Teleport의 AWS CLI 및 콘솔 지원을 사용하여 Amazon Athena에 대한 보안 접근을 설정할 수 있습니다.

이 가이드에서 다음을 수행하는 방법을 설명합니다:

• Teleport Application Service 설치.
• AWS CLI 및 콘솔 접근 설정.
• Athena 데이터베이스 연결.

사전 조건#

• AWS account with Athena databases.
• IAM permissions to create IAM roles.
• aws Command Line Interface (CLI) tool installed in PATH.
• A host, e.g., an EC2 instance, where you will run the Teleport Application Service.

(!docs/pages/includes/edition-prereqs-tabs.mdx!)

• (!docs/pages/includes/tctl.mdx!)

We will assume your Teleport cluster is accessible at teleport.example.com and *.teleport.example.com. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to mytenant.teleport.sh.)

1/5단계. Athena 접근을 위한 IAM 역할 생성#

Create an IAM role that provides access to your Athena resources. Teleport Application Service will assume this IAM role on behalf of the Teleport user that accesses these Athena resources.

There are several methods to create an IAM role:

2/5단계. Teleport IAM 역할 매핑 구성#

Give your Teleport users permissions to assume IAM roles in your Teleport cluster.

You can do this by creating a Teleport role with the aws_role_arns field listing the IAM role ARN created in the previous step. Create a file called ExampleTeleportAthenaRole.yaml with the following content:

$ cat > ExampleTeleportAthenaRole.yaml <
  

See Role Templates for
details.

Create the new role:
$ tctl create -f ExampleTeleportAthenaRole.yaml

(!docs/pages/includes/create-role-using-web.mdx!)
(!docs/pages/includes/add-role-to-user.mdx role="ExampleTeleportAthenaRole"!)

3/5단계. Teleport Application Service 설치#

Generate a token#
A join token is required to authorize a Teleport Application Service instance
to join the cluster. Generate a short-lived join token and save the output of
the command:
$ tctl tokens add \
    --type=app \
    --app-name=aws \
    --app-uri=https://console.aws.amazon.com/console/home

On the host where you will run the Teleport Application Service, copy the token
to a file called /tmp/token.

Install and start Teleport#
Install Teleport on the host where you will run the Teleport Application
Service. See our Installation page for options
besides Linux servers.
(!docs/pages/includes/install-linux.mdx!)
Edit the Teleport configuration file (/etc/teleport.yaml) to include the
following information, adjusting the value of proxy_server to specify the host
and port of your Teleport Proxy Service:
version: v3
teleport:
  join_params:
    token_name: "/tmp/token"
    method: token
  proxy_server: "teleport.example.com:443"
auth_service:
  enabled: false
proxy_service:
  enabled: false
ssh_service:
  enabled: false
app_service:
  enabled: true
  apps:
  - name: aws
    uri: https://console.aws.amazon.com/home/home

(!docs/pages/includes/aws-credentials.mdx service="the Teleport Application Service"!)
(!docs/pages/includes/start-teleport.mdx service="the Teleport Application Service"!)


4/5단계. Teleport에 역할 위임 권한 부여#

Next, attach the following policy to the IAM role or IAM user the Teleport
Application Service instance is using, which allows the Application Service to
assume the IAM roles:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "*"
    }
  ]
}



5/5단계. 연결#
Application Service가 시작되고 클러스터에 참여하면 Athena 데이터베이스에 연결을 시작할 수 있습니다.
AWS Management Console 사용#

Log in to the Teleport Web UI at https://teleport.example.com (replace with
your Proxy Service's public address).
Navigate to the Applications tab in your Teleport cluster's control panel and
click on the Launch button for the AWS application. This will bring up an IAM
role selector:

Click on the role {{ iam-role }} and you will get redirected to the AWS
Management Console, signed in with the selected role.
In the console's top-right corner, you should see that you're logged in through
federated login and the name of your assumed IAM role is
{{ iam-role }}/<teleport-username> where the session name is your Teleport username.

AWS CLI 사용#

Log into the previously configured AWS app on your desktop:
$ tsh apps login --aws-role {{ iam-role }} aws
Logged into AWS app aws. Example AWS CLI command:

$ tsh aws s3 ls

The --aws-role flag allows you to specify the AWS IAM role to assume when
accessing the AWS API. You can either provide a role name like --aws-role ExampleTeleportDynamoDBRole or a full role ARN like
arn:aws:iam::123456789000:role/{{iam-role}}.
Now you can use the tsh aws command like the native aws command-line tool:
$ {{ tsh-example }}

To log out of the aws application and remove credentials:
$ tsh apps logout aws


다른 Athena 애플리케이션 사용#
아직 이전에 구성된 AWS 앱에 로그인하지 않은 경우 먼저 로그인합니다:
$ tsh apps login --aws-role ExampleTeleportAthenaRole aws

ODBC 또는 JDBC 드라이버로 Athena에 연결합니다:
ODBC로 연결JDBC로 연결DBeaver로 연결

로컬 HTTPS 프록시를 시작합니다:
$ tsh proxy aws --port 8443 --format athena-odbc
Started AWS proxy on http://127.0.0.1:8443.

Set the following properties for the Athena ODBC data source:
[Teleport AWS Athena Access]
AuthenticationType = IAM Credentials
UID = (=aws.aws_access_key=)
PWD = (=aws.aws_secret_access_key=)
UseProxy = 1;
ProxyScheme = http;
ProxyHost = 127.0.0.1;
ProxyPort = 8443;
TrustedCerts = <local-ca-bundle-path>

Here is a sample connection string using the above credentials and proxy settings:
DRIVER=Simba Amazon Athena ODBC Connector;AuthenticationType=IAM Credentials;UID=(=aws.aws_access_key=);PWD=(=aws.aws_secret_access_key=);UseProxy=1;ProxyScheme=http;ProxyHost=127.0.0.1;ProxyPort=8443;TrustedCerts=<local-ca-bundle-path>;AWSRegion=<region>;Workgroup=<workgroup>

제공된 연결 문자열을 ODBC 드라이버가 있는 Athena 애플리케이션에 사용합니다.


로컬 HTTPS 프록시를 시작합니다:
$ tsh proxy aws --port 8443 --format athena-jdbc
Started AWS proxy on http://127.0.0.1:8443.

First, add the following certificate to your keystore:
<local-ca-bundle-path>

For example, to import the certificate using "keytool":
keytool -noprompt -importcert -alias teleport-aws -file <local-ca-bundle-path> -keystore <keystore>

Then, set the following properties in the JDBC connection URL:
User = (=aws.aws_access_key=)
Password = (=aws.aws_secret_access_key=)
ProxyHost = 127.0.0.1;
ProxyPort = 8443;

Here is a sample JDBC connection URL using the above credentials and proxy settings:
jdbc:awsathena://User=(=aws.aws_access_key=);Password=(=aws.aws_secret_access_key=);ProxyHost=127.0.0.1;ProxyPort=8443;AwsRegion=<region>;Workgroup=<workgroup>

출력된 지침을 따라 로컬 인증서를 Java Keystore에 추가합니다. 기본 Java Keystore는 일반적으로 다음 위치에 있습니다:
$ ls $(java -XshowSettings:properties -version 2>&1 | grep 'java.home' | awk '{print $3}')/lib/security/cacerts

그런 다음 JDBC 드라이버가 있는 Athena 애플리케이션에 제공된 JDBC 연결 URL을 사용합니다.


로컬 HTTPS 프록시를 시작합니다:
$ tsh proxy aws --port 8443 --format athena-jdbc
Started AWS proxy on http://127.0.0.1:8443.

First, add the following certificate to your keystore:
<local-ca-bundle-path>

For example, to import the certificate using "keytool":
keytool -noprompt -importcert -alias teleport-aws -file <local-ca-bundle-path> -keystore <keystore>

Then, set the following properties in the JDBC connection URL:
User = (=aws.aws_access_key=)
Password = (=aws.aws_secret_access_key=)
ProxyHost = 127.0.0.1;
ProxyPort = 8443;

Here is a sample JDBC connection URL using the above credentials and proxy settings:
jdbc:awsathena://User=(=aws.aws_access_key=);Password=(=aws.aws_secret_access_key=);ProxyHost=127.0.0.1;ProxyPort=8443;AwsRegion=<region>;Workgroup=<workgroup>

DBeaver는 기본 Java Keystore 대신 자체 Java Keystore를 사용합니다. 예를 들어 macOS의 경우 Keystore 위치는 /Applications/DBeaver.app/Contents/Eclipse/jre/Contents/Home/lib/security/cacerts입니다.
DBeaver에 CA 인증서 가져오기를 따라 DBeaver의 Keystore를 설정합니다. 그런 다음 위의 tsh proxy aws 명령에서 출력된 지침에 따라 Keystore에 로컬 인증서를 추가합니다.
DBeaver를 시작하고 "Athena" 연결을 추가합니다. tsh proxy aws 출력에서 사용자 이름(AWS 액세스 키)과 비밀번호(AWS 비밀 키)를 입력합니다:

그런 다음 "드라이버 속성"에서 ProxyHost와 ProxyPort 설정을 채웁니다:

"완료"를 클릭합니다. 이제 Athena 데이터베이스에 연결할 수 있습니다.


유용한 환경 변수
기본적으로 tsh proxy aws는 최상의 보안을 위해 로컬 통신용 임의 AWS 자격 증명을 생성하고 생성된 지침에 여러 플레이스홀더를 사용합니다. 다음 환경 변수를 설정하여 이 값들을 덮어쓸 수 있습니다:

TELEPORT_AWS_ACCESS_KEY_ID: 로컬 AWS 액세스 키를 설정합니다.
TELEPORT_AWS_SECRET_ACCESS_KEY: 로컬 AWS 비밀 키를 설정합니다.
TELEPORT_AWS_REGION: AWS 리전을 설정합니다.
TELEPORT_AWS_KEYSTORE: Java Keystore 경로를 설정합니다.
TELEPORT_AWS_WORKGROUP: Athena 워크그룹 이름을 설정합니다.


만료된 로컬 인증서
tsh proxy aws는 로컬 통신을 위한 로컬 인증 기관(CA)을 생성합니다. 새 tsh login 세션 후 로컬 CA가 만료될 수 있으며 새 CA가 생성됩니다. Keystore에서 별칭을 삭제하고 다시 추가하여 Java Keystore를 최신 상태로 유지하세요.

aws 애플리케이션에서 로그아웃하고 자격 증명을 제거하려면:
$ tsh apps logout aws

다음 단계#

Teleport를 사용한 AWS Management Console 및 API 접근에 대한 자세한 정보.
AWS 서비스 엔드포인트에 대해 자세히 알아보세요.