Terraform module to provision Teleport related resources.

Starting from version 5.0.0, this module uses Terraform 0.12 syntax.

This module creates a script to configure and start the Teleport service on a server. It's useful on pre-built images, where everything is already setup on build-time but Teleport still needs to be configured with the actual node information, like private IP, node name and auth credentials. It uses envsubst to set the correct configuration into /etc/teleport.yaml, so the following environment variables need to be present in that file before running this script:

• $ADVERTISE_IP
• $AUTH_TOKEN
• $AUTH_SERVER
• $NODENAME

No providers.

No modules.

No resources.

The two cloudinit outputs can be used in the context of write files. Example:

write_files:
${teleport_config}
${teleport_service}

data "cloudinit_config" "api_cloudinit" {
  gzip          = true
  base64_encode = true

  # Configure teleport
  part {
    content_type = "text/cloud-config"
    content =<<EOF
#cloud-config

write_files:
${module.teleport_bootstrap_script.teleport_config_cloudinit}
${module.teleport_bootstrap_script.teleport_service_cloudinit}
EOF
  }

  # Start teleport
  part {
    content_type = "text/x-shellscript"
    content      = "${module.teleport_bootstrap_script.teleport_bootstrap_script}"
  }
}

module "teleport_bootstrap_script" {
  source      = "github.com/skyscrapers/terraform-teleport//teleport-bootstrap-script?ref=1.0.0"
  auth_server = "tools01.customer.skyscrape.rs:3025"
  auth_token  = "something_really_really_secret"
  function    = "api"
  environment = "${terraform.workspace}"
}

This module will deploy Teleport on an EC2 instance. The same server will run both auth and proxy. It'll also create an EIP and a Route53 record to be able to access Teleport. The server will use Letsencrypt to retrieve a valid certificate for the Teleport server. It'll use the DNS challenge with Route53 to validate the domain name, but in case the Route53 sub-zone is not completely setup during the first boot and Letsencrypt fails to generate a valid certificate, the server will keep retrying until it does, and in the meantime, Teleport will use a self-signed certificate for the Web UI and API.

These are the requirements to apply this module:

• Teleport pre-built in an AMI: to avoid relying on external sources during boot time, all dependencies have to be present in the AMI, and that includes Teleport and the CloudWatch logs agent. Skyscrapers publishes and maintains such an AMI, and can be found with the filter:
  • owner-id: "496014204152"
  • name: "ebs-teleport-*"
  • tag:project: "teleport"
• Route53 zone
• VPC and a subnet where to deploy the EC2 instance

No modules.

[
  "0.0.0.0/0"
]

[
  "0.0.0.0/0"
]

[
  "10.0.0.0/8"
]

[
  "0.0.0.0/0"
]

[
  "0.0.0.0/0"
]

module "teleport_ec2" {
  source                  = "github.com/skyscrapers/terraform-teleport//teleport-server?ref=8.0.0"
  project                    = "int"
  environment                = "tools"
  teleport_hostname          = "teleport"
  r53_zone                   = "tools.example.com"
  subnet_id                  = var.public_lb_subnets[0]
  key_name                   = mykey

  teleport_auth_tokens = sensitive(concat(
    ["node:${random_password.node_token.result}"],
    ["kube,app:${random_password.agent_token.result}"],
  ))

  providers = {
    aws         = aws
    aws.route53 = aws.route53
  }
}

Starting version 8.0.0 of the module, we introduced 2 breaking changes:

• Renamed teleport_subdomain variable to teleport_hostname
• Introduced the possibility to host the R53 zone in a different AWS account. If you want to keep the functionality as before, just point the aws.route53 provider alias to the main aws one.

module "teleport_ec2" {
  providers = {
    aws.route53 = aws
  }
}

This module will create the needed security group rules to allow a Teleport node to join a cluster. It requires the security groups of the three components (see "Available variables"), although both proxy and auth might run in the same server and have the same security group.

\

module "teleport_vault_sg_rules" {
  teleport_proxy_sg_id = "${data.terraform_remote_state.teleport.teleport_server_sg_id}"
  teleport_node_sg_id  = "${module.ha_vault.sg_id}"
  teleport_auth_sg_id  = "${data.terraform_remote_state.teleport.teleport_server_sg_id}"
}