Is this AWS console app_server set-up safe?

[pires]

I have followed the guided AWS Console/CLI app onboarding on Teleport Community Edition v17.4.8. Now, I would like to reproduce it in my IaC - which is not Terraform - and it took me a while to figure it out.

Teleport shows the following app_server resource:

$ tctl get app_server
kind: app_server
metadata:
  labels:
    aws_account_id: "REDACTED"
  name: aws-integration
spec:
  app:
    kind: app
    metadata:
      labels:
        aws_account_id: "REDACTED"
      name: aws-integration
    spec:
      cloud: AWS
      insecure_skip_verify: false
      integration: aws-integration
      public_addr: aws-integration.REDACTED:443
      uri: https://console.aws.amazon.com
    version: v3
  host_id: SOME_UUID
  hostname: ""
  rotation:
    current_id: ""
    last_rotated: "0001-01-01T00:00:00Z"
    schedule:
      standby: "0001-01-01T00:00:00Z"
      update_clients: "0001-01-01T00:00:00Z"
      update_servers: "0001-01-01T00:00:00Z"
    started: "0001-01-01T00:00:00Z"
  version: 17.4.8
version: v3

I copied and edited it into the following YAML file:

kind: app_server
version: v3
metadata:
  labels:
    aws_account_id: "REDACTED"
  name: aws-integration
spec:
  app:
    kind: app
    metadata:
      labels:
        aws_account_id: "REDACTED"
      name: aws-integration
    spec:
      cloud: AWS
      insecure_skip_verify: false
      integration: aws-integration
      public_addr: aws-integration.REDACTED:443
      uri: https://console.aws.amazon.com
  host_id: 00000000-0000-0000-0000-000000000000
  version: 17.4.8

The host_id is a bit of a magic UUID because I don't know how to determine this. Is what I have done unsafe? Should I be doing it in a different way that doesn't involved the Terraform provider?

I deleted the previous app_server and applied the new one:

$ tctl rm app_server/aws-integration

$ tctl create -f aws-console-app_server.yml

I then tried using it and it just worked.

And for reference, this is my integration:

kind: integration
sub_kind: aws-oidc
version: v1
metadata:
  name: aws-integration
spec:
  aws_oidc:
    role_arn: arn:aws:iam::REDACTED:role/teleport-access