* session-search[31]: replace needs_further_review bool with enum reason filter
Replaces the optional bool needs_further_review filter on both
SearchSessionSummariesParams and SearchSessionSummariesRequest with
repeated NeedsReviewReason filter_needs_further_review_reasons, letting
callers narrow results to sessions flagged for specific reasons rather
than any-or-none. The access graph and public API protos are regenerated
accordingly, and the enterprise service layer is updated to forward the
new field.
tctl recordings search replaces --[no-]needs-review with --review-reason,
a Kingpin enum flag accepting individual reason names or all to match any
flagged session. The valid values live in reviewReasonNames, a single map
that drives both flag validation and proto enum conversion. A parity test
asserts that reviewReasonNames contains exactly one entry per
non-UNSPECIFIED NeedsReviewReason value, so adding a proto reason without
wiring it into the CLI fails the test.
* fix test
* update docs
Adds a `SearchMode` enum to session search protos, allowing clients to choose the search mode that best fits their keywords.
Some searches perform better with embeddings only, while others work better with strict keyword matching. This change lets clients opt into their preferred search method, while keeping hybrid search as the default.
Signed-off-by: Tiago Silva <[email protected]>
Adds two proto files that together define the session summary search
feature.
proto/accessgraph/v1/session_search.proto — internal, Auth->Access Graph
Used exclusively by the Auth server. Defines SessionRecordingService
with two RPCs:
- SearchSessionSummaries: a bidirectional streaming RPC the Auth
server uses to paginate through session summaries stored in the
Access Graph. The Auth server sends search_params on the first
message, receives batches of SessionSummary results each
terminated by a PageComplete, and sends FetchMore to advance pages.
Each SessionSummary includes session_end_event — the raw audit
event the Auth server evaluates against the requesting user's RBAC
permissions before deciding whether to forward the result to client.
- StoreSessionSummary: used by the summarizer pipeline to persist
session summaries and their vector embeddings to the Access Graph.
api/proto/teleport/sessionsearch/v1/session_search.proto — public, Client->Auth
Used by Teleport clients (tsh, web UI handler, etc.). Defines
SessionSearchService.SearchSessionSummaries as a unary-request /
server-streaming RPC. The Auth server implements this service: it
receives the client's filter criteria, fans out to the Access Graph
via the internal bidi stream above (handling all pagination
internally), filters each result using session_end_event, and streams
only the permitted SessionSummary results back. Clients see a single
continuous stream with no pagination mechanics exposed to them.
Signed-off-by: Tiago Silva <[email protected]>
* proto/prehog: Sync from cloud repo for access graph usage
Sync the `prehog.v1` proto package sfrom the cloud
repo to bring in the changes for access graph usage events.
* proto/accessgraph: Extend EventsStreamV2 response for usage events
Extend the EventsStreamV2 response to allow usage events to be sent back
to teleport.
The usage events that can be sent back are currently all defined in the
`prehog.v1alpha` protobuf package. As this does not have a `go_package`
statement, we need to add a `M` flag to the buf config for generating
the Go code. There is no canonical package for the generated code as the
protos live and are generated in two repos (cloud and teleport).
* proto: Regenerate proto/grpc code for access graph usage events
Regenerate the generated proto code to include the changes for access
graph usage events. This includes the following packages:
- `prehog.v1` (Go and Typescript)
- `accessgraph.v1alpha` (Go)
The contents of this commit were auto-generated with:
make grpc/host
* usagereporter: Add anonymizer for identity security events
Add types compatible with `Anonymizer` for the two identity security
events:
* `prehogv1a.IdentitySecurityGraphSizeEvent`
* `prehogv1a.IdentitySecurityAuditLogsIngestedEvent`
These events are directly transformed as they contain no anonymizable
data.
* usage: Aggregate access graph queries per user
Extend `aggregating.Reporter` to aggregate the number of access graph
queries per user so we can generate monthly user active reports of
access graph usage for self-hosted Teleport customers.
* aggregating: Rename some identitySecurity -> sessionSummary
Rename some variables and functions in the aggregating reporter to more
tightly scope the naming, using "sessionSummary" instead of
"identitySecurity". Another report is to be added named
"identitySecurity" as an aggregation of more general data about the
product.
The existing report defined in the proto -
`IdentitySecuritySummariesGeneratedReport` has been retained as that is
a larger change to make across repositories and with "Summaries" in the
name, is scoped enough to differentiate it from the upcoming report.
* aggregating: Aggregate identity security events into new report
Aggregate the `IdentitySecurityGraphSizeEvent` and
`IdentitySecurityAuditLogsIngestedEvent` events into the
`IdentitySecurityReport` aggregated report.
Aggregation for the graph size events is simply taking the last size of
each provider, as these are essentially guages reporting the size at a
point in time. Aggregation for the audit log events are an accumulation
by provider giving a total count over the report window.
Updates the RegisterRequest proto to support multiple Host CA certificates
by introducing a new host_ca_pems repeated field while maintaining backwards
compatibility by deprecating the existing host_ca_pem field. This enables
proper authentication during Host CA rotation and HSM scenarios where
multiple certificates may be active simultaneously.
Signed-off-by: Tiago Silva <[email protected]>
* proto/accessgraph: Add RPC for sending k8s audit logs to Access Graph
Add a `KubeAuditLogsStream()` rpc to the `AccessGraphService` for
streaming Kubernetes apiserver audit logs from the Teleport discovery
service to access graph. This is intended for EKS audit logs which are
made available via CloudWatch, but can accommodate other k8s services.
The audit log messages are represented as a `google.protobuf.Struct` so
as to not depend on the k8s.io .proto files, but also as k8s typically
uses protos internally only - the expectation is that we'll receive the
apiserver audit logs as json-encoded strings. This encode easily as a
`google.protobuf.Struct`.
* proto: Generate protos for accessgraph
Generate proto and grpc code for changes to accessgraph/v1alpha1:
make grpc/host
These changes add the `KubeAuditLogsStream()` rpc and associated types.
* access-graph: Add KMS resource protos
Add the `AWSKMSKeyV1` protobuf messages to support importing KMS key
into the access graph.
This new type is added to the `AWSResource` oneof.
The Go bindings were regenerated using `make grpc`.
* access-graph: Add AWS KMS key discovery to access graph
Implement AWS KMS keys discovery and ingest into access graph. The
fetcher discovers keys across all specified regions.
For each KMS key, the fetcher retrieves the following details:
* Key metadata, including ARN, creation date, and HSM cluster ID
* Resource tags
* Key aliases
* The key policy document
Add a mock KMS client to support comprehensive unit testing of the new
fetcher, covering various key configurations and error cases.
The new KMS key resource is integrated into the existing discovery framework,
including the merge, deduplication, and reconciliation steps.
The required IAM policy for access graph discovery is updated to include the
necessary `kms:` permissions.
Correct typo in the `GlueTableName` field name.
* Address review feedback
* Address second set of review feedback
* Regenerate go-bindings for proto
* Fix golden files with new AWS KMS actions
* [iac] add github organization name to proto
This PR adds the github organization name to GithubConfigV1 proto
message.
Signed-off-by: Tiago Silva <[email protected]>
* add github plugin type
* add secret plugin
---------
Signed-off-by: Tiago Silva <[email protected]>
* protos: Add protos for Identity Activity Center
Add new and extend protos for the new Identity Activity
Center feature in Access Graph. Identity centers around activities of user,
allows to easily correlate log items by identity target or type and proactively
provides alerts such as impossible travel.
* Fix according to review
Fix according to review comments.
This PR expands `NetIQResourceAssignmentRef` message to include the
`entitlements` to carry information about how a particular role/resource
is mapped into other IdPs.
Each entitlement contains information about name and specially the
`value` field where the information is carried.
Signed-off-by: Tiago Silva <[email protected]>
* Adding Azure integration gRPC messages and RPC methods
* Make derive
* Update proto/accessgraph/v1alpha/azure.proto
Co-authored-by: Tiago Silva <[email protected]>
* Update proto/accessgraph/v1alpha/azure.proto
Co-authored-by: Tiago Silva <[email protected]>
* Update proto/accessgraph/v1alpha/azure.proto
Co-authored-by: Tiago Silva <[email protected]>
* PR feedback
* More PR feedback and generating protobuf code
* Make derive
* Adding identities field to principals, condition to role assignments, and role name to role definitions
* Rebase conflicts
* Did not fully fetch from origin/master when rebasing
* Removing azure config field and keeping poll_interval as-is
* Correct from parent branch
* Apply suggestions from code review
Co-authored-by: Tiago Silva <[email protected]>
* PR feedback
* Adding doc comments to access graph proto
* Adding object type to principals
* Adding location to Azure virtual machines
* Update proto/accessgraph/v1alpha/access_graph_service.proto
Co-authored-by: Tiago Silva <[email protected]>
* Moving Azure Discovery protobuf config to the Azure Discovery PR
* Make grpc
---------
Co-authored-by: Tiago Silva <[email protected]>
Currently, if a AWS call fails due to a rate limited API or a network issue, Discovery service considers the underlying ret psources as deleted from AWS.
This causes several problems because those resources will be removed from access graph view.
This PR changes that behavior and ensures resources are reused on failures.
This PR extends the Access Graph resources to be able include the newly added `teleport.access_graph.v1.PrivateKey`,
`teleport.access_graph.v1.AuthorizedKey` and existing device trust information `teleport.devicetrust.v1.Device`.
Part of https://github.com/gravitational/access-graph/issues/637
Signed-off-by: Tiago Silva <[email protected]>
* Add "Access Graph Path Changed" event tracking
The update introduces support for access path changes. The necessary objects, events, and methods are adjusted accordingly. Icon representation for the new event in the Audit Event List is also added.
* Add affected_resource_type field
* Update audit event messages and add resource kind
Updated the description and formatting of audit events when an access graph path is changed. Additionally, the "affected_resource_kind" field was added to provide more information about the affected resource.
* fmt
* Update access path change message in audit events
The message text for changes to access paths in audit/audit events has been updated. This modification improves the clarity of the description for such events.
* Add access graph settings to Entra ID plugin
* Move Entra ID labels to OSS
* Add Entra resources and RPC to Access Graph proto
* Add azure-oidc integration to web.
Current code assumes that Integration is always either AwsOidc,
or an external audit storage integration
* Change app sso cache to a repeated field
* Add AWSSAMLProviderV1 to access graph proto
* Access Graph: sync AWS SAML Providers
* Parse SAML entity descriptor before sending to TAG
* Add protos for AWS OIDC providers
* Fetch AWS OIDC providers
* Fetch signing certificates for AWS SAML providers
* Deflake identity provider fetch test
The concrete implementation of IAM mock uses a map,
resulting in non-deterministic iteration order.
Sort the results before comparing to alleviate.
* Update lib/srv/discovery/fetchers/aws-sync/iam_test.go
Co-authored-by: Jakub Nyckowski <[email protected]>
---------
Co-authored-by: Jakub Nyckowski <[email protected]>
* Introduce Access Graph EventsStreamV2
A new GRPC method EventsStreamV2 is introduced. The new method allows returning responses from the Access Graph.
The new API is required by crown jewel implementation. The new API will be used to emit audit events from the access graph.
* Add new fields to Event protobuf for better tracking
Added two new fields, AffectedResourceName and AffectedResourceSource, to the Event protobuf. These additions allow for a more detailed and efficient tracking of changes and their sources, improving overall monitoring and event handling.
* Add AccessPathChanged event and update service file
A new proto file, events.proto, has been added to define the AccessPathChanged event, detailing changes in access paths. The access_graph_service.proto has been updated to use this new event instead of the legacy one. The relevant changes are also reflected in the generated Go file, access_graph_service.pb.go.
* Missing files
* Add Access Graph protobuf file
Added Access Graph proto file definitions. This GRPC service defines the schema Teleport will use to talk to Access Graph service.
* Regenerate proto
* Replace multiple sends command with a stream
* Move messages to separate proto files
Rename the service proto file to better describe its content.
* Address review comments
* Regenerate protos
* Add comment
Tiago Silva