Can't tctl auth sign database certificate remotely via proxy / in Teleport Cloud

[r0mant]

When trying to sign a database certificate for configuring a self-hosted database by invoking tctl auth sign remotely (for example, in case of Teleport Cloud) users get this error:

➜  ~ tctl auth sign --format=db --host=db.example.com --out=server --ttl=8760h         
ERROR: this request can only be executed by a database service or an admin

[r0mant]

Prior to Teleport version 6.2.1 only cluster admin could generate self-hosted database certificates by running tctl auth sign command locally on the auth server.

Starting from 6.2.1 release, the command allows generating these certificates remotely as well, by leveraging Teleport's impersonation capabilities.

To generate these certs, user invoking the command must have permissions to impersonate the built-in Db user/role representing a database node.

Example allow rule:

allow:
  impersonate:
    users: ["Db"]
    roles: ["Db"]