diff --git a/docs/img/access-graph/dac/db-object-contains-relation.png b/docs/img/access-graph/dac/db-object-contains-relation.png new file mode 100644 index 0000000000000..c26f2c541bdaf Binary files /dev/null and b/docs/img/access-graph/dac/db-object-contains-relation.png differ diff --git a/docs/img/access-graph/dac/db-object-details.png b/docs/img/access-graph/dac/db-object-details.png new file mode 100644 index 0000000000000..b0ffdd835149d Binary files /dev/null and b/docs/img/access-graph/dac/db-object-details.png differ diff --git a/docs/img/access-graph/dac/db-object-permissions-label.png b/docs/img/access-graph/dac/db-object-permissions-label.png new file mode 100644 index 0000000000000..8034e19741855 Binary files /dev/null and b/docs/img/access-graph/dac/db-object-permissions-label.png differ diff --git a/docs/img/access-graph/dac/overview.png b/docs/img/access-graph/dac/overview.png new file mode 100644 index 0000000000000..47100c9188ee6 Binary files /dev/null and b/docs/img/access-graph/dac/overview.png differ diff --git a/docs/pages/admin-guides/teleport-policy/policy-connections.mdx b/docs/pages/admin-guides/teleport-policy/policy-connections.mdx index 37fae4539620d..85120c116e6f0 100644 --- a/docs/pages/admin-guides/teleport-policy/policy-connections.mdx +++ b/docs/pages/admin-guides/teleport-policy/policy-connections.mdx @@ -71,6 +71,32 @@ can be identified by having `Temporary: true` property. Resource Groups are created from Teleport roles. +### Database Access Controls + +Teleport supports [object-level permissions](../../enroll-resources/database-access/rbac.mdx#executing-database-object-permission-rules) for select database protocols. + +The database objects-level access information is automatically synchronized to Teleport Policy, making it possible to see who has particular levels of access to the different parts of the database. + +When you inspect a particular user's access, the Teleport Access Graph will automatically display the database objects that the user can access. + +![Overview of access including individual database objects](../../../img/access-graph/dac/overview.png) + +To see more details about a specific database object, simply select it. + +
+![Details of an individual database object](../../../img/access-graph/dac/db-object-details.png) +
+ +In the graph, database objects are connected by multiple edges: + +1. There is exactly one edge connecting the object to its parent database resource. This edge has "contains" label. + +![Database object and parent database resource](../../../img/access-graph/dac/db-object-contains-relation.png) + +2. At least one edge shows the permissions associated with the object, such as `INSERT, SELECT, UPDATE`. If multiple roles grant permissions to the same object, additional edges of this type may be present. The permissions are presented as edge labels. + +![Specific object permissions](../../../img/access-graph/dac/db-object-permissions-label.png) + #### Resources Resources are created from Teleport resources like nodes, databases, and Kubernetes clusters.