Support for different S3 Buckets

[bearrito]

Unless, my reading of the documentation is incorrect, when using S3 as a storage back-end, we can only configure 1 S3 bucket. In particular, one bucket is used for Certs and Session Recordings.

It seems as if the configuration it self can do this, but isn't surfaced through the Official Teleport AMI. In particular, the integration points in https://github.com/gravitational/teleport/tree/master/assets/aws/files/bin

I'd like to be able to specify multiple buckets, mainly for IAM reasons. Is this feasible with the current design, without snowflaking and deviating from the official AMI, but am missing something?

[webvictim]

Teleport itself only supports the use of a single S3 bucket for one cluster as per the docs: https://goteleport.com/docs/setup/reference/backends/#s3

One way to achieve different buckets for different servers/clusters might be to use separate Teleport clusters with our trusted cluster functionality to link them together: https://goteleport.com/docs/setup/admin/trustedclusters/

[bearrito]

That's what I assumed.

Is it possible to add this as a feature request?

I think a number of things would be easier if the bucket for certs and session recordings were kept separate namely

• Different IAM Policies, in particular I could allow security engineers to access to session recordings
• Different Lifecycle rules could be applied to the bucket objects.

Edit: I'll note that is possible to handle most these questions by use specifying the resources in the IAM policies, as well as specifying object(s) in the lifecycle configuration, just think it would be easier to separate them.

[webvictim]

Added as #13492