Detecting cloud tag changes on enrolled resources — alert, and optionally freeze access

[ytensor42]

We keep hearing the same shape of request from security teams that use cloud tags as the access boundary.

Teleport already imports AWS (and other cloud) tags as resource labels and matches them in RBAC. That is not the gap. The gap is the transition:

If a tag on a node or database is updated or removed in AWS, can Teleport notice, tell security, and keep everyone off that asset until someone reviews why the tag changed and lifts the block?

Today the answer is: access will eventually follow the new labels, and that is not the same as treating a tag mutation as an incident.

I am posting this as an Idea, not a feature request issue, to see who else has this problem and which slice would actually get used.

What works today

• RBAC on labels. node_labels / db_labels / app_labels can match imported tags. If you write the role so a sensitive asset must carry a given tag, losing that tag can drop new sessions. If you write a wide allow (*) and the restricting tag disappears, access can widen. Labels are the matcher, not an overlay on top of a default grant.
• Sync is polled, not EventBridge.
  • Teleport Agent on EC2: tags from instance metadata, aws/ prefix, refresh about every hour. Tags in instance metadata must be enabled. Non-Nitro instance types may need a restart for IMDS tag updates. Docs: EC2 tags as Teleport labels.
  • Discovery Service: default poll about every 5 minutes. AWS database tags are copied onto the Teleport database resource (raw tag key, not the aws/ prefix). Docs: auto-discovery labels.
• Open sessions are not killed by a label change. A lock can terminate sessions, but lock targets today are user, role, agent UUID, desktop, device, etc. — not “this database” or “everything with label X.”
• Audit is “resource updated,” not “this key changed from X to Y.” Discovered databases emit db.update (TDB04I) with the current label map. Access Monitoring Rules watch Access Requests, not resource-label changes.
• AWS already sees the mutation in near real time via CloudTrail (TagResource / UntagResource / …) → EventBridge. Teleport does not subscribe to that. You can already build “tag changed → notify / tctl lock” on the AWS side and use Teleport only as the enforcement plane.

What we are asking the room

Not “build a full incident-response product in Teleport.” Which of these would you actually deploy?

Slice	What it is	Why it might be enough
1. Structured audit event	e.g. resource.label_change with kind, name, key, old value, new value (or deleted). Event Handler / SIEM does the rest.	Closest existing issue: #18258. No new AWS permissions. Noisy if every automation retags.
2. Watched keys → action	Config: if Owner or sensitivity (or a list you set) changes, set a quarantine label and/or place a lock.	Needs an unlock path and will false-positive if the list is *.
3. Lock a resource, not only an identity	Lock this database / kube cluster / app (by name or label) until an admin deletes the lock.	Makes “quarantine this asset” possible without inventing a new workflow object.
4. Document the AWS-native pattern	CloudTrail → EventBridge → notify + tctl lock / label. Teleport stays the enforcement plane.	Fastest path; many orgs already have tag-change alerting in AWS.
5. Full workflow	Detect → notify security → freeze → ticket → explicit release → restore access.	Largest. Do not assume this is what people want.

Azure / GCP have the same shape if the answer is “Teleport should own this.” AWS-only is a valid first cut.

Questions

1. Do you use cloud tags as a security boundary for Teleport RBAC today (not just env=prod for UX)?
2. When a tag is removed, is your failure mode “people lose access” or “people gain access they should not have”?
3. Is Discovery’s ~5 minute / agent IMDS ~1 hour lag acceptable for this control, or do you need CloudTrail-speed?
4. If Teleport shipped slice 1 only, would you wire Event Handler / SIEM yourself? Or is the control useless without an automatic freeze?
5. Would you rather keep detection in AWS (slice 4) and only use Teleport to lock or relabel?

Please comment even if the answer is “we already do this in CloudTrail and do not want it in Teleport.” That is a useful signal.

Related issues

• #18258 — emit an audit event when resource labels change (slice 1).
• #15135 — fetch EC2 tags via AWS API instead of IMDS (different problem: Patch Group / invalid IMDS keys).
• #17102 — option to disable importing EC2/Azure tags.
• #17171 — lock a user out of a single resource (identity-centric; the ask above is resource-centric).