Audited access to clusters and databases behind SSO
Context
My team runs several Kubernetes clusters and a few dozen Postgres databases, split between production and non-production. Engineers need hands-on access to them to debug and support production. Teleport is now the access layer in front of all of it, signed in through our company SSO.
Problem
Access was mostly granted through AWS account-level permissions. That is broad by nature, and it left real gaps in production: anyone with the account access could reach far more than they needed. Nothing recorded what someone did inside a session, so we couldn't answer who ran what. It was also hard to scope access to a person or a task. A compliance audit was coming, and it needed least-privilege access and session-level auditing. The replacement also had to be easy enough that people would use it instead of working around it.
What I did
I owned the Teleport agent and configuration for every cluster and database. I deployed an agent to each cluster, registered each database, and mapped SSO groups to roles, with production scoped more tightly than non-production. I also owned communication through the rollout. I told users what would change and when, and onboarded about a dozen engineers one by one over a month or two, as each was approved for a license. I fixed the rough edges they hit before the next person started.
Result
Every cluster and database is registered in Teleport, with sessions tied to a named person and recorded. I'm now moving production over so Teleport is the only way in, and that is what makes production fully audited. About a dozen engineers are onboarded. The access controls held up in the compliance audit we passed.