{/* */} {/* */} {/* */} {/* */} {/* */} {/* */} If you're running InfluxDB (including the the managed Amazon Timestream for InfluxDB service) there's two large challenges that many production deployments will encounter: * **How do you mitigate the risks of issuing tokens to your InfluxDB clients?** * **How do you securely connect clients when they're not in the same network as the InfluxDB database?** When you've got hundreds or thousands of distributed clients using the same set of shared long-lived and overly permissive access credentials the last thing you need is a publicly accessible database. If any of those thousands of clients is compromised your system is entirely vulnerable. But secure credential distribution and scaling secure connectivity are both hard distributed systems problems! Don't fear, I'm going to show you an easy to setup solution that solves both of these problems for you at the same time! By the end of this guide you'll have: * The ability to connect InfluxDB clients to your _private_ Amazon Timestream for InfluxDB service, no matter where they're running — without the need to make InfluxDB accessible from the public internet, no setting up port forwarding or IP rules. * Automated, secure token management for InfluxDB that grants least-privilege unique access credentials to each client — no more sharing long-lived tokens among multiple clients. * Automatic time-based revocation, renewal, and rotation of client tokens. Introducing the Amazon InfluxDB Token Management with Ockam! ## Prerequisites Before getting started, ensure you have: - An AWS account with appropriate permissions - Docker and Docker Compose installed - AWS CLI configured - Basic familiarity with AWS services (VPC, EC2, CloudFormation) - Approximately 45 minutes of time for complete setup (less if you have Timestream for InfluxDB already provisioned) ## Amazon Timestream InfluxDB 💙 Ockam Amazon Timestream for InfluxDB offers a managed time-series database engine that empowers application developers and DevOps teams to run InfluxDB databases on AWS. It supports real-time time-series applications using open-source APIs and delivers single-digit millisecond query response times. ### The challenge of managing access at scale Managing credentials for thousands of discrete clients challenges organizations at scale. The operational burden of issuing unique credentials often leads companies to share a single credential across their client services and devices. This approach increases risk - any compromised client could expose secrets used by the entire fleet. When credentials leak, organizations must scramble to revoke and deploy new credentials across their entire infrastructure simultaneously. Industry best practices recommend regular credential auditing and rotation to reduce business risk. However, this continuous revocation and rotation creates ongoing operational complexity that grows with the client base. ### Securing your InfluxDB instance Ockam with Amazon Timestream for InfluxDB lets you keep your InfluxDB instance private. Using Ockam's secure channels, you can restrict access to authenticated and authorized Ockam nodes only. This provides: - **Reduced Attack Surface**: Keeping your InfluxDB instance off the public internet significantly limits potential attack vectors. - **Enhanced Security**: Ockam's secure channels encrypt data in transit and restrict access to authorized clients only. - **Simplified Network Configuration**: You eliminate the need for complex firewall rules or VPNs. Ockam's Automated token management solution works with any InfluxDB client out of the box. Organizations can define standardized policies for uniquely identifiable, least privilege, time-limited credentials. Each client requests its own credential and uses it wherever InfluxDB credentials apply. The time-limited design automatically revokes expired credentials, prompting clients to request new ones to maintain communication. This post shows you how to set up automated, secure token management for Amazon Timestream InfluxDB using Ockam in four steps: - Step 1: Create a private Amazon Timestream InfluxDB instance (15 minutes) - Step 2: Sign up for Ockam and create enrollment tickets (5 minutes) - Step 3: Set up an Ockam _outlet_ node with the lease manager alongside your private InfluxDB instance (15 minutes) - Step 4: Set up an Ockam _inlet_ node on your client device to request credentials and communicate with InfluxDB (10 minutes) ![Amazon Timestream InfluxDB token management with Ockam](/blog/amazon-influxdb-token-management/amazon-influxdb-token-management.png) ## Step 1: Create a private Amazon Timestream InfluxDB instance ![Amazon Timestream InfluxDB](/blog/amazon-influxdb-token-management/arch-influxdb.png) Let's create a private Amazon Timestream InfluxDB instance to demonstrate an end-to-end example of automated, secure token management using telegraf to send data to the database. If you already have a private InfluxDB instance, you can skip this section. ### Create InfluxDB instance using CloudFormation template For ease of use, we have prepared a CloudFormation template that deploys all the required infrastructure for you. This template simplifies the setup process by automating the creation of resources. Open our [Timestream for InfluxDB stack](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?stackName=InfluxDBStack&templateURL=https://ockam-awsmp-fulfillment-cf-templates.s3.us-east-1.amazonaws.com/blog-artifacts/influxdb.yaml) in a new tab, ensuring you launch it in the `us-east-1` region, and then follow the instructions. The CloudFormation template will create: - An InfluxDB instance on the provided VPC and subnets - A security group for InfluxDB that allows inbound traffic from the VPC CIDR block. - An EC2 instance in one of the subnets with the InfluxDB client downloaded to use in `/opt` directory. ### Create InfluxDB instance manually ### !!steps Deploy manually via AWS Console - Navigate to the AWS Console - Search for `influxdb` in the search field at the top - Select the matching result and visit the InfluxDB databases screen - Click `Create InfluxDB Database` Configure the following settings: - **Database credentials:** Enter the required details - **Instance configuration/Storage configuration/Availability settings:** Update as needed - **Connectivity configuration:** Choose a VPC, choose (private) subnets. - Choose a security group - Inbound rules: Custom TCP rule for port 8086 and source IP address range of your VPC or limit it to a subnet that will be used by the Ockam node - Outbound rules: All traffic to `0.0.0.0/0` - **Publicly accessible:** Select "Not publicly accessible" - **Database port:** Leave the default value of `8086` - **Parameter group:** Leave the default value - **Tags:** Add any tags you want to help with billing and resource management Click `Create InfluxDB Database` Note: Database creation takes approximately 15 minutes to complete. ![!tour Create a database](/blog/amazon-influxdb-token-management/influxdb-create.png) ### Create an All Access InfluxDB Token and Obtain Org ID If you used the Cloudformation template to create your InfluxDB instance, you will also have an ec2 machine `-ec2-instance` created that has the Influx CLI pre-installed so you can run the below. Connect to the machine using Session Manager and run `sudo su` to switch to the root user. Note: As part of InfluxDB creation, a secret will be created in AWS Secrets Manager (`READONLY-InfluxDB-auth-parameters-`). This secret will contain the bucket, password, organization name and username. #### !!steps Update the variables with your InfluxDB details. We'll export these values to environment variables to make it easier to copy & paste commands and have them work without modification. ```bash ! tour export INFLUXDB_ORG="YOUR_INFLUXDB_ORG_NAME" \ INFLUXDB_USERNAME="YOUR_INFLUXDB_USERNAME" \ INFLUXDB_PASSWORD="YOUR_INFLUXDB_PASSWORD" \ INFLUXDB_ENDPOINT="https://YOUR_INFLUXDB_ENDPOINT:8086" ``` #### !!steps Create a configuration. This will provide the Influx CLI with the information required to authenticate successfully for the commands that follow. ```bash ! tour influx config create --active --config-name testconfig \ --host-url $INFLUXDB_ENDPOINT \ --org $INFLUXDB_ORG \ --username-password "$INFLUXDB_USERNAME:$INFLUXDB_PASSWORD" ``` #### !!steps List the InfluxDB Orgs, if you've just setup a new instance there should only be a single org. The output will be in the format of: ```bash ID Name b5409d973e287b14 demo-org ``` Take note of the `Organization ID` (the `b5409d973e287b14` in this example) as we'll need it shortly. ```bash ! tour influx org list ``` #### !!steps Store the Organization ID in a variable so we can reference it easily in other commands. ```bash ! tour export INFLUXDB_ORG_ID=$( \ influx org list --json | jq -r '.[].id') ``` #### !!steps Create an all-access token. This token is what our lease manager will use to manage the creation and revocation of the tokens issued to the clients. ```bash ! rout influx auth create --all-access \ --description "All-access token for Ockam integration" \ --json export INFLUXDB_TOKEN=$(influx auth list --json \ | jq -r '.[] | select(.description == "All-access token for Ockam integration") | .token') ``` #### !!steps Store the InfluxDB token securely in AWS Secrets Manager. ```bash ! tour export SECRET_NAME="$INFLUXDB_ORG_ID-all-access-token" aws secretsmanager create-secret \ --name $SECRET_NAME \ --description "Ockam node InfluxDB lessor token" \ --secret-string "$INFLUXDB_TOKEN" ``` #### !!steps Now that the the lease manager's token is stored securely in AWS Secrets Manager, we'll need to provide the `ARN` reference to where it's stored in the setup of the lease manager. Take note of the `ARN` so we can provide it later when asked. ```bash ! tour aws secretsmanager describe-secret \ --secret-id $SECRET_NAME \ --query ARN --output text ``` ## Step 2: Sign up for Ockam and create enrollment tickets Enrollment tickets provision Ockam nodes. We'll create two enrollment tickets: 1. One for the Ockam _Outlet_ node that runs alongside the private InfluxDB instance containing the lease manager. 2. One for the Ockam _Inlet_ node that runs on your client devices to communicate with the Ockam Outlet node. ### !!steps Install Ockam Command Run the following command on your local workstation: ```bash ! tour curl --proto '=https' --tlsv1.2 -sSfL \ https://install.command.ockam.io \ | bash && source "$HOME/.ockam/env" ``` This will install the Ockam Command and source in the required environment settings. Skip this step if you've previously installed Ockam Command. ### !!steps Setup admin account Initialize your Ockam environment: ```bash ! tour ockam enroll ``` Wrapped up in this single `ockam enroll` command are several steps that will bootstrap your first project and get you ready to go. It will: * Generate an Ockam Identity and store its secret keys in a file system based Ockam Vault. * Create an account with Ockam Orchestrator. * Provision a trial Space and Project in the Orchestrator. * Make your Ockam Identity the administrator of your new Project. ### !!steps Generate enrollment ticket for Ockam Outlet node We need to generate the first enrollment ticket to allow a new Ockam Outlet Node to join our Ockam Project. This node will run alongside the private InfluxDB instance. ```bash ! tour ockam project ticket \ --usage-count 1 --expires-in 24h \ --attribute amazon-influxdb-outlet \ --relay influxdb \ > outlet.ticket ``` ### !!steps In this command we've set the new ticket to expire in `24 hours`, and a usage count of `1`. This means the generated ticket is valid for a single use, and that it's valid for 24 hours. A single usage ticket means there is low risk associated with mishandling this ticket after use; there's no means for an attacker to re-use it like an API token to access any system. ```shell ! tour ockam project ticket \ # !focus(1:1) --usage-count 1 --expires-in 24h \ --attribute amazon-influxdb-outlet \ --relay influxdb \ > outlet.ticket ``` ### !!steps The Project Membership Credential that's issued will include attributes that will be cryptographically attested to by the Project's Membership Authority. You can use these attributes to apply policies with Attribute Based Access Controls (ABAC) to allow or restrict specific actions and communication paths between nodes. In this example we assign a single attribute of `amazon-influxdb-outlet`. ```shell ! tour ockam project ticket \ --usage-count 1 --expires-in 24h \ # !focus(1:1) --attribute amazon-influxdb-outlet \ --relay influxdb \ > outlet.ticket ``` ### !!steps The `--relay influxdb` flag is a shortcut for creating a policy that allows this node to create a relay at the address `influxdb`. This relay will allow a InfluxDB client to establish a secure end-to-end encrypted connection to the InfluxDB server, running in your amazon account, without requiring you to expose any endpoints to the public Internet. As the final part of this command we pipe the generated ticket to a file named `outlet.ticket`. ```bash ! tour ockam project ticket \ --usage-count 1 --expires-in 24h \ --attribute amazon-influxdb-outlet \ # !focus(1:1) --relay influxdb \ > outlet.ticket ``` ### !!steps Generate enrollment ticket for Ockam Inlet node. We need to generate a second enrollment ticket to allow a new Ockam Inlet Node to join our Ockam Project. This node will run alongside the InfluxDB client. ```bash ! tour ockam project ticket \ --usage-count 1 --expires-in 24h \ --attribute amazon-influxdb-inlet \ --tls \ > inlet.ticket ``` ### !!steps In this command we've set the new ticket to expire in `24 hours`, and a usage count of `1`. This means the generated ticket is valid for a single use, and that it's valid for 24 hours. A single usage ticket means there is low risk associated with mishandling this ticket after use; there's no means for an attacker to re-use it like an API token to access any system. ```shell ! tour ockam project ticket \ # !focus(1:1) --usage-count 1 --expires-in 24h \ --attribute amazon-influxdb-inlet \ --tls \ > inlet.ticket ``` ### !!steps The Project Membership Credential that's issued will include attributes that will be cryptographically attested to by the Project's Membership Authority. You can use these attributes to apply policies with Attribute Based Access Controls (ABAC) to allow or restrict specific actions and communication paths between nodes. In this example we assign a single attribute of `amazon-influxdb-inlet`. ```shell ! tour ockam project ticket \ --usage-count 1 --expires-in 24h \ # !focus(1:1) --attribute amazon-influxdb-inlet \ --tls > inlet.ticket ``` ### !!steps The `--tls` flag allows the Ockam node to request a TLS certificate to use for the connection. As the final part of this command we pipe the generated ticket to a file named `inlet.ticket`. ```bash ! tour ockam project ticket \ --usage-count 1 --expires-in 24h \ --attribute amazon-influxdb-inlet \ # !focus(1:1) --tls > inlet.ticket ``` ## Step 3: Deploy the Ockam Outlet Node ![Amazon Timestream InfluxDB token management with Ockam](/blog/amazon-influxdb-token-management/arch-ockam-outlet.png) The Ockam Node for Amazon Timestream InfluxDB streamlines deploying a managed Ockam Node in your AWS VPC. ### !!steps Launch Ockam node for Amazon Timestream InfluxDB To deploy the node that will allow your InfluxDB client to reach your Amazon Timestream InfluxDB instance visit the ["Ockam - Node for Amazon Timestream InfluxDB"](https://aws.amazon.com/marketplace/pp/prodview-yitol6hljwilq?sr=0-1&ref_=beagle&applicationId=AWSMPContessa), and click the `Continue to Subscribe` button, and then `Continue to Configuration`. On the configuration page choose the region that your Amazon Timestream InfluxDB instance is running in, and then click `Continue to Launch` followed by `Launch`. ![!tour Ockam node for Amazon Timestream InfluxDB](/blog/amazon-influxdb-token-management/marketplace-influxdb.png) ### !!steps Enter stack details The initial Create Stack screen pre-fills the fields with the correct information for your node, so you can press `Next` to proceed. ![!tour Ockam node for Amazon Timestream InfluxDB - create stack screen](/blog/amazon-influxdb-token-management/marketplace-create-stack.png) ### !!steps Enter node configuration This screen has important details to you need to fill in: * **Stack name:** Give this stack a recognizable name, you'll see this in various locations in the AWS Console. It'll also make it easier to clean these resources up later if you wish to remove them. * **VPC ID:** The ID of the Virtual Private Cloud network to deploy the node in. Make sure it's the same VPC where you've deployed your InfluxDB instance. * **Subnet ID:** Choose a suitable Subnet ID within the chosen VPC that has access to Amazon Timestream InfluxDB Database. Note that the subnet's IP address range must be added to the InfluxDB security group inbound rules. * **EC2 instance type:** Choose a suitable EC2 instance type. Default instance type is `m6a.large`. Adjust instance type depending on your use case. If you would like to have predictable network bandwidth of 12.5 Gbps use `m6a.8xlarge`. Make sure the instance type is available in the subnet you are launching in. * **Enrollment ticket:** Copy the contents of the `outlet.ticket` file we created earlier and paste it in here. * **InfluxDB Endpoint:** Copy the `Endpoint` value for the InfluxDB Database. * **InfluxDB Org ID:** Copy the `Organization ID` value for the InfluxDB Database obtained earlier by running `influx org list` command. * **InfluxDB Token Secret ARN:** Copy the ARN of the secret we created earlier. * **InfluxDB Leased Token Permission:** Copy and paste the below configuration. It is a JSON array of permission objects for InfluxDB leased token(s). When Ockam _inlet_ node requests a leased token from _outlet_ node, it will use the permissions specified here. Leave the variable `INFLUX_ORG_ID` as it will be replaced during runtime. For this example we will use below permissions that allows read and write access to all buckets. ```json [ { "action": "read", "resource": { "type": "buckets", "orgID": "INFLUX_ORG_ID" } }, { "action": "write", "resource": { "type": "buckets", "orgID": "INFLUX_ORG_ID" } } ] ``` * **JSON Node Configuration:** Copy and paste the below configuration. Note that the configuration values for `relay` and `allow` match with the enrollment tickets created in the previous step. `INFLUX_ENDPOINT`, `INFLUX_ORG_ID`, `INFLUX_TOKEN` and `LEASED_TOKEN_PERMISSIONS` will be replaced with the values provided in the cloudformation stack details. ```json { "http-server-port": 23345, "relay": "influxdb", "tcp-outlet": { "to": "INFLUX_ENDPOINT:8086", "from": "ui-outlet", "allow": "amazon-influxdb-inlet", "tls": true }, "influxdb-outlet": { "to": "INFLUX_ENDPOINT:8086", "tls": true, "allow": "amazon-influxdb-inlet", "org-id": "INFLUX_ORG_ID", "all-access-token": "INFLUX_TOKEN", "leased-token-expires-in": "300", "leased-token-permissions": "LEASED_TOKEN_PERMISSIONS" } } ``` Ockam Command will process the configuration file after the node starts, with the first instruction being to create a relay with the name `influxdb`. This relay will allow InfluxDB client to establish a secure end-to-end encrypted connection to your InfluxDB Database. It provides the ability to have entirely isolated infrastructure running within a private network, without requiring you to expose any endpoints to the public Internet and no configuring of allow lists to custom network routes. An outlet decrypts any messages received by the node and then forwards them to the specified InfluxDB address. Click Next to launch the CloudFormation run. A successful CloudFormation stack run configures the Ockam Timestream InfluxDB Outlet node on an EC2 machine. - EC2 machine mounts an EFS volume created in the same subnet. Ockam state is stored in the EFS volume. - A security group with egress access to the internet will be attached to the EC2 machine. - Connect to the EC2 machine via AWS Session Manager. - To view the log file, run `sudo cat /var/log/cloud-init-output.log`. - Successful run will show `Ockam node setup completed successfully` in the logs - View the Ockam node status in CloudWatch. - Navigate to Cloudwatch -> Log Group and select `-status-logs`. Select the Logstream for the EC2 instance. - The Cloudformation template creates a subscription filter that sends data to a Cloudwatch alarm `-OckamNodeDownAlarm`.Alarm will turn green upon ockam node successfully running. - An Autoscaling group ensures at least one EC2 instance is running at all times ![!tour Ockam node for Amazon Timestream InfluxDB- create stack screen](/blog/amazon-influxdb-token-management/marketplace-specify-stack-details.png) ## Step 4: Deploy the Ockam Inlet Node You can set up an Ockam InfluxDB Inlet Node locally using Docker or command line. ![Ockam InfluxDB Inlet Node](/blog/amazon-influxdb-token-management/arch-ockam-inlet.png) ### Setup an Ockam Inlet Node along with telegraf client in Docker To set up an Inlet Node locally and interact with it outside of AWS, use Docker Compose. #### !!steps Store your Ockam Project ID. ```bash ! tour export OCKAM_PROJECT_ID="$(ockam project show --jq .id)" ``` #### !!steps Create a new `docker-compose.yml` with this configuration. ```bash ! tour services: ockam: image: ghcr.io/build-trust/ockam container_name: influxdb-inlet ports: - "8086:8086" - "18086:18086" environment: ENROLLMENT_TICKET: ${ENROLLMENT_TICKET:-} OCKAM_DEVELOPER: ${OCKAM_DEVELOPER:-false} OCKAM_LOGGING: true OCKAM_LOG_LEVEL: info command: - node - create - --enrollment-ticket - ${ENROLLMENT_TICKET} - --foreground - --configuration - | influxdb-inlet: from: 0.0.0.0:18086 via: influxdb allow: amazon-influxdb-outlet tls: true tcp-inlet: alias: ui-inlet from: 0.0.0.0:8086 to: ui-outlet via: influxdb allow: amazon-influxdb-outlet tls: true network_mode: bridge telegraf-client: image: telegraf:1.26 container_name: telegraf-client command: | /bin/sh -c ' cat << EOF > /tmp/telegraf.conf [agent] interval = "30s" round_interval = true metric_batch_size = 1000 metric_buffer_limit = 10000 collection_jitter = "0s" flush_interval = "30s" flush_jitter = "0s" precision = "" hostname = "" omit_hostname = false debug = true # Enable verbose debugging quiet = false # Disable quiet mode to show all logs [[outputs.influxdb_v2]] urls = ["https://influxdb-inlet.${OCKAM_PROJECT_ID}.ockam.network:18086"] token = "OCKAM_MANAGED" organization = "${INFLUXDB_ORG}" bucket = "${INFLUXDB_BUCKET}" [[inputs.cpu]] percpu = true totalcpu = true collect_cpu_time = false report_active = false [[inputs.disk]] ignore_fs = ["tmpfs", "devtmpfs", "devfs", "iso9660", "overlay", "aufs", "squashfs"] [[inputs.mem]] [[inputs.system]] EOF cat /tmp/telegraf.conf && telegraf --config /tmp/telegraf.conf ' environment: - OCKAM_PROJECT_ID=${OCKAM_PROJECT_ID:-} - INFLUXDB_ORG=${INFLUXDB_ORG:-} - INFLUXDB_BUCKET=${INFLUXDB_BUCKET:-} depends_on: - ockam network_mode: host ``` #### !!steps Copy the `inlet.ticket` to same location as the `docker-compose.yml` file and run the following command to create an Ockam Timestream InfluxDB inlet that can connect to the outlet running in AWS, along with telegraf client container that pushes metrics to InfluxDB via secure encrypted connection. - Update `YOUR_ORG_NAME` with the name of the organization in InfluxDB - Update `YOUR_BUCKET_NAME` with the name of the bucket in InfluxDB ```bash ! tour ENROLLMENT_TICKET="$(cat inlet.ticket)" \ INFLUXDB_ORG="YOUR_ORG_NAME" \ INFLUXDB_BUCKET="YOUR_BUCKET_NAME" \ docker-compose up -d ``` ## Seeing the results You have now successfully setup end-to-end encrypted connection between your InfluxDB instance running in AWS and your local machine running the telegraf client. Final setup looks like this: ![Amazon Timestream InfluxDB token management with Ockam](/blog/amazon-influxdb-token-management/amazon-influxdb-token-management.png) Keep in mind what the setup looked like on the client side though, we provided some JSON configuration (which would likely be identical for all of your clients) and a single-use enrollment ticket. Any additional clients would get their own single-use enrollment ticket and everything else would remain the same. Consider the things we did not have to do: * Update firewall rules or security groups in our VPC to allow the client access to InfluxDB. * Specify the hostname or IP address of our InfluxDB server. * Provide any form of API token or access credential to authorize against the InfluxDB server. The enrollment ticket combined with our portal automagically establishes a secure point-to-point connection with the Ockam node running next to InfluxDB. The lease manager assigns a unique and short-lived InfluxDB access InfluxDB token to every single client that is successfully authenticated and authorized to connect. The Ockam client node then transparently inserts that authorization token into all future requests (which is why we didn't need to provide any authentication in the Telegraf config). The lease manager will automatically revoke the access token when the time comes, and the Ockam client node and lease manager will then negotiate to receive a new one and inserts it into authorization header. All of this happened automatically, and will continue to happen regularly and automatically, to ensure your systems are secure. ### Querying with Influx CLI ### !!steps You can validate everything working as expected by querying the bucket using Influx CLI to see the data being sent to InfluxDB from telegraf client. Update `YOUR_BUCKET_NAME` with the name of the bucket in InfluxDB. ```bash ! tour influx query 'from(bucket:"YOUR_BUCKET_NAME") |> range(start: -1h) |> filter(fn: (r) => r._measurement == "cpu") |> yield()' ``` ### !!steps Check CPU metrics. ```bash ! tour influx query 'from(bucket:"YOUR_BUCKET_NAME") |> range(start: -1h) |> filter(fn: (r) => r._measurement == "cpu") |> yield()' ``` ### !!steps Check memory metrics. ```bash ! tour influx query 'from(bucket:"YOUR_BUCKET_NAME") |> range(start: -1h) |> filter(fn: (r) => r._measurement == "mem") |> yield()' ``` ### !!steps Check disk metrics. ```bash ! tour influx query 'from(bucket:"YOUR_BUCKET_NAME") |> range(start: -1h) |> filter(fn: (r) => r._measurement == "disk") |> yield()' ``` ### Accessing the Admin Dashboard You can access the InfluxDB UI at `https://influxdb-inlet.YOUR_PROJECT_ID.ockam.network:8086` ![InfluxUI via Ockam](/blog/amazon-influxdb-token-management/access-influx-ui-privately.png) ## Adding more clients You can issue additional inlet enrollment tickets to any number of machines and they'll all be able to securely connect to your InfluxDB instance. Each inlet node will request a leased token from the outlet node and use it to authenticate with the InfluxDB instance. The outlet node will rotate the leased token based on the expiry time set in the configuration to ensure the security of the connection. ## What did we just achieve? Let's quickly recap everything we've just implemented, because it can happen so quickly it can be easy to miss: * We're able to establish private & secure point-to-point connections to our Amazon Timestream for InfluxDB instance from any number of clients, from any network. * Each client has a unique identity, and can additionally have cryptographically attestable attributes applied to it by an administrator. Those attributes can then be used to define Attribute Based Access Control policies that control which nodes can establish a connection to our private InfluxDB server. * Each connection is mutually authenticated and end-to-end encrypted. * The nodes generate and share encryption keys themselves to establish a secure connection — so there's no centralised handling or storage of keys by third-party. * The Ockam protocol also automatically and regularly rotates the encryption keys. * Combined with the lease manager, each uniquely identifiable InfluxDB client will now receive its own unique time-limited InfluxDB access token. The token will be securely distributed to clients over mutually authenticated Ockam secure channel. * There's was no need to make our InfluxDB service accessible from the public internet. * There's no more sharing of long-lived InfluxDB access tokens across multiple clients. * There's no more risk and complications associated distributing sensitive access tokens to clients. * … and we can access the InfluxDB Admin Dashboard! Ockam is able to set all of this up in minutes, and replaces the riskiest parts of connecting private systems with an approach that is almost impossible to get wrong. And while this guide emphasises setting this up with Amazon Timestream, the approach works exactly the same with any self-hosted InfluxDB server. You'll need to start the outlet node manually using [Ockam Command](https://command.ockam.io/manual/), though I'm happy to help explain how to do get that running. If you need some help [drop me a note](https://www.ockam.io/contact/form). ## Troubleshooting Common issues and solutions: 1. **Connection Issues:** - Ensure the InfluxDB endpoint and port (8086) are correct. - Verify that the InfluxDB instance is reachable from the Ockam _outlet_ node. - Check security group settings on both the InfluxDB instance and the Ockam _outlet_ node. 2. **Ockam Node Issues:** - Verify token attributes match the configuration. - Ensure the enrollment ticket is correct and valid. 3. **InfluxDB Issues:** - Verify the InfluxDB token has the necessary permissions. - Check organization name and bucket name in the telegraf client configuration. - Review lease manager configuration If you continue to experience issues, please [reach out to us](https://www.ockam.io/contact/form) for further assistance.

Quickstarts

Secure token management for Amazon InfluxDB

Glenn Gillen

VP of Product, GTM

Secure token management for Amazon InfluxDB

Glenn Gillen

VP of Product, GTM