Teleport Terraform Templates

Terraform templates and reusable modules for demonstrating Teleport features on AWS. Designed for Solution Engineers running POCs, live demos, and prospect workshops.

Configuration: use export TF_VAR_* for inputs rather than committing terraform.tfvars files.

Layout

templates/teleport-terraform/
├── control-plane/    # control plane blueprints (EKS, roles, SSO, plugins)
├── data-plane/       # individual use case demos (one Teleport feature per template)
├── profiles/         # multi-use-case compositions for prospect archetypes
├── modules/          # shared building blocks (networking, nodes, databases, apps, desktop)
└── tools/            # validation, smoke tests, and OPA policy checks

data-plane vs. profiles:

• data-plane — demo a single Teleport feature. Each template creates its own VPC.
• profiles — demo multiple features for a specific prospect archetype. All use cases share one VPC, one terraform apply, one terraform destroy.

Quick Start (any template)

tsh login --proxy=myorg.teleport.sh
eval $(tctl terraform env)

export TF_VAR_proxy_address=myorg.teleport.sh
export TF_VAR_user=you@company.com
export TF_VAR_teleport_version=18.7.1

cd data-plane/server-access-ssh-getting-started   # or any template
terraform init && terraform apply

Templates

Control Plane

Data Plane

Profiles

See profiles/README.md for usage and demo flows.

Modules

Infrastructure

Database

Application

Machine ID

Discovery

Each module has its own README with variables, outputs, and usage examples.

Tools

Pre-commit Hooks

brew install pre-commit terraform-docs tflint
pip install checkov
pre-commit install
pre-commit run --all-files   # baseline check

GitHub Actions Deployment

Deploy a full profile without local Terraform setup — useful for spinning up a demo environment from anywhere.

One-time setup (run against your Teleport cluster):

# Create the CI bot with access to the Terraform provider
tctl bots add github-ci --roles=terraform-provider

# Create the GitHub join token (see docs/github-actions-setup.md for full YAML)
tctl create github-join-token.yaml

Required secrets (Settings → Secrets and variables → Actions):

Optional secrets:

Deploy: Actions → Deploy Teleport Demo → Run workflow → pick a profile and environment.

Destroy: Re-run the deploy workflow with the Destroy checkbox checked, or trigger Scheduled Demo Teardown manually to clean up all profiles at once.

Scheduled teardown: Runs every Monday at 08:00 UTC and destroys any profiles that still have resources running. Requires TF_STATE_BUCKET to locate the state files.

Note: workflows are only triggerable from the default branch (main).

Notes

• State is kept locally and gitignored. Each practitioner manages their own state.
• The application-access-aws-console template requires manage_account_a_roles=true on first deploy in a fresh account to create the IAM target roles. See that template's README for the shared-account ownership pattern.
• All templates tag resources with teleport.dev/creator, env, team, and ManagedBy=terraform for cost attribution and RBAC consistency.