Teleport can provide secure access to MongoDB Atlas via the Teleport Database Service. This allows for fine-grained access control through Teleport's RBAC.

In this guide, you will:

1. Configure your MongoDB Atlas database 상호 TLS 또는 AWS IAM 인증으로.
2. Add the database to your Teleport cluster.
3. Connect to the database via Teleport.

작동 방식#

Teleport Database Service는 상호 TLS 또는 AWS IAM을 사용하여 MongoDB Atlas와 통신합니다:

• 상호 TLS: MongoDB Atlas가 데이터베이스 클라이언트용 Teleport 인증 기관을 신뢰하도록 구성하고, Teleport가 MongoDB Atlas용 인증서에 서명하는 Let's Encrypt CA를 신뢰하도록 구성합니다. 사용자가 Teleport를 통해 MongoDB Atlas에 연결하면 Teleport Database Service는 인증서를 사용하여 인증하고 사용자 트래픽을 MongoDB Atlas로 전달합니다.
• AWS IAM: MongoDB 사용자가 "MONGODB-AWS" 인증 메커니즘을 사용하도록 구성하고, Teleport가 MongoDB Atlas용 인증서에 서명하는 Let's Encrypt CA를 신뢰하도록 구성합니다. 사용자가 Teleport를 통해 MongoDB Atlas에 연결하면 Teleport Database Service는 인증을 위해 연결된 IAM 역할을 맡아 사용자 트래픽을 MongoDB Atlas로 전달합니다.

사전 조건#

• A running Teleport cluster. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

• The tctl and tsh clients.

  Installing `tctl` and `tsh` clients

  1. Determine the version of your Teleport cluster. The tctl and tsh clients must be at most one major version behind your Teleport cluster version. Send a GET request to the Proxy Service at /v1/webapi/find and use a JSON query tool to obtain your cluster version. Replace with the web address of your Teleport Proxy Service:

     $ TELEPORT_DOMAIN=
     $ TELEPORT_VERSION="$(curl -s https://$TELEPORT_DOMAIN/v1/webapi/find | jq -r '.server_version')"
     

  2. Follow the instructions for your platform to install tctl and tsh clients:

• MongoDB Atlas 클러스터.
• Teleport Database Service를 실행할 호스트(예: Amazon EC2 인스턴스).

To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials.

For example, run the following command, assigning to the domain name of the Teleport Proxy Service in your cluster and to your Teleport username:

$ tsh login --proxy= --user=
$ tctl status
# Cluster  (=teleport.url=)
# Version  (=teleport.version=)
# CA pin   (=presets.ca_pin=)

If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

1/4단계. Teleport Database Service 설정#

The Database Service requires a valid join token to join your Teleport cluster. Run the following tctl command and save the token output in /tmp/token on the server that will run the Database Service:

$ tctl tokens add --type=db --format=text
(=presets.tokens.first=)

Teleport Database Service를 실행할 호스트에 Teleport를 설치합니다:

To install a Teleport Agent on your Linux server:

The recommended installation method is the cluster install script. It will select the correct version, edition, and installation mode for your cluster.

1. Assign to your Teleport cluster hostname and port, but not the scheme (https://).

2. Run your cluster's install script:

   $ curl "https:///scripts/install.sh" | sudo bash
   

다음으로 Database Service를 시작합니다.

$ sudo teleport db start \
  --token=/tmp/token \
  --auth-server= \
  --name=mongodb-atlas \
  --protocol=mongodb \
  --uri=mongodb+srv://cluster0.abcde.mongodb.net \
  --labels=env=dev

version: v3
teleport:
  auth_token: "/tmp/token"
  proxy_server: 


You can check the status of the Teleport Database Service with systemctl status teleport
and view its logs with journalctl -fu teleport.

자세한 내용은 전체 YAML 참조를 확인하세요.

$ --uri=mongodb+srv://cluster0.abcde.mongodb.net

$ tctl auth sign --format=mongodb --host=mongo --out=mongo

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:role/teleport-database-access",
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

$ tsh login --proxy=teleport.example.com --user=alice
$ tsh db ls
# Name          Description Labels
# ------------- ----------- --------
# mongodb-atlas             env=dev

$ tsh login --proxy=mytenant.teleport.sh --user=alice
$ tsh db ls
# Name          Description Labels
# ------------- ----------- --------
# mongodb-atlas             env=dev

$ tsh db connect --db-user=alice --db-name dev mongodb-atlas

$ tsh db connect --db-user=role/teleport-access --db-name dev mongodb-atlas

$ tsh db connect --db-user=arn:aws:iam::111111111111:role/teleport-access --db-name dev mongodb-atlas

# 특정 데이터베이스 인스턴스의 자격 증명 제거.
$ tsh db logout mongodb-atlas
# 모든 데이터베이스 인스턴스의 자격 증명 제거.
$ tsh db logout