AWS console access

[r0mant]

Add support to Teleport for generating auto-sign-in AWS management console URLs using federation API.

This functionality is implemented as a part of app access currently where an AWS console is represented as an application. This is how a user would configure it in their configuration:

app_service:
  enabled: "yes"
  apps:
  - name: "awsconsole-1"
    uri: "https://console.aws.amazon.com/ec2/v2/home"
    labels:
      aws_account_id: 123
  - name: "awsconsole-2"
    uri: "https://console.aws.amazon.com/ec2/v2/home"
    labels:
      aws_account_id: 456

In their role definitions, users are able to specify which AWS roles a role can assume, in the form of AWS role resource ARNs:

spec:
  allow:
    app_labels:
      '*': '*'
    aws_role_arns:
    - arn:aws:iam::123:role/ec2-read-only
    - arn:aws:iam::456:role/ec2-full-access

The UI will display roles matching the account as long as the application configuration has aws_account_id label as shown above:

After clicking on the appropriate role to assume, Teleport app service will generate a federated login token and redirect the user to the console which will log them in automatically.

Note, a user interacts with AWS console directly - it is not proxied via Teleport like "normal" application access web apps since it would be pretty challenging (if not impossible) and very fragile to try and proxy all AWS console requests through Teleport. The federated session is marked with Teleport's user name so it can be easily queried in CloudWatch. In future, we will import CloudWatch events to Teleport's audit log.

The UX of this feature has been approved by @klizhentas. Docs PR: #7640.

Closes #7027.

[timothyb89]

Just a couple small questions

[russjones]

Bot.