Project: Teleport (Provisioning / Security & Compliance)
File: 0072-ec2-tags.md

authors: Andrew Burke (andrew.burke@goteleport.com) state: implemented Teleport nodes running on cloud instances automatically add instance tags as labels. Supported cloud providers: EC2: Implemented in Teleport 9.3.4+ and 10.0.0+. See the for details. Azure: In progress. The current recommended method of requires Creating a custom script to fetch the tags Individually adding each tag as a dynamic label Using the AWS API gateway, where the cost scales with the number of nodes using it As of January 2022, . This will allow Teleport nodes to discover their own instance tags. Unlike the AWS API gateway, instance metadata requests are free and per-instance. Cloud tags will be supported everywhere that dynamic labels are currently supported (i.e. SSH, Kube, Apps, and Databases). Each agent will be assigned the same labels (so for instance, if a database agent has multiple databases, all of the databases will have the same labels from the cloud instance). When a Teleport process running an SSH or other service is started, check if it is running in a cloud instance. If it is, fetch all tags from the instance metadata service and add them as labels to Teleport, then start a service that periodically (every hour) that does the same. Updates will replace all labels from the previous iteration, so newly created or deleted tags will be reflected in Teleport. Cloud labels will use a namespace prefix in Teleport for namespacing (similar to `teleport.dev`). For example, if an EC2 instance has the tag `Name: my-instance`, Teleport will add the label `aws/Name: my-instance`. Ideally, the namespace will prevent collisions with static and command label names, but if there is a collision, cloud labels will not override static or command labels. In order to use this feature, instance tags in metadata must be enabled for the instance. Instance tags in metadata can be enabled/disabled when launching a new instance; they can also be toggled for an existing instance via `Actions > Instance settings > Allow tags in instance metadata` in the management console or with the `modify-instance-metadata-options` command in the AWS CLI. See the for more details. Note: Some instance types (specifically non-) . This will need to be mentioned in the documentation. Namespace prefix: `aws` AWS applies . Each instance can have at most 50 tags, so with one request to fetch all tag keys and up to 50 requests to fetch tag values, Teleport only needs to make at most 51 instance metadata requests per hour, which should not have throttling issues. Azure instance metadata (including tags) is always enabled and requires no additional setup from the user. Azure VMs do not require a restart for tag updates to apply. Namespace prefix: `azure` Azure . Unlike EC2, Azure instance metadata provides all tag key-value pairs at once, so Teleport only needs to make 1 request per hour. Azure instances can have at most 50 tags. When a Teleport process is created, it will check if it is running in a cloud instance. If it is, and the instance has the tag `TeleportHostname` with a nonempty value, the process will use that value as the node's hostname, overriding the hostname provided in the config.