` command +`teleport-pagerduty-values.yaml` and executing the `helm upgrade ...` command above again. Then you can restart the plugin with the following command: ```code diff --git a/docs/pages/identity-governance/access-requests/plugins/servicenow.mdx b/docs/pages/identity-governance/access-requests/plugins/servicenow.mdx index b514a84cd18..7731d227586 100644 --- a/docs/pages/identity-governance/access-requests/plugins/servicenow.mdx +++ b/docs/pages/identity-governance/access-requests/plugins/servicenow.mdx @@ -29,7 +29,7 @@ ServiceNow. (!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!) -- An ServiceNow account with access to read and write to and from the 'incident' table. +- A ServiceNow account with access to read and write to and from the 'incident' table. - (!docs/pages/includes/tctl.mdx!) ## Step 1/4. Create services diff --git a/docs/pages/identity-governance/access-requests/role-requests.mdx b/docs/pages/identity-governance/access-requests/role-requests.mdx index 2109414b7fa..7caa890ee5a 100644 --- a/docs/pages/identity-governance/access-requests/role-requests.mdx +++ b/docs/pages/identity-governance/access-requests/role-requests.mdx @@ -183,7 +183,7 @@ iot:~ alice$ ``` Note that in order to make a Role Access Request this way, the role you request -access with must have `search_as_role` set so you can read the node you want to +access with must have `search_as_roles` set so you can read the node you want to ssh into. ```yaml diff --git a/docs/pages/identity-governance/idps/saml-guide.mdx b/docs/pages/identity-governance/idps/saml-guide.mdx index 702f7555532..615be5766d2 100644 --- a/docs/pages/identity-governance/idps/saml-guide.mdx +++ b/docs/pages/identity-governance/idps/saml-guide.mdx @@ -114,14 +114,14 @@ As a first step of the SAML Application setup wizard, the Teleport Web UI displa the Teleport SAML IdP metadata values. The process of SAML service provider configuration varies from service provider -to service provider. Some service provider may ask to provide Teleport SAML IdP's -entity ID, SSO URL and X.509 certificate explicitly. Other's may ask to upload +to service provider. Some service providers may ask to provide Teleport SAML IdP's +entity ID, SSO URL and X.509 certificate explicitly. Others may ask to upload the Teleport SAML IdP metadata (SAML entity descriptor) file . ![Teleport IdP metadata](../../../img/access-controls/saml-idp/step-2-copy-metadata.png) In the case of IAMShowcase app, which this guide is -based on, it is designed to grant access protected page for any well formatted +based on, it is designed to grant access to the protected page for any well formatted IdP federated SAML assertion data. As such, we will move to the next step in the setup wizard to add the IAMShowcase app to Teleport. diff --git a/docs/pages/identity-governance/idps/saml-idp-rbac.mdx b/docs/pages/identity-governance/idps/saml-idp-rbac.mdx index 64c6647d938..4b6c358f447 100644 --- a/docs/pages/identity-governance/idps/saml-idp-rbac.mdx +++ b/docs/pages/identity-governance/idps/saml-idp-rbac.mdx @@ -95,7 +95,7 @@ the SAML IdP service provider resource. In this case, the role needs to target `saml_idp_service_provider` resource with either `create,update,read,list,delete` or all of them as needed. -The role should also grants access to the `app_labels` that matches with the +The role should also grant access to the `app_labels` that matches with the resource label configured for the `saml_idp_service_provider` resource. `saml_idp_service_provider` resource access verb diff --git a/docs/pages/identity-governance/idps/usage/saml-grafana.mdx b/docs/pages/identity-governance/idps/usage/saml-grafana.mdx index 958a63d80b6..52a8497a7ab 100644 --- a/docs/pages/identity-governance/idps/usage/saml-grafana.mdx +++ b/docs/pages/identity-governance/idps/usage/saml-grafana.mdx @@ -57,7 +57,7 @@ Create it with `tctl`: ```code $ tctl create sp-manager.yaml -role 'saml-idp-service-provider-manager' has been created +role 'sp-manager' has been created ``` (!docs/pages/includes/create-role-using-web.mdx!) diff --git a/docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx b/docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx index f545b3b9a75..88e177926ce 100644 --- a/docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx +++ b/docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx @@ -26,10 +26,10 @@ Teleport. Authentication is based on the [interactive sign-in]( https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively) -process. User audit events in Azure are tagged on behalf of Teleport user account, +process. User audit events in Azure are tagged on behalf of the Teleport user account, providing better audit visibility. -Alternatively, you can also manage access to Azure API and CLI by deploying the +Alternatively, you can also manage access to the Azure API and CLI by deploying the [Teleport Application Service](../../../enroll-resources/application-access/cloud-apis/azure.mdx). This approach supports access based on [managed identity]( https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-managed-identity), @@ -100,7 +100,7 @@ You can locate **Microsoft Entra External ID** in Azure portal under Azure servi ![Add new SAML IdP in Microsoft Entra External ID](../../../../img/access-controls/saml-idp/ms-entra-external-id/entra-add-idp.png) -Note that while adding Teleport as an identity provider, you need to provide domain name +Note that while adding Teleport as an identity provider, you need to provide a domain name as explained in the Step 1 of this guide. Once you add Teleport as SAML IdP in Microsoft Entra External ID, you will need to copy the Entra ID `Tenant ID` from @@ -136,7 +136,7 @@ From the **Users** page, click `+ New User` button and select "Invite external u ![Invite External User](../../../../img/access-controls/saml-idp/ms-entra-external-id/entra-invite-user.png) -Enter the details for this user as needed to set up the account. You will notice that the a default value for +Enter the details for this user as needed to set up the account. You will notice that the default value for the "Invite redirect URL" field that points to `https://myapplications.microsoft.com/` is set for this user. This URL is where Microsoft will redirect the user after their first authentication. You can update this URL if you wish to redirect user to a different URL or keep it as it is. @@ -193,7 +193,7 @@ resource under the `teleport-dev-vm-pool` resource group with the privilege gran The Microsoft Entra External ID must be linked with an existing billing subscription. -This is required so the users can access and billed for Azure resources available under the linked subscription. +This is required so the users can access and be billed for Azure resources available under the linked subscription. ![Microsoft Entra External ID link subscription](../../../../img/access-controls/saml-idp/ms-entra-external-id/entra-link-subscription.png) @@ -258,7 +258,7 @@ Note that the rules of DNS update apply here as well. ### Issues related to identity provider configuration -Refer to official the [Microsoft Entra External ID SAML federation](https://learn.microsoft.com/en-us/entra/external-id/direct-federation) docs for general configuration. +Refer to the official the [Microsoft Entra External ID SAML federation](https://learn.microsoft.com/en-us/entra/external-id/direct-federation) docs for general configuration. ### Issues related to user invitation and user type conversion For issues related to user invitation, or internal to external user type conversion, refer to the [Microsoft Entra B2B collaboration](https://learn.microsoft.com/en-us/entra/external-id/troubleshoot) troubleshooting docs. diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx index a39713b1923..bce9f681dba 100644 --- a/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx +++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx @@ -9,7 +9,7 @@ enterprise: Identity Governance --- The Identity Center Integration can be configured to handle various advanced use -cases that are ot necessarily supported by the default installation flow. This +cases that are not necessarily supported by the default installation flow. This guide describes these advanced options and use cases. ## Disabling Account Assignment role creation diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx index 3586867e9d5..797b64769ef 100644 --- a/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx +++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx @@ -363,7 +363,7 @@ into a single Identity Center group containing all members reachable from the top-level Access List. The flattened Identity Center group will be kept updated as members are added to -or removed from nested +or removed from nested Access Lists. ### How does Teleport handle failures caused by transient network or load issues? diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx index 8c286aa9475..51a9ab67205 100644 --- a/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx +++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx @@ -14,7 +14,7 @@ This guide describes how to introduce Teleport into an existing Okta-managed AWS IAM Identity Center configuration. It specifically describes two scenarios: one where Teleport shares control of your Identity Center managed resources in conjunction with Okta, and another where Teleport replaces Okta as the Identity Center SSO -Provider and user provisioner +Provider and user provisioner. ## How it works @@ -49,7 +49,7 @@ Center groups and manage Group membership. We will start by setting up Teleport, Okta and Identity Center in a Partial hand-off configuration, covering -- integrating Okta and Teleport, ensuring that all users Okta users provisioned +- integrating Okta and Teleport, ensuring that all Okta users provisioned into Identity Center are also provisioned into Teleport, - configuring Teleport to manage groups and account assignments in Identity Center - setting up Teleport group import rules so that Identity Center groups managed @@ -392,7 +392,7 @@ restart the Identity Center integration in Full Hand-Off mode. Once Teleport has full control over provisioning into Identity Center, you can deactivate the Identity Center integration in Okta. Leaving the Okta Identity Center integration in place will cause Teleport and Okta to both try and control -the user information +the user information. ## Extending the integration diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx index 779cb56a54d..16faf92d569 100644 --- a/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx +++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx @@ -18,7 +18,7 @@ access granted via Teleport and AWS Identity Center. For a deep dive into how Teleport manages AWS Identity Center access works you can read the main [AWS IAM Identity Center guide](./aws-iam-identity-center.mdx). For the purposes of this guide, it's enough to understand that Teleport manages the creation -and deletion of AWS Account Assignments based on a users's Account Assignment grants, +and deletion of AWS Account Assignments based on a user's Account Assignment grants, either from their standing Teleport Roles, Access List membership or approved Access Requests. diff --git a/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx b/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx index 9503e351065..1708acbe243 100644 --- a/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx +++ b/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx @@ -55,7 +55,7 @@ Teleport Auth Service is running. The setup typically involves configuring a man for Teleport Auth Service and assigning that managed identity with the Microsoft Graph API permissions required by the Teleport Entra ID integration. -This method is best suited for an air-gapped Teleport clusters where the Teleport Proxy Service +This method is best suited for an air-gapped Teleport cluster where the Teleport Proxy Service is not publicly accessible. ### Choosing guided or manual Entra ID configuration method diff --git a/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx b/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx index f6b6cbfce28..a071b546387 100644 --- a/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx +++ b/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx @@ -36,14 +36,14 @@ Enter a name for your application and create the application. Open the newly created enterprise application. Under “Manage” menu select “Single sign-on”. In this configuration UI, you will need to set up Teleport -as an SAML servicer provider. +as an SAML service provider. Click edit button to configure “Basic SAML Configuration”. Enter the SAML assertion endpoint as Entity ID and ACS URL value. - **Entity ID and ACS URL:** SAML ACS endpoint of your Teleport cluster. E.g. `https://example.teleport.sh/v1/webapi/saml/acs/entra-id` -For “Attributes & Claims”, attributes with user will already be available for you but you will need to +For “Attributes & Claims”, attributes for the user will already be available for you but you will need to add a `groups` claim. ![Entra ID Integration](../../../../../img/igs/entraid/entra-sso-config.png) diff --git a/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx b/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx index c09a3ad54ba..b0013b274bd 100644 --- a/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx +++ b/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx @@ -56,7 +56,7 @@ $ az login --allow-no-subscriptions ## Step 2/3. Configure and apply -The example Terraform module provides Entra ID configuration options are based on the +The example Terraform module provides Entra ID configuration options that are based on the Microsoft Graph API authentication method you wish to configure for the Teleport Entra ID integration. Teleport supports two types of Microsoft Graph API authentication methods: @@ -179,7 +179,7 @@ $ terraform apply Once the changes are applied, the Terraform module will produce an application client ID and -Entra ID tenant ID values as an output. You will need these values in the next step. +the Entra ID tenant ID values as an output. You will need these values in the next step. Entra ID is now configured with the required attributes needed for the Teleport Entra ID integration. @@ -219,7 +219,7 @@ $ tctl plugins install entraid \ in Teleport based on the groups imported from the Entra ID. - `--no-access-graph` flag specifies Identity Security integration is to be skipped. - `--use-system-credentials` flag specifies to use system credential configured using Managed Identity. Use this flag only -if you with to set up system credential based authentication. +if you wish to set up system credential based authentication. - `--manual-setup` flag specifies a manual Entra ID configuration is selected by the user. `tctl` will then prompt for an Entra ID tenant ID and an application client ID of the enterprise diff --git a/docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx b/docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx index e810e7bc1e3..e7426770621 100644 --- a/docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx +++ b/docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx @@ -18,7 +18,7 @@ roles to go along with them. With the synchronization of Okta apps and groups as Teleport Access List feature in the Okta integration, this work is performed for you. This guide explains how to set up -Okta app and the sync. +the Okta app and group sync. ## How it works @@ -78,7 +78,7 @@ integration, ensure that: - (Optional) You have organized your Okta applications and groups into [Okta resource sets](https://help.okta.com/en-us/content/topics/security/custom-admin-role/create-resource-set.htm), - which allow you to limit the scope your Okta access token. + which allow you to limit the scope of your Okta access token. ## Step 1/2. Set default list owner(s) diff --git a/docs/pages/identity-governance/integrations/okta/guided-sso.mdx b/docs/pages/identity-governance/integrations/okta/guided-sso.mdx index 223b83fd430..10c266e9250 100644 --- a/docs/pages/identity-governance/integrations/okta/guided-sso.mdx +++ b/docs/pages/identity-governance/integrations/okta/guided-sso.mdx @@ -13,7 +13,7 @@ enterprise: Identity Governance {/* lint disable page-structure remark-lint */} The Teleport Okta SSO integration allows Teleport users to authenticate using -Okta as an identity provider. Teleport. The guided enrollment flow for the Okta +Okta as an identity provider. The guided enrollment flow for the Okta SSO integration is part of the [guided Okta integration](./okta.mdx). This guide is a companion to the guided Okta SSO integration, showing you how to perform required actions within Okta. @@ -69,7 +69,7 @@ Okta Integration Network support is still in beta. If unsure please proceed with 4. Give your app a name, e.g. "Teleport" and optionally upload a logo and click **Next**. -5. That will bring you to the "Configure SAML" step where you'll have to provide a several values: +5. That will bring you to the "Configure SAML" step where you'll have to provide several values: - Single sign on URL: @@ -152,7 +152,7 @@ The preferred way to assign a Teleport role to an Okta SSO user is by adding the ### SAML connector attributes to roles mapping -The alternative is to use SAML connector attributes to roles mapping. The mapping is defined in the SAML connector resource and can be edited either the web UI or `tctl`. +The alternative is to use SAML connector attributes to roles mapping. The mapping is defined in the SAML connector resource and can be edited either in the web UI or `tctl`. In the web UI: diff --git a/docs/pages/identity-governance/integrations/okta/user-sync.mdx b/docs/pages/identity-governance/integrations/okta/user-sync.mdx index d9370632144..6ec37065f83 100644 --- a/docs/pages/identity-governance/integrations/okta/user-sync.mdx +++ b/docs/pages/identity-governance/integrations/okta/user-sync.mdx @@ -98,7 +98,7 @@ resources. **Application** - - View application and their details + - View an application and its details - Edit application's user assignments 1. And finally click **Save role**. @@ -156,7 +156,7 @@ section. 4. Select the custom admin role and the resource set created earlier and click **Save changes**. -## Step 2/3.Configure the app to trust Teleport JWTs +## Step 2/3. Configure the app to trust Teleport JWTs To allow Teleport access to Okta, the Okta API Services app created in the previous step must be able to verify the JWT tokens issued by Teleport. In order diff --git a/docs/pages/identity-governance/integrations/scim/scim.mdx b/docs/pages/identity-governance/integrations/scim/scim.mdx index 28d3bed5dbe..7cc63a725c7 100644 --- a/docs/pages/identity-governance/integrations/scim/scim.mdx +++ b/docs/pages/identity-governance/integrations/scim/scim.mdx @@ -23,7 +23,7 @@ policies. ## How it works The SCIM integration uses a 1:1 mapping between SCIM group and Teleport -Access Lists +Access Lists: - Each SCIM group `displayName` must match the `spec.title` of a Teleport Access List. @@ -86,7 +86,7 @@ resource "teleport_access_list" "acl-group-requester" { -## Step 2/3. Configure SCIM Integration +## Step 2/3: Configure SCIM Integration Teleport provides a guided Web UI-based configuration flow for the SCIM integration. In the Teleport Web UI, go to **"Add new integration"** and select **SCIM**. @@ -108,7 +108,7 @@ Click **Continue** to proceed to the **SCIM Credentials** screen. - Copy the **Client ID**, **Client Secret**, and **Base URL** — you'll use them when configuring your Identity Provider in the next step. -## Step 3/3. Configure SCIM integration with your Identity Management SCIM provider +## Step 3/3: Configure SCIM integration with your Identity Management SCIM provider SCIM configuration may differ depending on your IdP. The integration has been officially tested with the following providers: diff --git a/docs/pages/identity-governance/locking.mdx b/docs/pages/identity-governance/locking.mdx index d29f4911fa9..78b10457e49 100644 --- a/docs/pages/identity-governance/locking.mdx +++ b/docs/pages/identity-governance/locking.mdx @@ -35,7 +35,7 @@ A lock can target the following objects or attributes: A lock is a dynamic Teleport resource stored on the Teleport Auth Service backend. Teleport services implement a lock watcher that subscribes to Auth Service events related to lock creation. When these services receive a -notification that the a lock has been created or modified, they enact safeguards +notification that a lock has been created or modified, they enact safeguards to prevent various operations, e.g., preventing access from a locked user. ## Prerequisites diff --git a/docs/pages/identity-security/access-graph/identity-activity-center.mdx b/docs/pages/identity-security/access-graph/identity-activity-center.mdx index a6455789ddb..9523f594f4d 100644 --- a/docs/pages/identity-security/access-graph/identity-activity-center.mdx +++ b/docs/pages/identity-security/access-graph/identity-activity-center.mdx @@ -118,7 +118,7 @@ for transient and long-term storage, and AWS Glue table and database. `policy.tf` includes the declaration of the AWS IAM policy that must be attached to the AWS identity that the Identity Security service runs as, -enabling it to access the resources and execute queries. If using an E2 instance +enabling it to access the resources and execute queries. If using an EC2 instance for Identity Security, attach the policy to the instance role. If using ECS or EKS, attach the policy to the task or pod role. diff --git a/docs/pages/identity-security/integrations/aws-sync.mdx b/docs/pages/identity-security/integrations/aws-sync.mdx index 9cd051d0ba5..48fa2c96b00 100644 --- a/docs/pages/identity-security/integrations/aws-sync.mdx +++ b/docs/pages/identity-security/integrations/aws-sync.mdx @@ -303,7 +303,7 @@ If Identity Activity Center is enabled, the following extra configurations are r integration: - : The ARN of the Amazon SQS queue subscribed to the SNS topic that receives CloudTrail notifications. -- : The arn of the Amazon S3 bucket where CloudTrail delivers its log files. +- : The ARN of the Amazon S3 bucket where CloudTrail delivers its log files. - : The ARN of the AWS KMS key used to encrypt messages in the SQS queue. - : The ARN of the AWS KMS key used to encrypt objects in the S3 bucket that stores CloudTrail logs. @@ -337,11 +337,11 @@ integration: "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey", - "kms:GenerateDataKeyWithoutPlaintext", + "kms:GenerateDataKeyWithoutPlaintext" ], "Resources": [ "", - "", + "" ] } ] diff --git a/docs/pages/identity-security/integrations/netiq.mdx b/docs/pages/identity-security/integrations/netiq.mdx index 0b4d96bb540..499aabb1e03 100644 --- a/docs/pages/identity-security/integrations/netiq.mdx +++ b/docs/pages/identity-security/integrations/netiq.mdx @@ -1,7 +1,7 @@ --- title: Discover NetIQ Access Patterns with Teleport Identity Security sidebar_label: NetIQ -description: Describes how to synchronize OpenTex NetIQ access patterns using Identity Security. +description: Describes how to synchronize OpenText NetIQ access patterns using Identity Security. tags: - how-to - identity-security @@ -56,7 +56,7 @@ to visualize access structures effectively. - A running Teleport Enterprise cluster v17.2.4 or later. - Identity Security enabled for your account. -- An OpenTex NetIQ instance with a user that has read access to the organization. +- An OpenText NetIQ instance with a user that has read access to the organization. - For self-hosted clusters: - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration. - A running Access Graph node v1.27.0 or later. diff --git a/docs/pages/identity-security/integrations/ssh-keys-scan.mdx b/docs/pages/identity-security/integrations/ssh-keys-scan.mdx index 835ee5cfccf..1c5b74d2a70 100644 --- a/docs/pages/identity-security/integrations/ssh-keys-scan.mdx +++ b/docs/pages/identity-security/integrations/ssh-keys-scan.mdx @@ -1,7 +1,7 @@ --- title: Discover Insecure SSH Access with Teleport Identity Security sidebar_label: SSH Keys -description: Describes how to enable SSH Key Scanning using Identity Security to identity access patterns that use long-lived SSH keys. +description: Describes how to enable SSH Key Scanning using Identity Security to identify access patterns that use long-lived SSH keys. tags: - how-to - identity-security @@ -42,7 +42,7 @@ Together with the key fingerprint, the Teleport-protected server also sends the By default, Teleport scans the `$HOME/.ssh/authorized_keys` and `$HOME/.ssh/authorized_keys2` files for authorized keys. Here, `$HOME` refers to the home directory of each user on the system, whether they are local or LDAP managed users. -### Importing User's SSH private keys +### Importing SSH private keys Teleport's `tsh` CLI tool can scan users' laptops for SSH private keys. It goes through the specified directories, defaulting to `/Users` on macOS, `/home` on Linux, and `C:\Users` on Windows, diff --git a/docs/pages/identity-security/session-summaries.mdx b/docs/pages/identity-security/session-summaries.mdx index 9f106f1770f..bd3d29c09b8 100644 --- a/docs/pages/identity-security/session-summaries.mdx +++ b/docs/pages/identity-security/session-summaries.mdx @@ -312,7 +312,7 @@ Replace with the ARN of the Amazon Bedrock model. If you're using an inference profile, the `Resource` field must instead specify -the inference profile ARN, as well as ARNS of *all* of the models that given +the inference profile ARN, as well as ARNs of *all* of the models that given inference profile may end up calling. These can be given either as an array of specific elements or using wildcards. For more details, see [the Amazon Bedrock documentation on prerequisites for using inference @@ -779,4 +779,4 @@ name="bedrock-inference-profile-arn"/> with the inference profile ARN: ```sh aws bedrock get-inference-profile --inference-profile-identifier="" -``` \ No newline at end of file +``` diff --git a/docs/pages/identity-security/usage/dashboard.mdx b/docs/pages/identity-security/usage/dashboard.mdx index d4764aca296..69c5ce0dc56 100644 --- a/docs/pages/identity-security/usage/dashboard.mdx +++ b/docs/pages/identity-security/usage/dashboard.mdx @@ -23,6 +23,6 @@ cloud provider and third-party solutions. To visit the standing privileges dashboard, navigate to **Identity Security** > **Dashboard**. -You can explore details about standing privileges can be clicking on a user or bot: +You can explore details about standing privileges clicking on a user or bot: ![Standing Privileges](../../../img/access-graph/standing-privileges.png) diff --git a/docs/pages/identity-security/usage/graph-explorer.mdx b/docs/pages/identity-security/usage/graph-explorer.mdx index 4e7de69e74b..31c3b628096 100644 --- a/docs/pages/identity-security/usage/graph-explorer.mdx +++ b/docs/pages/identity-security/usage/graph-explorer.mdx @@ -13,7 +13,7 @@ The Graph Explorer view in Teleport Access Graph reveals access patterns within your infrastructure. You can see which infrastructure resources different identities have access to, and which identities have access to a single resource. You can reveal identities with excessive permissions and resources -with unexpected sources of access, helping you protecting your infrastructure +with unexpected sources of access, helping you protect your infrastructure against identity-based attacks. The Graph Explorer displays access controls from multiple systems in a single diff --git a/docs/pages/identity-security/usage/investigate.mdx b/docs/pages/identity-security/usage/investigate.mdx index 4352ce18e92..e5c05612e4f 100644 --- a/docs/pages/identity-security/usage/investigate.mdx +++ b/docs/pages/identity-security/usage/investigate.mdx @@ -12,7 +12,7 @@ enterprise: Identity Security The Investigate dashboard provides an overview of recent identity activity across your infrastructure, helping you investigate security risks and incidents. You can see Teleport audit events related to identity, such as -certificate issuance and multi-factory authentication challenges, as well as +certificate issuance and multi-factor authentication challenges, as well as events from [integrations](../integrations/integrations.mdx) such as GitHub and AWS. Because Identity Activity Center visualizes events from multiple integrations at once, you can investigate identity-related incidents that diff --git a/docs/pages/includes/application-access/aws-database-access-cli.mdx b/docs/pages/includes/application-access/aws-database-access-cli.mdx index 3999653de4a..7220575a649 100644 --- a/docs/pages/includes/application-access/aws-database-access-cli.mdx +++ b/docs/pages/includes/application-access/aws-database-access-cli.mdx @@ -9,7 +9,7 @@ $ tsh aws s3 ls The `--aws-role` flag allows you to specify the AWS IAM role to assume when accessing the AWS API. You can either provide a role name like `--aws-role -ExampleTeleportDynamoDBRole` or a full role ARN like +{{ iam-role }}` or a full role ARN like `arn:aws:iam::123456789000:role/{{iam-role}}`. Now you can use the `tsh aws` command like the native `aws` command-line tool: diff --git a/docs/pages/includes/application-access/aws-database-start-app-service.mdx b/docs/pages/includes/application-access/aws-database-start-app-service.mdx index bcb989d171f..7197c83b4a3 100644 --- a/docs/pages/includes/application-access/aws-database-start-app-service.mdx +++ b/docs/pages/includes/application-access/aws-database-start-app-service.mdx @@ -49,7 +49,7 @@ app_service: enabled: true apps: - name: aws - uri: https://console.aws.amazon.com/home/home + uri: https://console.aws.amazon.com/console/home ``` (!docs/pages/includes/aws-credentials.mdx service="the Teleport Application Service"!) diff --git a/docs/pages/includes/database-access/tctl-auth-sign-3-files.mdx b/docs/pages/includes/database-access/tctl-auth-sign-3-files.mdx index a84fab0c7d9..bbc9d7a0440 100644 --- a/docs/pages/includes/database-access/tctl-auth-sign-3-files.mdx +++ b/docs/pages/includes/database-access/tctl-auth-sign-3-files.mdx @@ -19,7 +19,7 @@ the database, follow these instructions on your workstation: 1. To use `tctl` from your workstation, your Teleport user must be allowed to impersonate the system role `Db` in order to be able to generate the database - certificate. Include the following `allow` rule in in your Teleport user's + certificate. Include the following `allow` rule in your Teleport user's role: ```yaml diff --git a/docs/pages/includes/discovery/aws-db-discovery-config.mdx b/docs/pages/includes/discovery/aws-db-discovery-config.mdx index 343221c4930..930d1faafbd 100644 --- a/docs/pages/includes/discovery/aws-db-discovery-config.mdx +++ b/docs/pages/includes/discovery/aws-db-discovery-config.mdx @@ -18,7 +18,7 @@ spec: # 'elasticache' - discovers Amazon ElastiCache Redis and Valkey databases. # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases. # 'memorydb' - discovers Amazon MemoryDB databases. - # 'opensearch' - discovers Amazon OpenSearch Redis databases. + # 'opensearch' - discovers Amazon OpenSearch databases. # 'rds' - discovers Amazon RDS and Aurora databases. # 'rdsproxy' - discovers Amazon RDS Proxy databases. # 'redshift' - discovers Amazon Redshift databases. diff --git a/docs/pages/includes/discovery/discovery-config.yaml b/docs/pages/includes/discovery/discovery-config.yaml index e8e2ceb341b..1995a95c8a1 100644 --- a/docs/pages/includes/discovery/discovery-config.yaml +++ b/docs/pages/includes/discovery/discovery-config.yaml @@ -29,7 +29,7 @@ discovery_service: # 'elasticache' - Amazon ElastiCache Redis and Valkey databases. # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases. # 'memorydb' - Amazon MemoryDB databases. - # 'opensearch' - Amazon OpenSearch Redis databases. + # 'opensearch' - Amazon OpenSearch databases. # 'docdb' - Amazon DocumentDB databases. - types: ["ec2"] # AWS regions to search for resources from diff --git a/docs/pages/includes/mcp-access/configure-app-service.mdx b/docs/pages/includes/mcp-access/configure-app-service.mdx index 2d24da8c221..555b6786461 100644 --- a/docs/pages/includes/mcp-access/configure-app-service.mdx +++ b/docs/pages/includes/mcp-access/configure-app-service.mdx @@ -1,7 +1,7 @@ {{ extraAppScheme="" }} You can update an existing Application Service or create a new one to enable the -the MCP server. +MCP server. diff --git a/docs/pages/includes/mcp-access/integration-teleport-app.mdx b/docs/pages/includes/mcp-access/integration-teleport-app.mdx index 25fcd4000cf..e943da1eadc 100644 --- a/docs/pages/includes/mcp-access/integration-teleport-app.mdx +++ b/docs/pages/includes/mcp-access/integration-teleport-app.mdx @@ -37,7 +37,7 @@ spec: Create the `app` resource with: ```code -$ tctl create -f app-{{service}}-app.yaml +$ tctl create -f app-{{service}}-mcp.yaml ``` @@ -45,10 +45,10 @@ $ tctl create -f app-{{service}}-app.yaml Create a `teleport_app` resource in terraform. Replace with the host running the {{serviceName}} MCP server: ```hcl -resource "teleport_app" "grafana" { +resource "teleport_app" "{{ service }}" { version = "v3" metadata = { - name = "grafana" + name = "{{ service }}" labels = { "teleport.dev/origin" = "dynamic" "env" = "dev" diff --git a/docs/pages/includes/mcp-access/integration-tsh.mdx b/docs/pages/includes/mcp-access/integration-tsh.mdx index 74f4217c18a..c0f221ae075 100644 --- a/docs/pages/includes/mcp-access/integration-tsh.mdx +++ b/docs/pages/includes/mcp-access/integration-tsh.mdx @@ -6,5 +6,5 @@ $ tsh mcp config {{service}}-mcp --client-config claude ``` After configuring your MCP client, you will find {{serviceName}}-related tools from -`teleport-mcp-{{service}}-mcp`. You can now use these tools to interactive with +`teleport-mcp-{{service}}-mcp`. You can now use these tools to interact with {{serviceName}} via Teleport in your MCP clients: diff --git a/docs/pages/includes/provision-token/gitlab-spec.mdx b/docs/pages/includes/provision-token/gitlab-spec.mdx index 2ad5d6291fe..cdfd6a5f26a 100644 --- a/docs/pages/includes/provision-token/gitlab-spec.mdx +++ b/docs/pages/includes/provision-token/gitlab-spec.mdx @@ -57,7 +57,7 @@ spec: # - Use '?' to match any single character. namespace_path: my-user # pipeline_source restricts joins to jobs triggered by certain criteria, - # e.g triggered through the web interface. + # e.g. triggered through the web interface. pipeline_source: web # environment restricts joins to jobs that are associated with the # specified environment diff --git a/docs/pages/includes/provision-token/spacelift-spec.mdx b/docs/pages/includes/provision-token/spacelift-spec.mdx index a51f0efdf31..cf98d6f66de 100644 --- a/docs/pages/includes/provision-token/spacelift-spec.mdx +++ b/docs/pages/includes/provision-token/spacelift-spec.mdx @@ -27,7 +27,7 @@ spec: - space_id: root # caller_type is the type of caller_id. This must be `stack` or `module`. caller_type: stack - # caller_id is the id of the caller. e.g the name of the stack or module. + # caller_id is the id of the caller. e.g. the name of the stack or module. # # This field supports glob-style matching when the enable_glob_matching field is true: # - Use '*' to match zero or more characters. @@ -36,4 +36,4 @@ spec: # scope is the scope of the token - either `read` or `write`. # See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes scope: read -``` \ No newline at end of file +``` diff --git a/docs/pages/includes/provision-token/tpm-spec.mdx b/docs/pages/includes/provision-token/tpm-spec.mdx index b5df1ed6eec..bf7c80b230e 100644 --- a/docs/pages/includes/provision-token/tpm-spec.mdx +++ b/docs/pages/includes/provision-token/tpm-spec.mdx @@ -36,7 +36,7 @@ spec: allow: # description is a human-readable description of the rule. It has no # bearing on whether a TPM is allowed to join, but can be used to - # associate a rule with a specific host (e.g the asset tag of the server + # associate a rule with a specific host (e.g. the asset tag of the server # in which the TPM resides). - description: "example-build-server-100" # ek_public_hash is the SHA256 hash of the EKPub marshaled in PKIX format @@ -48,4 +48,4 @@ spec: # with colon separated nibbles. This value will not be checked when a TPM # does not have an EKCert configured. ek_certificate_serial: "01:23:45:67:89:ex:am:pl:e0:23:45:67:89:ab:cd:ef" -``` \ No newline at end of file +``` diff --git a/docs/pages/includes/role-spec.mdx b/docs/pages/includes/role-spec.mdx index db907a737d3..9caf2fa99bb 100644 --- a/docs/pages/includes/role-spec.mdx +++ b/docs/pages/includes/role-spec.mdx @@ -197,7 +197,7 @@ spec: kubernetes_labels: # A user can only access prod environments 'env': 'prod' - # User can access any region in us-west, e.g us-west-1, us-west-2 + # User can access any region in us-west, e.g. us-west-1, us-west-2 'region': 'us-west-*' # Regular expressions start with ^ and end with $. # Teleport uses Go's regular expression syntax: @@ -283,7 +283,7 @@ spec: app_labels: # A user can only access prod environments 'env': 'prod' - # User can access any region in us-west, e.g us-west-1, us-west-2 + # User can access any region in us-west, e.g. us-west-1, us-west-2 'region': 'us-west-*' # Regular expressions start with ^ and end with $. # Teleport uses Go's regular expression syntax: diff --git a/docs/pages/includes/server-access/azure-join-managed-identity.mdx b/docs/pages/includes/server-access/azure-join-managed-identity.mdx index 209ef1eb054..2714726ced2 100644 --- a/docs/pages/includes/server-access/azure-join-managed-identity.mdx +++ b/docs/pages/includes/server-access/azure-join-managed-identity.mdx @@ -193,7 +193,7 @@ $ DEPLOY_OUTPUT=$(az deployment group create \ --resource-group \ --template-file teleport-create-identity.json) $ PRINCIPAL_ID=$(echo $DEPLOY_OUTPUT | jq -r '.properties.outputs.principalID.value') -$ CLIENT_ID=$(echo $DEPLOY_OUTPUT | jq -r '.properties.outputs.principalID.value') +$ CLIENT_ID=$(echo $DEPLOY_OUTPUT | jq -r '.properties.outputs.clientID.value') $ ROLE_NAME=$(echo $DEPLOY_OUTPUT | jq -r '.properties.outputs.roleName.value') ``` diff --git a/docs/pages/includes/tpm-joining-background.mdx b/docs/pages/includes/tpm-joining-background.mdx index d9137b1bdab..67fb6336166 100644 --- a/docs/pages/includes/tpm-joining-background.mdx +++ b/docs/pages/includes/tpm-joining-background.mdx @@ -4,7 +4,7 @@ shared secret, the unique identity of the host's Trusted Platform Module (TPM) and public key cryptography is used to authenticate the host. In environments where there is no other form of identity available to machines, -e.g on-prem, this is the most secure method for joining. It avoids the need to +e.g. on-prem, this is the most secure method for joining. It avoids the need to distribute a shared secret as is needed for the `token` join method. A Trusted Platform Module (TPM) is a secure, physical cryptoprocessor that is diff --git a/docs/pages/machine-workload-identity/access-guides/applications.mdx b/docs/pages/machine-workload-identity/access-guides/applications.mdx index d9e1fe15f6c..c80080ac0ee 100644 --- a/docs/pages/machine-workload-identity/access-guides/applications.mdx +++ b/docs/pages/machine-workload-identity/access-guides/applications.mdx @@ -95,7 +95,7 @@ If you aren't sure which to use, we recommend starting with the To configure the `application-tunnel` service, first determine where you want the listener to bind to. As any client that can connect to the service listener will be able to access the application, it is recommended to bind to the -loopback interface (e.g `127.0.0.1`) as this will prevent access from other +loopback interface (e.g. `127.0.0.1`) as this will prevent access from other hosts. Modify your `tbot` configuration to add an `application-tunnel` service: diff --git a/docs/pages/machine-workload-identity/deployment/github-actions.mdx b/docs/pages/machine-workload-identity/deployment/github-actions.mdx index c1ca0132ac3..985d6b21ea4 100644 --- a/docs/pages/machine-workload-identity/deployment/github-actions.mdx +++ b/docs/pages/machine-workload-identity/deployment/github-actions.mdx @@ -385,7 +385,7 @@ Replace: The `auth-k8s` action sets the `KUBECONFIG` for future steps to the credentials it has fetched from Teleport. This means that most existing tooling for -Kubernetes (e.g `kubectl` and `helm`) can use your cluster with no additional +Kubernetes (e.g. `kubectl` and `helm`) can use your cluster with no additional configuration. Add, commit, and push this new workflow file to the default branch of your diff --git a/docs/pages/machine-workload-identity/faq.mdx b/docs/pages/machine-workload-identity/faq.mdx index 9839bb2b986..025afbbfbea 100644 --- a/docs/pages/machine-workload-identity/faq.mdx +++ b/docs/pages/machine-workload-identity/faq.mdx @@ -28,7 +28,7 @@ where a supported join method exists. These are: - Spacelift - Terraform Cloud -On CI/CD platforms where you control the runner environment (e.g self-hosted +On CI/CD platforms where you control the runner environment (e.g. self-hosted Jenkins runner), MWI can run as a daemon on the runner and the generated credentials can be mounted into the environment of your individual workflow runs. diff --git a/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx b/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx index 3b388c33f22..a8aa43d4c09 100644 --- a/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx +++ b/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx @@ -172,7 +172,7 @@ resource "aws_s3_bucket" "example" { 1. Browse to S3 1. Select "Create bucket" -1. Enter a meaningful, unique name for your bucket, e.g `workload-id-demo` +1. Enter a meaningful, unique name for your bucket, e.g. `workload-id-demo` 1. Leave other settings as default 1. Click "Create bucket". @@ -442,10 +442,10 @@ web_identity_token_file=/opt/workload-identity/jwt_svid Configure the following environment variables: -- `AWS_ROLE_ARN`: The ARN of the role you created earlier, e.g +- `AWS_ROLE_ARN`: The ARN of the role you created earlier, e.g. `arn:aws:iam::123456789012:role/workload-id-demo` - `AWS_WEB_IDENTITY_TOKEN_FILE`: The path to the JWT file that `tbot` is writing, - e.g `/opt/workload-identity/jwt_svid` + e.g. `/opt/workload-identity/jwt_svid` diff --git a/docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx b/docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx index a1bedef5972..c02bbf18744 100644 --- a/docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx +++ b/docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx @@ -166,7 +166,7 @@ Click "Next" to proceed to the "Add permissions" page. Now select the permissions you wish to grant to your workload on AWS. Click "Next" to proceed to the "Name, review, and create" page. Give your role -a descriptive name, e.g "my-workload-roles-anywhere". +a descriptive name, e.g. "my-workload-roles-anywhere". Click "Create role". @@ -177,7 +177,7 @@ Finally, you must create a Roles Anywhere profile. Navigate back to the "Roles Anywhere" section of the AWS IAM console and click "Create a profile". -Give your profile a descriptive name, e.g "my-workload". +Give your profile a descriptive name, e.g. "my-workload". Select the role you created in the previous step. diff --git a/docs/pages/machine-workload-identity/workload-identity/tsh.mdx b/docs/pages/machine-workload-identity/workload-identity/tsh.mdx index 6f746c4eac9..a1647d058c3 100644 --- a/docs/pages/machine-workload-identity/workload-identity/tsh.mdx +++ b/docs/pages/machine-workload-identity/workload-identity/tsh.mdx @@ -44,7 +44,7 @@ Additionally, flags can be used to further customize the SVID: | `flag` | Description | |--------------------|---------------------------------------------------------------------------------------------------------------------| -| `--credential-ttl` | Sets the Time To Live for the resulting X509 SVID. Specify duration using `s`, `m` and `h`, e.g `12h` for 12 hours. | +| `--credential-ttl` | Sets the Time To Live for the resulting X509 SVID. Specify duration using `s`, `m` and `h`, e.g. `12h` for 12 hours. | ### Using headless authentication to issue a SVID on a remote host diff --git a/docs/pages/reference/architecture/authorization.mdx b/docs/pages/reference/architecture/authorization.mdx index 2b365ea0aaf..a44ce39321d 100644 --- a/docs/pages/reference/architecture/authorization.mdx +++ b/docs/pages/reference/architecture/authorization.mdx @@ -134,7 +134,7 @@ spec: 'environment': '^test|staging$' kubernetes_labels: - # User can access any region in us-west, e.g us-west-1, us-west-2 + # User can access any region in us-west, e.g. us-west-1, us-west-2 'region': 'us-west-*' 'cluster_name': '^us.*\.example\.com$' ``` diff --git a/docs/pages/reference/cli/tctl.mdx b/docs/pages/reference/cli/tctl.mdx index fe5328e5efe..239341baea4 100644 --- a/docs/pages/reference/cli/tctl.mdx +++ b/docs/pages/reference/cli/tctl.mdx @@ -1687,7 +1687,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--annotations`|none|Resolution attributes \=\\[,...\]| -|`--assume-start-time`|none|Sets time roles can be assumed by requestor (RFC3339 e.g 2023-12-12T23:20:50.52Z)| +|`--assume-start-time`|none|Sets time roles can be assumed by requestor (RFC3339 e.g. 2023-12-12T23:20:50.52Z)| |`--delegator`|none|Optional delegating identity| |`--reason`|none|Optional reason message| |`--roles`|none|Override requested roles \\[,...\]| @@ -2376,7 +2376,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--expires-at`|none|Time that the revocation should expire, usually this should match the expiry time of the credential. This should be specified using RFC3339 e.g '2024-02-05T15:04:00Z'. If unspecified, the time 1 week from now is used.| +|`--expires-at`|none|Time that the revocation should expire, usually this should match the expiry time of the credential. This should be specified using RFC3339 e.g. '2024-02-05T15:04:00Z'. If unspecified, the time 1 week from now is used.| |`--reason`|none|Reason for revocation.| |`--serial`|none|Serial number of the certificate to revoke.| |`--type`|none|Type of credential to revoke (x509)| diff --git a/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx index 574ba8ed0ca..8252410db14 100644 --- a/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx +++ b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx @@ -42,7 +42,7 @@ spec: # The hint field allows a string to be passed to workloads along with a # credential issued for this identity. This can be used to help workloads # differentiate between multiple identities that they may have - # (e.g `internal` vs `external`). + # (e.g. `internal` vs `external`). # # Optional. Supports templating. hint: An example hint diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx index afd79731d5e..e2698a5d52b 100644 --- a/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx +++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx @@ -103,7 +103,7 @@ spec: - space_id: root # caller_type is the type of caller_id. This must be `stack` or `module`. caller_type: stack - # caller_id is the id of the caller. e.g the name of the stack or module. + # caller_id is the id of the caller. e.g. the name of the stack or module. caller_id: my-stack ``` diff --git a/docs/pages/zero-trust-access/management/security/restrict-privileges.mdx b/docs/pages/zero-trust-access/management/security/restrict-privileges.mdx index 72b1e904d35..ea8b9d165ec 100644 --- a/docs/pages/zero-trust-access/management/security/restrict-privileges.mdx +++ b/docs/pages/zero-trust-access/management/security/restrict-privileges.mdx @@ -30,7 +30,7 @@ To prevent changes to labels from granting elevated privileges, you should: - Review sources used to generate dynamic labels and restrict modifications to the command or the data sources used. - Follow the **principle of least privilege** in creating and assigning roles. - Don't give users permissive roles when more a restrictive role will do. For example, don't + Don't give users permissive roles when a more restrictive role will do. For example, don't assign users the preset `access` or `editor` role, which give them permission to access and edit all cluster resources. Instead, define roles with the minimum required permissions for each user and configure **Access Requests** or **Access Lists** to provide temporary elevated permissions. diff --git a/examples/resources/plugins/teleport-msteams-helm.yaml b/examples/resources/plugins/teleport-msteams-helm.yaml index 4f69fe22176..94b6a7b7ee0 100644 --- a/examples/resources/plugins/teleport-msteams-helm.yaml +++ b/examples/resources/plugins/teleport-msteams-helm.yaml @@ -1,4 +1,4 @@ -# Default values for slack. +# Default values for msteams. # This is a YAML-formatted file. # Declare variables to be passed into your templates.