AWS OIDC: List Deployed Database Services HTTP API

[marcoandredinis]

This PR adds a new endpoint which returns the deployed database services.

Calling the ECS APIs requires a region, so we had to iterate over the following resources to collect the relevant regions:

• databases
• database services
• discovery configs

Demo:
curl --silent 'https://.../integrations/aws-oidc/teleportdev/listdeployeddatabaseservices' -XPOST ... | jq

{
  "services": [
    {
      "name": "database-service-vpc-47381f2f",
      "dashboardUrl": "https://eu-west-2.console.aws.amazon.com/ecs/v2/clusters/lenix_marcoandredinis_com-teleport/services/database-service-vpc-47381f2f",
      "validTeleportConfig": true,
      "matchingLabels": [
        {
          "name": "region",
          "value": "eu-west-2"
        },
        {
          "name": "vpc-id",
          "value": "vpc-47381f2f"
        },
        {
          "name": "account-id",
          "value": "278576220453"
        }
      ]
    }
  ]
}

[marcoandredinis]

@eriktate @zmb3 Can you please take a look when you get a chance?

[michellescripts]

Should this be GET?

[zmb3]

+1

[marcoandredinis]

We have been using POST for most of the integration actions, even when listing things.

teleport/lib/web/apiserver.go

Line 984 in 04bc1c9

h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/databases", h.WithClusterAuth(h.awsOIDCListDatabases))

teleport/lib/web/apiserver.go

Line 990 in 04bc1c9

h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/ec2", h.WithClusterAuth(h.awsOIDCListEC2))

teleport/lib/web/apiserver.go

Line 991 in 04bc1c9

h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/eksclusters", h.WithClusterAuth(h.awsOIDCListEKSClusters))

teleport/lib/web/apiserver.go

Lines 995 to 997 in 04bc1c9

	h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/securitygroups", h.WithClusterAuth(h.awsOIDCListSecurityGroups))
	h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/databasevpcs", h.WithClusterAuth(h.awsOIDCListDatabaseVPCs))
	h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/subnets", h.WithClusterAuth(h.awsOIDCListSubnets))

I see these endpoints as a way to execute some action in the Integration. So, something closer to a RPC over HTTP, in contrast with a more typical REST format.

[zmb3]

We have been using POST for most of the integration actions

Hmm, any background on why we decided to do this? Unless there's strong reason, sticking with established conventions is usually the preferred option.

[marcoandredinis]

I think it started like this because we wanted this RPC-like interface where we could register a single endpoint but then use url path variables to call the AWS OIDC gRPC methods directly.

Things evolved in a different manner, and at this point I would argue that following a more REST-y approach would be better (less surprises).

So, we either start converting them to use GETs where is makes sense or we keep it as is.
No strong opinion on which one to follow.

[GavinFrazar]

my 2c: keep the existing endpoints as-is for backward compatibility (unless you want to migrate them), but for this PR make the new list deployed db services endpoint GET

[marcoandredinis]

Switched to GET
cc @michellescripts

[zmb3]

+1

[GavinFrazar]

my 2c: keep the existing endpoints as-is for backward compatibility (unless you want to migrate them), but for this PR make the new list deployed db services endpoint GET

[marcoandredinis]

@zmb3 Can you please take another look?