HashiCorp Vault — Boundary

1 minute read

HashiCorp Boundary provides identity-based access management for dynamic infrastructure — replacing VPNs and bastion hosts with zero-trust remote access.

What is Boundary?

Traditional Access Boundary Access
VPN + bastion host Direct, identity-based
Static SSH keys Dynamic, short-lived credentials
IP-based firewall rules Identity-based access policies
Broad network access Just-in-time, session-based

How Boundary Works

User authenticates
  └── Boundary Controller verifies identity
        └── Policy check: user allowed to access target?
              └── Boundary Worker creates a proxied session
                    └── Credential injection (from Vault)
                          └── User connects to target
                                └── Session recorded and auditable

Boundary + Vault Integration

Vault acts as the credential store for Boundary:

# In Boundary: create a Vault credential store
boundary credential-stores create vault \
    -scope-id=p_1234567890 \
    -vault-address=https://vault.example.com:8200 \
    -vault-token=hvs.boundary-token

# Create a credential library (maps to a Vault path)
boundary credential-libraries create vault-generic \
    -credential-store-id=csvlt_abc123 \
    -vault-path="database/creds/readonly" \
    -credential-type=username_password

User Workflow

# User authenticates to Boundary
boundary authenticate

# Connect to a database (credentials auto-injected from Vault)
boundary connect postgres -target-id=ttcp_xyz789
# Boundary:
# 1. Gets dynamic DB credentials from Vault
# 2. Injects them into the session
# 3. User connects without ever seeing the credentials
# 4. Credentials are revoked when session ends

Key Concepts

Concept Description
Controller Manages users, policies, and configuration
Worker Handles session proxying (data plane)
Scope Organizational boundary (org → project)
Target The resource users connect to (DB, SSH, RDP)
Credential Store Integration with Vault for dynamic credentials
Session Time-bound, auditable connection

When to Use Boundary

Use Case Boundary Value
SSH access to servers Replace bastion hosts
Database access Inject dynamic credentials
RDP to Windows servers Proxied, auditable sessions
Kubernetes access Identity-based kubectl
Multi-cloud access Unified access control

Learn More

Next: Consul & Nomad

You may also enjoy