RDS

Requirements

Name	Description
IAM Edit Permission	To attach RDS read and/or write permissions to the Teleskope IAM role
Database Admin User	To create a read and/or write database user for each RDS cluster you'd like us to scan
Network Access	Teleskope must be able to reach each instance endpoint on its database port. See Network Access for the public and private subnet paths.

1

Grant Teleskope AWS scopes

Grant the TeleskopeRole read permission

Teleskope requires read access to automatically discover all of your RDS clusters and instances.

Attach the AmazonRDSReadOnlyAccess permission to the TeleskopeRole identity you created.

RDS Read Only Terraform

resource "aws_iam_role_policy_attachment" "rds_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess"
}

Grant the TeleskopeRole Read and Write IAM Access to RDS (Optional)

Teleskope requires write access to perform remediation actions like tagging.

Attach the AmazonRDSFullAccess to the Teleskope role you created.

RDS Read/Write Terraform

resource "aws_iam_role_policy_attachment" "rds_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSFullAccess"
}

2

Create a Database User for Teleskope

For each RDS cluster you would like to scan using Teleskope, you will need to:

1. Create a database user for authentication with Username and Password, or IAM Auth.

2. Grant the user permission to read/write in the cluster

3

Confirm network access

Set up the network path that matches your deployment — see Network Access below.

4

Enroll the Cluster in the Teleskope UI

Network Access

The IAM role covers discovery only: Teleskope lists your clusters and instances through the AWS API. Crawling and scanning open a database connection to each instance endpoint, so Teleskope must be able to reach that endpoint on its database port. Which path applies depends on whether the instance is publicly accessible.

Publicly accessible instances

Allow inbound traffic on the database port from Teleskope's egress IP addresses in the instance's security group. Teleskope provides the full IP set.

Warning: Allowlist the entire IP set, not a single address. Individual egress IPs can change during infrastructure updates.

Instances in private subnets

A private endpoint is not reachable from outside your VPC. Choose one of the following paths.

VPC Peering

Teleskope connects to the instance endpoint directly over a VPC peering connection.

1. Provide Teleskope the VPC ID containing your RDS instances. Teleskope initiates a peering request from its VPC and shares its AWS account ID and VPC CIDR.

2. Accept the peering connection in your console (VPC → Peering connections).

3. In the route tables used by your RDS subnets, add a route to the Teleskope VPC CIDR via the peering connection.

4. In the instance's security group, allow inbound traffic on the database port from the Teleskope VPC CIDR.

Peering requires non-overlapping CIDRs between your VPC and Teleskope's. Teleskope confirms this before sending the request.

SSH Tunnel (Bastion)

Teleskope connects through a bastion host you operate in a public subnet.

1. Launch an EC2 instance in a public subnet to serve as the SSH tunnel bastion host.

2. Place the Teleskope-provided public key in ~/.ssh/authorized_keys on the bastion user:

   echo "<TELESKOPE_PUBLIC_KEY>" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

3. Allow inbound SSH (port 22) from Teleskope's egress IP addresses in the bastion's security group. Teleskope provides the IP set.

4. Assign an Elastic IP (EIP) to the bastion host.

5. Adjust route tables and security groups so the bastion can reach the RDS instances on their database ports.

6. Provide Teleskope with the bastion username and the bastion Elastic IP.