Teleport Infrastructure Identity Platform

https://goteleport.com/docs
Admin
Teleport is an infrastructure identity platform that provides unified identity, zero trust access,...
Tokens:2,287,036
Snippets:16,064
Trust Score:9.4
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install and start Teleport systemd service (TAR archive)

Source: https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/aws-console

Create a systemd service configuration for Teleport, enable it, and start it when installed from a TAR archive. Check status with systemctl status teleport and logs with journalctl -fu teleport.

```bash
$ sudo teleport install systemd -o /etc/systemd/system/teleport.service
$ sudo systemctl enable teleport
$ sudo systemctl start teleport

```

--------------------------------

### Start Teleport service on Google Cloud (package manager)

Source: https://goteleport.com/docs/enroll-resources/auto-discovery/kubernetes/gke-discovery

Starts the Teleport service on Google Cloud when installed via a package manager.

```bash
$ sudo systemctl start teleport

```

--------------------------------

### Enable and start tbot service after install

Source: https://goteleport.com/docs/machine-workload-identity/deployment/aws

Reload systemd daemon, enable and start the tbot service.

```bash
$ sudo systemctl daemon-reload
$ sudo systemctl enable tbot --now

```

--------------------------------

### Download Teleport Windows Auth Setup program

Source: https://goteleport.com/docs/enroll-resources/desktop-access/getting-started

Downloads the Teleport Windows Auth Setup executable (version 18.11.3). Run this before installing the certificate.

```bash
$ curl.exe -fo teleport-windows-auth-setup-v18.11.3-amd64.exe https://cdn.teleport.dev/teleport-windows-auth-setup-v18.11.3-amd64.exe
```

--------------------------------

### Start Teleport Application Service with systemd (package manager)

Source: https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/aws-console

Enable and start the Teleport Application Service when installed via a package manager. Check status with systemctl status teleport and logs with journalctl -fu teleport.

```bash
$ sudo systemctl enable teleport
$ sudo systemctl start teleport

```

--------------------------------

### Clone and enter the minimal Access Request plugin example

Source: https://goteleport.com/docs/identity-governance/access-requests/plugins/how-to-build

Clones the Teleport repository at branch v18 and changes into the minimal Access Request plugin example directory. This is the starting point for the guide.

```bash
$ git clone https://github.com/gravitational/teleport -b branch/v18
$ cd teleport/examples/access-plugin-minimal
```

--------------------------------

### Example teleport_installer resource with custom script

Source: https://goteleport.com/docs/reference/infrastructure-as-code/terraform-provider/resources/installer

Defines a teleport_installer resource named 'example' with a custom script that downloads and runs the generic Teleport install script, then configures the Teleport agent. The script uses template placeholders like {{.PublicProxyAddr}} and {{.TeleportPackage}}.

```hcl
# Teleport Installer resource

resource "teleport_installer" "example" {
  version = "v1"
  metadata = {
    name        = "example"
    description = "Example Teleport Installer"
    labels = {
      example = "yes"
    }
  }

  spec = {
    # This "custom" script is actually the default installer script ($ tctl get installer/default-installer).
    # Edit it to customize the commands that the Teleport Discovery Service
    # configures virtual machines to run to install Teleport on startup.
    script = <<EOF
#!/usr/bin/env sh
set -eu


INSTALL_SCRIPT_URL="https://{{.PublicProxyAddr}}/scripts/install.sh"

echo "Offloading the installation part to the generic Teleport install script hosted at: $INSTALL_SCRIPT_URL"

TEMP_INSTALLER_SCRIPT="$(mktemp)"
curl -sSf "$INSTALL_SCRIPT_URL" -o "$TEMP_INSTALLER_SCRIPT"

chmod +x "$TEMP_INSTALLER_SCRIPT"

sudo -E "$TEMP_INSTALLER_SCRIPT" || (echo "The install script ($TEMP_INSTALLER_SCRIPT) returned a non-zero exit code" && exit 1)
rm "$TEMP_INSTALLER_SCRIPT"


echo "Configuring the Teleport agent"

set +x
TELEPORT_BINARY=/usr/local/bin/teleport
[ -z "$${TELEPORT_INSTALL_SUFFIX:-}" ] || TELEPORT_BINARY=/opt/teleport/$${TELEPORT_INSTALL_SUFFIX}/bin/teleport

sudo -E "$TELEPORT_BINARY" install autodiscover-node --public-proxy-addr={{.PublicProxyAddr}} --teleport-package={{.TeleportPackage}} --repo-channel={{.RepoChannel}} --auto-upgrade={{.AutomaticUpgrades}} --azure-client-id={{.AzureClientID}} $@
  }
}
EOF
  }
}

```

--------------------------------

### Install Entra ID plugin with tctl plugins install entraid

Source: https://goteleport.com/docs/identity-security/integrations/entra-id

Run this command to start the interactive Entra ID integration setup for air-gapped clusters. Requires tctl v16.4.7 or later and an existing Teleport user as the default Access List owner. Replace the example auth server address with your Teleport Auth Service address; for multiplex mode use the proxy address. Add --no-access-graph if your license does not include Identity Security.

```bash
$ tctl plugins install entraid \
    --default-owner=Access List Owner \
    --default-owner=someOtherOwner@teleport.sh  \
    --use-system-credentials \
    --auth-server example.teleport.sh:443
```

--------------------------------

### tbot start CLI example

Source: https://goteleport.com/docs/reference/machine-workload-identity/configuration

Sample CLI command from `tctl bots add ...` that generates the default configuration when no config file is provided.

```bash
$ tbot start \
   --destination-dir=./tbot-user \
   --token=00000000000000000000000000000000 \
   --ca-pin=sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678 \
   --proxy-server=example.teleport.sh:443
```

--------------------------------

### Start tbot with configuration file

Source: https://goteleport.com/docs/machine-workload-identity/workload-identity/getting-started

Starts tbot with the configuration file, assuming it is /etc/tbot.yaml.

```bash
$ sudo tbot start -c /etc/tbot.yaml

```

--------------------------------

### Install tctl and tsh clients on Mac, Windows, and Linux

Source: https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/azure

Downloads and installs the tctl and tsh clients on Mac, Windows, and Linux. The Mac example uses a .pkg installer, the Windows example uses a zip archive, and the Linux example extracts a tarball and runs the install script. Note that Homebrew is not supported for Teleport installation.

```bash
$ curl -O https://cdn.teleport.dev/teleport-${TELEPORT_VERSION?}.pkg
```

```powershell
$ curl.exe -O https://cdn.teleport.dev/teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip
Unzip the archive and move the `tctl` and `tsh` clients to your %PATH%
NOTE: Do not place the `tctl` and `tsh` clients in the System32 directory, as this can cause issues when using WinSCP.
Use %SystemRoot% (C:\Windows) or %USERPROFILE% (C:\Users\<username>) instead.
```

```bash
$ curl -O https://cdn.teleport.dev/teleport-v${TELEPORT_VERSION?}-linux-amd64-bin.tar.gz
$ tar -xzf teleport-v${TELEPORT_VERSION?}-linux-amd64-bin.tar.gz
$ cd teleport
$ sudo ./install
Teleport binaries have been copied to /usr/local/bin
```

--------------------------------

### Install NetIQ Sync plugin

Source: https://goteleport.com/docs/identity-security/integrations/netiq

Run this command to start the interactive wizard for configuring NetIQ Sync. The wizard will prompt for OSP and API addresses, OAuth client credentials, and IDM user credentials.

```bash
$ tctl plugins install netiq
```

--------------------------------

### Role Limiting MCP Tools

Source: https://goteleport.com/docs/enroll-resources/mcp-access/integration-guides/aws-bedrock-gateway

Optional role to limit which MCP tools the user can access by adjusting the mcp.tools list. The example uses a regex pattern to allow only tools starting with get, query, list, search, or find.

```yaml
kind: role
version: v8
metadata:
  name: bedrock-mcp-readonly
spec:
  allow:
    app_labels:
      'service': 'bedrock'
    mcp:
      # Adjust this list based on the MCP tools exposed by the gateway’s targets.
      tools:
      - ^(get|query|list|search|find)_.*$

```

--------------------------------

### Configure Teleport Terraform provider locally with tsh and tctl terraform env

Source: https://goteleport.com/docs/enroll-resources/auto-discovery/kubernetes/eks-discovery/eks-discovery-terraform

Local quick start: log in with tsh and run tctl terraform env in the same shell used for terraform commands. See the Local Demo guide for more detail on local setup.

```bash
$ tsh login
$ eval "$(tctl terraform env)"
```

--------------------------------

### tbot configuration file example (v2)

Source: https://goteleport.com/docs/reference/machine-workload-identity/configuration

Example tbot configuration file in the v2 schema, showing core settings and onboarding options.

```yaml
# version specifies the version of the configuration file in use. `v2` is the
# most recent and should be used for all new bots. The rest of this example
# is in the `v2` schema.
version: v2

# debug enables verbose logging to stderr. If unspecified, this defaults to
# false.
debug: true

# auth_server specifies the address of the Auth Service instance that `tbot` should connect
# to. You should prefer specifying `proxy_server` to specify the Proxy Service
# address.
auth_server: "teleport.example.com:3025"

# proxy_server specifies the address of the Teleport Proxy Service that `tbot` should
# connect to.
# It is recommended to use the address of your Teleport Proxy Service, or, if using
# Teleport Cloud, the address of your Teleport Cloud instance.
proxy_server: "teleport.example.com:443" # or "example.teleport.sh:443" for Teleport Cloud

# credential_ttl specifies how long certificates generated by `tbot` should
# live for. It should be a positive, numeric value with an `m` (for minutes) or
# `h` (for hours) suffix. By default, this value is `1h`.
# This has a maximum value of `24h`.
#
# It can be overridden for most outputs and services to give them a shorter TTL
# than `tbot`'s internal certificates.
credential_ttl: "1h"

# renewal_interval specifies how often `tbot` should aim to renew the
# outputs it has generated. It should be a positive, numeric value with an
# `m` (for minutes) or `h` (for hours) suffix. The default value is `20m`.
# This value must be lower than `credential_ttl`.
# This value is ignored when using `tbot` is running in one-shot mode.
#
# It can be overridden for most outputs and services to give them a shorter
# renewal interval than `tbot`'s internal certificates.
renewal_interval: "20m"

# oneshot configures `tbot` to exit immediately after generating the outputs.
# The default value is `false`. A value of `true` is useful in ephemeral environments, like
# CI/CD.
oneshot: false

# onboarding is a group of configuration options that control how `tbot` will
# authenticate with the Teleport cluster.
onboarding:
  # token specifies which join token, configured in the Teleport cluster,
  # should be used to join the Teleport cluster.
  #
  # This can also be an absolute path to a file containing the value you wish
  # to be used.
  # File path example:
  # token: /var/lib/teleport/tokenjoin
  token: "00000000000000000000000000000000"

  # join_method must be the join method associated with the specified token
  # above. This setting should match the value output when creating the bot using
  # `tctl`.
  #
  # Support values include:
  # - `token`
  # - `azure`
  # - `gcp`
  # - `circleci`
  # - `github`
  # - `gitlab`
  # - `iam`
  # - `ec2`
  # - `kubernetes`
  # - `spacelift`
  # - `tpm`
  # - `terraform_cloud`
  # - `generic_oidc`
  join_method: "token"

  # ca_pins are used to validate the identity of the Teleport Auth Service on
  # first connect. This should not be specified when using Teleport Cloud or
  # connecting through a Teleport Proxy.
  ca_pins:
    - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
    - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"

  # ca_path is used to specify where a CA file can be found that can be used to
  # validate the identity of the Teleport Auth Service on first connect.
  # This should not be specified when using Teleport Cloud or connecting through a
  # Teleport Proxy. The ca_pins option should be preferred over ca_path.
  ca_path: "/path/to/ca.pem"

  # gitlab holds configuration specific to the "gitlab" join method.
  gitlab:
    # token_env_var_name allows the environment variable that contains the
    # GitLab ID token to be specified. If unspecified, this defaults to
    # "TBOT_GITLAB_JWT".
    #
    # Overriding this is useful when you need to use `tbot` to authenticate to
    # multiple Teleport clusters from a single GitLab CI job.
    token_env_var_name: "MY_GITLAB_ID_TOKEN"
```

--------------------------------

### Start tbot with tbot.yaml

Source: https://goteleport.com/docs/reference/machine-workload-identity/bound-keypair/getting-started

Start the bot with the tbot.yaml configuration file.

```bash
$ tbot start -c tbot.yaml
```

--------------------------------

### Discovery Config Example Definition

Source: https://goteleport.com/docs/reference/infrastructure-as-code/teleport-resources/discovery-config

Example YAML definition of a discovery_config resource. It includes a discovery_group, AWS matchers for EC2, and optional EC2 install settings. The example shows how to configure AWS regions, tags, assume role, organization discovery, and installer parameters.

```yaml
kind: discovery_config
version: v1
metadata:
  name: my-discovery-config
spec:
  # discovery_group is used to group discovered resources into different
  # sets. This is required when you have multiple Teleport Discovery services
  # running. It prevents discovered services from colliding in Teleport when
  # managing discovered resources.
  # If two Discovery Services match the same resources, they must be in the
  # same discovery group.
  # If two Discovery Services match different resources, they must be in
  # different discovery groups.
  #
  # It is also used to watch DiscoveryConfig resources.
  # The Discovery Configs that have a matching discovery_group will be added to
  # this Discovery Service matchers.
  discovery_group: "disc-group"
  # Matchers for discovering AWS-hosted resources.
  aws:
    # AWS resource types to discover and register with your Teleport cluster.
    # Valid options are:
    # 'ec2' - Amazon EC2 instances.
    # 'eks' - Amazon EKS clusters.
    # 'rds' - Amazon RDS and Aurora databases.
    # 'rdsproxy' - Amazon RDS Proxy databases.
    # 'redshift' - Amazon Redshift databases.
    # 'redshift-serverless' - Amazon Redshift Serverless databases.
    # 'elasticache' - Amazon ElastiCache Redis and Valkey databases.
    # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases.
    # 'memorydb' - Amazon MemoryDB databases.
    # 'opensearch' - Amazon OpenSearch databases.
    # 'docdb' - Amazon DocumentDB databases.
  - types: ["ec2"]
    # AWS regions to search for resources from
    regions: ["us-east-1","us-west-1"]
    # Optional AWS resource tags to match when registering resources
    # Defaults to a wildcard selector that matches any resource: "*":"*"
    tags:
      "*": "*"
    # Optional AWS role that the Discovery Service will assume to discover
    # and register AWS-hosted databases and EKS clusters.
    assume_role:
      role_arn: "arn:aws:iam::123456789012:role/example-role-name"
      # AWS role name that the Discovery Service will assume to discover resources in other accounts
      # Only required when using discovering accounts under an organization.
      role_name: "example-role-name"
      # Optional AWS external ID that the Discovery Service will use to assume
      # a role in an external AWS account.
      external_id: "example-external-id"
    # Organization sections enables AWS organization account discovery.
    # Only applicable for EC2 discovery.
    organization:
      # Organization ID used for discovering accounts in the AWS organization.
      organization_id: "o-exampleorgid"
      # Filters for matching on AWS Organizational Units (OUs).
      organizational_units:
        # Include is a list of AWS Organizational Unit IDs and children OUs to include.
        # Accounts that belong to these OUs, and their children, will be included.
        # Only exact matches or wildcard (*) are supported.
        # Required.
        include_ous: ["*"]
        # Exclude is a list of AWS Organizational Unit IDs and children OUs to exclude.
        # Accounts that belong to these OUs, and their children, will be excluded, even if they were included.
        # Only exact matches are supported.
        # Optional. If empty, no OUs are excluded.
        exclude_ous: []
    # Optional section: install is used to provide parameters to the installer script.
    # Only applicable for EC2 discovery.
    install:
      # enroll_mode is used to identify the method used to enroll the ec2 instance into Teleport.
      # Only the value 1 is supported, which uses a script to install and enroll the instance into Teleport.
      # Only applicable for EC2 discovery.
      enroll_mode: 1
      # Whether to install teleport on the EC2 instance.
      # If false, it will enroll the EC2 instance as an agentless node.
      # When using agentless, change the script_name to "default-agentless-installer" or create a custom script.
      install_teleport: true
      # The token to use when joining the cluster
      join_token: "iam-join-token"
      # The method to use when joining the cluster
      join_method: "iam"
      # script_name is the name of the Teleport install script to use.
      # Optional, defaults to: "default-installer".
      script_name: "default-installer"
      # Optional: adds a suffix to teleport installation, allowing for multiple agent installations.
      # Requires managed updates to be enabled.
      # Supported characters are alphanumeric characters and `-`.
      suffix: "<suffix>"
      # Optional: when using managed updates, set the update group of the installation.
      # Supported characters are alphanumeric characters and `-`.
      update_group: "<update-group>"
```

--------------------------------

### Download and install Teleport Slack plugin from binary

Source: https://goteleport.com/docs/identity-governance/access-requests/plugins/slack-review

Download and install the Teleport Slack plugin from the Linux binary tarball, then verify the installation with the version command.

```bash
$ curl -L -O https://cdn.teleport.dev/teleport-access-slack-v18.11.3-linux-ARCH-bin.tar.gz
$ tar -xzf teleport-access-slack-v18.11.3-linux-ARCH-bin.tar.gz
$ cd teleport-access-slack
$ sudo ./install
```

```bash
$ teleport-slack version
teleport-slack v18.11.3 git:teleport-slack-v18.11.3-fffffffff go1.26.8
```

--------------------------------

### Automate Teleport Windows Auth Setup installation

Source: https://goteleport.com/docs/enroll-resources/desktop-access/getting-started

Installs the Teleport Windows Auth Setup program non-interactively from an administrative Command Prompt or PowerShell console. Requires the exported certificate file (teleport.cer).

```powershell
$ teleport-windows-auth-setup-v18.11.3-amd64.exe install --cert=teleport.cer -r
```

--------------------------------

### Start the plugin with teleport-slack start

Source: https://goteleport.com/docs/identity-governance/access-requests/plugins/slack

Starts the Teleport Slack plugin as an executable. The expected log output shows the plugin version and readiness.

```bash
$ teleport-slack start
```

```bash
$ teleport-slack start
INFO   Starting Teleport Access Slack Plugin 7.2.1: slack/app.go:80
INFO   Plugin is ready slack/app.go:101
```

--------------------------------

### Initialize Terraform working directory

Source: https://goteleport.com/docs/configuration/terraform-provider/local

Run terraform init to download the Teleport provider. The output shows the provider plugin being found and downloaded.

```bash
$ terraform init
Initializing the backend...

Initializing provider plugins...
- Finding terraform.releases.teleport.dev/gravitational/teleport versions matching ...

```

--------------------------------

### TMCP001I MCP Session Started

Source: https://goteleport.com/docs/reference/audit-events/mcp-sessions

Example audit event for a started MCP session with code TMCP001I. Contains session and user identifiers.

```json
{
  "code": "TMCP001I",
  "ei": 0,
  "event": "mcp.session.start",
  "namespace": "default",
  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
  "time": "2025-05-23T11:11:11.111Z",
  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
  "user": "ai-user",
  "app_name": "mcp-everything"
}
```

--------------------------------

### Install Teleport Clients (Linux)

Source: https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/azure-aks-workload-id

Download, extract, and install the Teleport Linux binaries.

```bash
$ curl -O https://cdn.teleport.dev/teleport-v${TELEPORT_VERSION?}-linux-amd64-bin.tar.gz
$ tar -xzf teleport-v${TELEPORT_VERSION?}-linux-amd64-bin.tar.gz
$ cd teleport
$ sudo ./install
```

--------------------------------

### Installer resource with templating options

Source: https://goteleport.com/docs/enroll-resources/auto-discovery/servers/azure-vm-discovery/azure-vm-discovery-management-group

Example `installer` resource that uses templating options. The `script` field can reference `{{ .PublicProxyAddr }}`, `{{ .MajorVersion }}`, and `{{ .RepoChannel }}`.

```yaml
kind: installer
metadata:
  name: default-installer
spec:
  script: |
    echo {{ .PublicProxyAddr }}
    echo Teleport-{{ .MajorVersion }}
    echo Repository Channel: {{ .RepoChannel }}
version: v1


```

--------------------------------

### Start Teleport Database Service (Self-Hosted)

Source: https://goteleport.com/docs/enroll-resources/database-access/reference/cli

Starts the Teleport Database Service for a self-hosted environment. Requires a token, auth server address, database name, protocol, and URI.

```bash
$ teleport db start \
    --token=/path/to/token \
    --auth-server=proxy.example.com:443 \
    --name=example \
    --protocol=postgres \
    --uri=postgres.example.com:5432
```

--------------------------------

### Enable and start teleport-discord service

Source: https://goteleport.com/docs/identity-governance/access-requests/plugins/discord

Enable and start the Teleport Discord plugin service after installing the unit file. Run these commands on a Linux host.

```bash
$ sudo systemctl enable teleport-discord
$ sudo systemctl start teleport-discord

```

--------------------------------

### teleport app start command syntax

Source: https://goteleport.com/docs/reference/cli/teleport

Starts the application proxy service. Use this command to launch the Teleport application proxy with the specified flags.

```bash
$ teleport app start [<flags>]
```

--------------------------------

### Port Range YAML Example

Source: https://goteleport.com/docs/reference/infrastructure-as-code/teleport-resources/app-server-v3

Example of a PortRange with a single port. The range starts with Port and ends with EndPort; for a single port, EndPort is 0.

```yaml
port: 1
end_port: 1

```

--------------------------------

### Start Slack plugin as executable

Source: https://goteleport.com/docs/identity-governance/access-requests/plugins/slack-review

Starts the Slack plugin as an executable, using the specified configuration file.

```bash
$ teleport-slack start --config teleport-slack.toml
```
Tokens:
Raw