mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-11 22:49:54 +00:00
Paul Gottschling
b19268b07b
* Add a Configuring Teleport docs section Make the how-to guides for managing Teleport resources with Infrastructure as Code tools more prominent by placing them in a Configuring Teleport section next to other foundational docs sections, e.g., Installation and Upgrading. Frame the task of managing Teleport with IaC as part of the broader task of configuring Teleport. To do so, move the introduction of the "Static and Dynamic Resources" page to a landing page for the new Configuration section. Move the remaining part of that page to the References section, since it's an advanced guide and more of a reference than a set of how-to instructions. This change also structures the Infrastructure as Code landing page into a Configure Teleport landing page by including links to guides for static as well as dynamic configuration. This adds clarity to the docs since users won't immediately know that Teleport exposes these two configuration variants. * Update internal links * Fix issues with the Configuring Teleport section - Update the static/dynamic field table to use the correct field name, `spec.mode`. - Change "Managing Resources" to "Resource Guides" for clarity, since all sections in Configuring Teleport would be about managing resources. - Reorder Configuration sidebar sections to move Resource Guides last and tctl before Terraform and Kubernetes.
50 lines
1.8 KiB
Plaintext
50 lines
1.8 KiB
Plaintext
---
|
|
title: Get Started with Role-Based Access Control
|
|
sidebar_label: Role-Based Access Control
|
|
sidebar_position: 1
|
|
description: Provides an introduction to the Teleport role-based access control system.
|
|
tags:
|
|
- privileged-access
|
|
- conceptual
|
|
- zero-trust
|
|
---
|
|
|
|
Teleport's role-based access control (RBAC) enables you to set fine-grained
|
|
policies for who can perform certain actions against specific resources. For
|
|
example, you can allow analytics team members to SSH into a MongoDB read
|
|
replica, but not the main database.
|
|
|
|
Teleport **roles** are [dynamic
|
|
resources](../../configuration/configuration.mdx) that allow or
|
|
deny access to infrastructure resources, as well as to Teleport API operations
|
|
like creating users or reviewing Access Requests.
|
|
|
|
## Role demo
|
|
|
|
You can follow the [Teleport Role Demo](role-demo.mdx) guide for a quick
|
|
illustration of how Teleport roles work.
|
|
|
|
## Labels
|
|
|
|
All infrastructure resources that are enrolled in your Teleport cluster have
|
|
**labels**, which are key-value pairs such as `env: dev`. When a user attempts to
|
|
connect to a resource, the Teleport Agent that proxies the resource checks the
|
|
user's Teleport roles to ensure that the user has the appropriate permissions
|
|
and, if not, denies the connection.
|
|
|
|
Read more about labels in [Add Labels to Resources](labels.mdx).
|
|
|
|
## Role templates
|
|
|
|
Teleport roles include a templating syntax that allows you to specify a user's
|
|
permissions based on data about the user, e.g., data from your organization's
|
|
identity provider or stored on the Teleport Auth Service backend.
|
|
|
|
Read more about [Teleport Role Templates](role-templates.mdx).
|
|
|
|
## Role reference
|
|
|
|
After getting familiar with the concepts we introduce in this section, you can
|
|
read the [Access Controls Reference](../../reference/access-controls/roles.mdx)
|
|
for descriptions of all fields you can configure in a Teleport role.
|