integration configure commands prompt for changes

This applies to the following "teleport integration configure" subcommands:
* deployservice-iam
* eice-iam
* ec2-ssm-iam
* aws-app-access-iam
* eks-iam
* access-graph
* listdatabases-iam

These commands will now describe the actions they will take, the
resources that will be created/configured, and will by default prompt
the user to confirm the changes.

Confirmation prompt can be skipped by passing the new --confirm flag.

The confirmation prompt is enabled by default because the most common
case, if not the only case, where a user runs these commands is via an
opaque "bash -c $(curl ...)" script generated by a web UI enrollment
wizard.

lib/cloud/aws/ssm_documents.go

@@ -27,8 +27,12 @@ import (
 // EC2DiscoverySSMDocument receives the proxy address and returns an SSM Document.
 // This document downloads and runs a Teleport installer.
 // Requires the proxy endpoint URL, example: https://tenant.teleport.sh
-func EC2DiscoverySSMDocument(proxy string) string {
-	randString := uuid.NewString() // Secure random so the filename can not be guessed to avoid possible script injection
+func EC2DiscoverySSMDocument(proxy string, insecureSkipNameRandomization bool) string {
+	installTeleportPath := "/tmp/installTeleport.sh"
+	if !insecureSkipNameRandomization {
+		// Secure random so the filename can not be guessed to avoid possible script injection
+		installTeleportPath = fmt.Sprintf("/tmp/installTeleport-%s.sh", uuid.NewString())
+	}
 
 	return fmt.Sprintf(`
 schemaVersion: '2.2'
@@ -45,16 +49,16 @@ mainSteps:
   name: downloadContent
   inputs:
     sourceType: "HTTP"
-    destinationPath: "/tmp/installTeleport-%s.sh"
+    destinationPath: %q
     sourceInfo:
       url: "%s/webapi/scripts/installer/{{ scriptName }}"
 - action: aws:runShellScript
   name: runShellScript
   inputs:
     timeoutSeconds: '300'
     runCommand:
-      - /bin/sh /tmp/installTeleport-%s.sh "{{ token }}"
-`, randString, proxy, randString)
+      - /bin/sh %s "{{ token }}"
+`, installTeleportPath, proxy, installTeleportPath)
 }
 
 const EC2DiscoveryPolicyName = "TeleportEC2Discovery"

lib/cloud/provisioning/awsactions/create_document.go

@@ -0,0 +1,87 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsactions
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ssm"
+	ssmtypes "github.com/aws/aws-sdk-go-v2/service/ssm/types"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+	"github.com/gravitational/teleport/lib/integrations/awsoidc/tags"
+)
+
+// DocumentCreator can create an AWS SSM document.
+type DocumentCreator interface {
+	// CreateDocument creates an AWS SSM document.
+	CreateDocument(ctx context.Context, params *ssm.CreateDocumentInput, optFns ...func(*ssm.Options)) (*ssm.CreateDocumentOutput, error)
+}
+
+// CreateDocument wraps a [DocumentCreator] in a [provisioning.Action] that
+// creates an SSM document when invoked.
+func CreateDocument(
+	clt DocumentCreator,
+	name string,
+	content string,
+	docType ssmtypes.DocumentType,
+	docFormat ssmtypes.DocumentFormat,
+	tags tags.AWSTags,
+) (*provisioning.Action, error) {
+
+	input := &ssm.CreateDocumentInput{
+		Name:           aws.String(name),
+		DocumentType:   docType,
+		DocumentFormat: docFormat,
+		Content:        aws.String(content),
+		Tags:           tags.ToSSMTags(),
+	}
+	details, err := formatDetails(input)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config := provisioning.ActionConfig{
+		Name:    "CreateDocument",
+		Summary: fmt.Sprintf("Create an AWS Systems Manager (SSM) %s document %q", docType, name),
+		Details: details,
+		RunnerFn: func(ctx context.Context) error {
+			_, err = clt.CreateDocument(ctx, input)
+			if err != nil {
+				var docAlreadyExistsError *ssmtypes.DocumentAlreadyExists
+				if errors.As(err, &docAlreadyExistsError) {
+					slog.InfoContext(ctx, "SSM document already exists", "name", name)
+					return nil
+				}
+
+				return trace.Wrap(err)
+			}
+
+			slog.InfoContext(ctx, "SSM document created", "name", name)
+			return nil
+		},
+	}
+	action, err := provisioning.NewAction(config)
+	return action, trace.Wrap(err)
+}

lib/cloud/provisioning/awsactions/create_role.go

@@ -77,6 +77,7 @@ func CreateRole(
 	trustPolicy *awslib.PolicyDocument,
 	tags tags.AWSTags,
 ) (*provisioning.Action, error) {
+
 	trustPolicyJSON, err := trustPolicy.Marshal()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -89,7 +90,7 @@ func CreateRole(
 	}
 	type createRoleInput struct {
 		// AssumeRolePolicyDocument shadows the input's field of the same name
-		// to marshal the trust policy doc as unescpaed JSON.
+		// to marshal the trust policy doc as unescaped JSON.
 		AssumeRolePolicyDocument *awslib.PolicyDocument
 		*iam.CreateRoleInput
 	}

lib/cloud/provisioning/awsactions/put_role_policy.go

@@ -0,0 +1,96 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsactions
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/gravitational/trace"
+
+	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+)
+
+// RolePolicyPutter can upsert an IAM inline role policy.
+type RolePolicyPutter interface {
+	// PutRolePolicy creates or replaces a Policy by its name in a IAM Role.
+	PutRolePolicy(context.Context, *iam.PutRolePolicyInput, ...func(*iam.Options)) (*iam.PutRolePolicyOutput, error)
+}
+
+// PutRolePolicy wraps a [RolePolicyPutter] in a [provisioning.Action] that
+// upserts an inline IAM policy when invoked.
+func PutRolePolicy(
+	clt RolePolicyPutter,
+	policyName string,
+	roleName string,
+	policy *awslib.PolicyDocument,
+) (*provisioning.Action, error) {
+
+	policyJSON, err := policy.Marshal()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	input := &iam.PutRolePolicyInput{
+		PolicyName:     &policyName,
+		RoleName:       &roleName,
+		PolicyDocument: &policyJSON,
+	}
+	type putRolePolicyInput struct {
+		// PolicyDocument shadows the input's field of the same name
+		// to marshal the trust policy doc as unescaped JSON.
+		PolicyDocument *awslib.PolicyDocument
+		*iam.PutRolePolicyInput
+	}
+	details, err := formatDetails(putRolePolicyInput{
+		PolicyDocument:     policy,
+		PutRolePolicyInput: input,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config := provisioning.ActionConfig{
+		Name: "PutRolePolicy",
+		Summary: fmt.Sprintf("Attach an inline IAM policy named %q to IAM role %q",
+			policyName,
+			roleName,
+		),
+		Details: details,
+		RunnerFn: func(ctx context.Context) error {
+			_, err = clt.PutRolePolicy(ctx, input)
+			if err != nil {
+				if trace.IsNotFound(awslib.ConvertIAMv2Error(err)) {
+					return trace.NotFound("role %q not found.", roleName)
+				}
+				return trace.Wrap(err)
+			}
+
+			slog.InfoContext(ctx, "Added inline policy to IAM role",
+				"policy", policyName,
+				"role", roleName,
+			)
+			return nil
+		},
+	}
+	action, err := provisioning.NewAction(config)
+	return action, trace.Wrap(err)
+}

lib/config/configuration.go

@@ -278,6 +278,8 @@ type IntegrationConfAccessGraphAWSSync struct {
 	Role string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // IntegrationConfAzureOIDC contains the arguments of
@@ -311,6 +313,8 @@ type IntegrationConfDeployServiceIAM struct {
 	TaskRole string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // IntegrationConfEICEIAM contains the arguments of
@@ -322,6 +326,8 @@ type IntegrationConfEICEIAM struct {
 	Role string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // IntegrationConfAWSAppAccessIAM contains the arguments of
@@ -331,6 +337,8 @@ type IntegrationConfAWSAppAccessIAM struct {
 	RoleName string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // IntegrationConfEC2SSMIAM contains the arguments of
@@ -355,6 +363,8 @@ type IntegrationConfEC2SSMIAM struct {
 	IntegrationName string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // IntegrationConfEKSIAM contains the arguments of
@@ -366,6 +376,8 @@ type IntegrationConfEKSIAM struct {
 	Role string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // IntegrationConfAWSOIDCIdP contains the arguments of
@@ -393,6 +405,8 @@ type IntegrationConfListDatabasesIAM struct {
 	Role string
 	// AccountID is the AWS account ID.
 	AccountID string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
 }
 
 // ReadConfigFile reads /etc/teleport.yaml (or whatever is passed via --config flag)

lib/configurators/aws/aws.go

@@ -775,7 +775,7 @@ func buildSSMDocumentCreators(ssm map[string]ssmClient, targetCfg targetConfig,
 			ssmCreator := awsSSMDocumentCreator{
 				ssm:      ssm[region],
 				Name:     matcher.SSM.DocumentName,
-				Contents: awslib.EC2DiscoverySSMDocument(proxyAddr),
+				Contents: awslib.EC2DiscoverySSMDocument(proxyAddr, false),
 			}
 			creators = append(creators, &ssmCreator)
 		}

lib/configurators/aws/aws_test.go

@@ -1392,7 +1392,7 @@ func TestAWSDocumentConfigurator(t *testing.T) {
 			"eu-central-1": &ssmMock{
 				t: t,
 				expectedInput: &ssm.CreateDocumentInput{
-					Content:        aws.String(awslib.EC2DiscoverySSMDocument("https://proxy.example.org:443")),
+					Content:        aws.String(awslib.EC2DiscoverySSMDocument("https://proxy.example.org:443", false)),
 					DocumentType:   ssmtypes.DocumentTypeCommand,
 					DocumentFormat: ssmtypes.DocumentFormatYaml,
 					Name:           aws.String("document"),

lib/integrations/awsoidc/access_graph_aws_sync.go

@@ -20,14 +20,16 @@ package awsoidc
 
 import (
 	"context"
-	"log/slog"
+	"io"
 
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/gravitational/trace"
 
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+	"github.com/gravitational/teleport/lib/cloud/provisioning/awsactions"
 )
 
 const (
@@ -46,6 +48,12 @@ type AccessGraphAWSIAMConfigureRequest struct {
 
 	// AccountID is the AWS Account ID.
 	AccountID string
+
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
+
+	// stdout is used to override stdout output in tests.
+	stdout io.Writer
 }
 
 // CheckAndSetDefaults ensures the required fields are present.
@@ -100,28 +108,20 @@ func ConfigureAccessGraphSyncIAM(ctx context.Context, clt AccessGraphIAMConfigur
 		return trace.Wrap(err)
 	}
 
-	policyDocument, err := awslib.NewPolicyDocument(
+	policy := awslib.NewPolicyDocument(
 		awslib.StatementAccessGraphAWSSync(),
-	).Marshal()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	_, err = clt.PutRolePolicy(ctx, &iam.PutRolePolicyInput{
-		PolicyName:     &req.IntegrationRoleTAGPolicy,
-		RoleName:       &req.IntegrationRole,
-		PolicyDocument: &policyDocument,
-	})
+	)
+	putRolePolicy, err := awsactions.PutRolePolicy(clt, req.IntegrationRoleTAGPolicy, req.IntegrationRole, policy)
 	if err != nil {
-		if trace.IsNotFound(awslib.ConvertIAMv2Error(err)) {
-			return trace.NotFound("role %q not found.", req.IntegrationRole)
-		}
 		return trace.Wrap(err)
 	}
 
-	slog.InfoContext(ctx, "IntegrationRole: IAM Policy added to IAM Role",
-		"policy", req.IntegrationRoleTAGPolicy,
-		"role", req.IntegrationRole,
-	)
-	return nil
+	return trace.Wrap(provisioning.Run(ctx, provisioning.OperationConfig{
+		Name: "access-graph-aws-iam",
+		Actions: []provisioning.Action{
+			*putRolePolicy,
+		},
+		AutoConfirm: req.AutoConfirm,
+		Output:      req.stdout,
+	}))
 }