Discover Azure Access Patterns with Teleport Policy

Teleport Policy streamlines and centralizes access management across your entire infrastructure. You can view access relationships in seconds, viewing unified, up-to-date relationships and policies between all users, groups, and computing resources.

Teleport Policy with Access Graph offers insights into access patterns within your Azure subscription. By scanning users, groups, service principals, and role definitions, it provides a visual representation and aids in enhancing the permission model within your Azure environment. This functionality enables you to address queries such as:

• What resources are accessible to Azure users and roles?
• Which groups belong to other groups and how does that impact resource access?
• How broad or narrow is scoping across the subscription when assigning roles to users and groups?

Utilizing the Access Graph to analyze permissions within an Azure subscription necessitates the setup of the Access Graph service, a Discovery Service, and integration with your Azure subscription.

Access Graph is a feature of the Teleport Policy product available to Teleport Enterprise edition customers.

To verify that Access Graph is set up correctly for your cluster, sign in to the Teleport Web UI, click the Policy sidebar button, and then the Browse menu item. Identities, resources, etc. should be listed.

How it works

Access Graph discovers Azure access patterns, synchronizes various Azure resources, including users, groups, service principals, and role definitions. These resources are then visualized using the graph representation detailed in the Teleport Policy usage page.

The importing process involves two primary steps:

Polling Cloud APIs

The Teleport Discovery Service continuously scans the configured Azure subscriptions. At configurable intervals as low as 15 minutes, it retrieves the following resources from your Azure account:

• Users
• Groups
• Service Principals
• Role Definitions
• Role Assignments
• Virtual Machines

Once all the necessary resources are fetched, the Teleport Discovery Service pushes them to Access Graph, ensuring that it remains updated with the latest information from your Azure environment.

Importing resources

Teleport Policy’s Access Graph feature visualizes the resources retrieved from your Azure subscription.

Prerequisites

• A running Teleport Enterprise cluster v17.2.1 or later.
• Teleport Policy enabled for your account.
• For self-hosted clusters:
  • Ensure that an up-to-date license.pem is used in the Auth Service configuration.
  • A running Access Graph node v1.27.0 or later. Check the Teleport Policy page for details on how to set up Access Graph.
  • The node running the Access Graph service must be reachable from the Teleport Auth Service.

Step 1/2. Configure the Discovery Service (Self-hosted only)

warning

If you have a cloud-hosted Teleport Enterprise cluster, you can disregard this step, as cloud-hosted Teleport Enterprise already operates a properly configured Discovery Service within your cluster.

To activate the Teleport Discovery Service, add a top level discovery_service section to the teleport.yaml config file used by the Auth Service. This service monitors dynamic discovery_config resources that are set up with the discovery_group matching.

discovery-group.

discovery_service:
  enabled: true
  discovery_group: discovery-group

Notice that if you already operate a Discovery Service within your cluster, it's possible to reuse it as long as the following requirements are met:

• On step 2, you match the discovery_group with the existing Discovery Service's discovery_group.
• Access Graph service is reachable from the machine where Discovery Service runs.

Once the Auth Service is configured, add the following to the Discovery Service configuration file to enable it for fetching Azure resources:

discovery_service:
  access_graph:
    azure:
      - subscription_id: azure-subscription-id

The Discovery Service will now periodically fetch resources from your Azure subscription.

Step 2/2. Set up Access Graph Azure Sync

To configure the Teleport Discovery Service, the Azure managed identity running the Discovery Service within Azure must be given the right permissions to fetch Azure resources. Within the Azure Cloud Shell, download the Teleport binary in .tar.gz format and use it to run the integration command.

You'll need to specify the following in the commands/configuration below:

• teleport-version
• azure-subscription-id
• azure-principal-id
• azure-discovery-role

Download and extract the Teleport binary:

curl -L https://cdn.teleport.dev/teleport-vteleport-version-linux-amd64-bin.tar.gz | tar xz

Run the integration command:

./teleport integration configure access-graph azure --principal-id azure-principal-id --role-name azure-discovery-role --subscription-id azure-subscription-id