Right now users have to configure AWS CLI/console access by enabling it in the app service and assigning it necessary IAM permissions:

https://goteleport.com/docs/application-access/cloud-apis/aws-console/

We should see if we can use our AWS OIDC integration to enable AWS CLI/console access as well. Then, users will be able to configure this integration by setting up the AWS integration in the Discover flow and won't need to host an agent similar to hosted access plugins.

UI steps:

• select AWS Access tile
• pick/create integration
• Run script that adds inline policy to Integration's IAM Role
  • bash -c $(curl https://...../webapi/scripts/integrations/configure/aws-app-access-iam.sh?role=<IntegrationRoleName>)
• AppServer is created here, but not visible to the user
  • POST https://.../integrations/aws-oidc/:name/aws-app-access
• Set Up Access (using aws-arn-role traits)
  • User must be warned that only roles with Tag teleport.dev/integration: true are allowed to be used by the integration.
• Test Connection: user can select an AWS IAM role and connect to it, the same way we do when listing Resources/Applications.

Example of ApplicationServer

kind: app_server
metadata:
  name: <integration-name>-aws
spec:
  app:
    kind: app
    metadata:
      labels:
        teleport.dev/origin: integration_awsoidc
        teleport.dev/integration_name: <integration-name>
      name: <integration-name>-aws
    spec:
      cloud: AWS
      public_addr: <integration-name>-aws.<proxy-public-addr>
      uri: https://console.aws.amazon.com/
    version: v3
  host_id: <proxy's host_id>
  version: <proxy's teleport version>
version: v3

Example of Teleport Role:

kind: role
version: v5
metadata:
  name: aws-console-access
spec:
  allow:
    aws_role_arns:
    - arn:aws:iam::1234567890:role/ExamplePowerUser
    - arn:aws:iam::1234567890:role/ExampleReadOnlyAccess

Example of IAM Policy required in IdP's Role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AssumeTaggedRole",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {"iam:ResourceTag/teleport.dev/integration": "true"}
            }
        }
    ]
}