Add ability to differentiate auto-discovered databases

[programmerq]

What would you like Teleport to do?

Currently, if multiple database agents are doing auto-discovery in different aws accounts, it is possible for a name collision to occur. It should be possible to configure the agent in a way to guarantee name uniqueness across the cluster.

What problem does this solve?

Say two AWS accounts are in use-- staging and prod. They are built to have as much dev/prod parity as possible. This means that the RDS databases in each account may even have the same names and tags.

While it is possible to override the database name for a given database by explicitly setting a teleport.dev/database-name aws tag on the database, it would be ideal to have the ability to have the teleport agent be able to differentiate the resources without relying on external tagging conventions.

Another scenario where a name/tag collision could happen is when restoring a database from one aws account to another. The restore target may not immediately have a unique teleport.dev/database-name tag until after the restore is complete.

To avoid this collision situation altogether, something like an opt-in name prefix, go template, or some other mechanism that can be set in the teleport.yaml file ahead of time would be fantastic.

Similar functionality for any cloud-discoverable resources would be ideal.

If a workaround exists, please include it.

Utilize the teleport.dev/database_name functionality (documented here and here) -- has drawbacks and doesn't totally solve the concern.

[dlettman]

We've also run into this issue with identically named RDS instances in different regions within the same AWS account. Region tags, at least, are different in this scenario, but the name collision still occurs.

[Jasstkn]

It would be nice to have more elegant solution via databases configuration in teleport agent.

[Jasstkn]

@programmerq jfyi, the correct label is teleport.dev/database_name with underscore not hyphen.

[TeleLos]

Added another customer c-mcl affected by the name collision when resources are deployed in different AWS regions.

[GavinFrazar]

This is resolved in the upcoming v14 release