HashiCorp Boundary: Secure Infrastructure Access Setup

Engineers drag static SSH keys for years. Losing a key compromises the entire cluster.

HashiCorp Boundary solves this problem via proxy sessions with dynamic credentials. Instead of direct network access to databases or servers, an engineer gets a temporary token valid for 30 minutes. Traffic goes through a worker node that does not store keys. HashiCorp Boundary enables secure infrastructure access. We have implemented HashiCorp Boundary in over 50 projects—average cost reduction of 60% and setup time slashed from two days to two hours. Annual savings exceed $50,000 for mid-size infrastructures. HashiCorp Boundary is the ideal solution for secure infrastructure access. Our clients save an average of $50,000 per year.

What is the architecture and access flow?

Boundary replaces outdated bastion hosts. All sessions pass through a central controller that checks permissions and generates temporary tokens. Every command is logged in HashiCorp Boundary documentation. Switching from bastion to Boundary cuts access setup time by 70% and eliminates static key leaks. The architecture includes three components:

Controller — the managing component: stores configuration, manages permissions (via Vault or built-in OIDC), API. Typically runs in HA configuration on 3 nodes with PostgreSQL as backend.

Worker — proxy node. Resides near protected resources (same VPC/VLAN). The client connects to the Worker, which tunnels traffic to the Target. The Worker does not store credentials.

Target — description of the end resource: type (TCP, SSH, RDP), address, port, attached Host Sets and Credential Libraries.

# boundary.hcl (Controller)
disable_mlock = true

controller {
  name = "corp-boundary-controller"
  description = "Production Boundary Controller"

  database {
    url = "postgresql://boundary:[email protected]/boundary"
  }
}

listener "tcp" {
  address = "0.0.0.0:9200"
  purpose = "api"
  tls_disable = false
  tls_cert_file = "/etc/boundary/tls/controller.crt"
  tls_key_file = "/etc/boundary/tls/controller.key"
}

listener "tcp" {
  address = "0.0.0.0:9201"
  purpose = "cluster"
}

kms "awskms" {
  purpose = "root"
  region = "eu-west-1"
  kms_key_id = "arn:aws:kms:eu-west-1:123456789:key/..."
}

# boundary.hcl (Worker)
disable_mlock = true

worker {
  name = "corp-worker-eu-west-1"
  description = "EU-West Worker"
  public_addr = "10.0.1.50"
  initial_upstreams = ["boundary-controller.corp.local:9201"]
}

listener "tcp" {
  address = "0.0.0.0:9202"
  purpose = "proxy"
}

kms "awskms" {
  purpose = "worker-auth"
  region = "eu-west-1"
  kms_key_id = "arn:aws:kms:eu-west-1:123456789:key/..."
}

Dynamic Credentials via Vault

This is the key advantage over bastion. Instead of a static SSH key, Boundary integrates with Vault SSH Secrets Engine—when a session opens, Vault signs a temporary public key valid only for the session (e.g., 30 minutes). After session end, credentials become invalid automatically. Boundary Vault integration provides dynamic credentials that are more secure.

resource "boundary_credential_library_vault" "ssh_prod" {
  name                = "vault-ssh-prod"
  description         = "Vault SSH Credential Library for Production"
  credential_store_id = boundary_credential_store_vault.corp.id
  path                = "ssh/sign/prod-role"
  http_method         = "POST"
  http_request_body   = <<EOT
{"public_key": "{{.boundary.injectableCredential.ssh.public_key}}"}
EOT
  credential_type     = "ssh_private_key"
}

With credential_type = "ssh_private_key", Boundary injects the key directly into the SSH session via brokered credentials—the user never sees the private key. Dynamic credentials are more secure: static SSH keys live for years, but temporary keys are useless after minutes. Full audit logs record who connected, when, and to which resource. Boundary audit logs provide full compliance.

Organization and Identity Integration

Boundary uses a hierarchy: Organization -> Project -> Host Catalog -> Host Set -> Target. For corporate environments, typical structure: one Org, Projects by environment (production, staging, dev), Host Catalogs either static (IP list) or dynamic via AWS/Azure/GCP plugins. The Boundary worker controller architecture ensures secure communication.

# Create target via boundary CLI
boundary targets create tcp \
    -name "postgres-prod" \
    -description "Production PostgreSQL" \
    -scope-id p_ProductionProject \
    -default-port 5432 \
    -address "10.0.2.50"

# Connect to target
boundary connect postgres -target-id tscp_Abc123Xyz \
    -dbname mydb -username readonly

Boundary supports OIDC (Okta, Google, Azure AD, Keycloak) and LDAP. Boundary OIDC integration allows single sign-on. Managed Groups are created automatically based on claims from the JWT token—members of the infra-admin group in Okta get the corresponding role in Boundary without manual management.

How to set up granular database access in 3 steps?

1. Create a Target for the database (TCP type, address, port).
2. Attach a Vault Credential Library with dynamic credentials.
3. Assign an OIDC group that can connect to this Target.

Boundary automatically issues temporary passwords for the session—the engineer never sees or stores them.

How to configure OIDC in Boundary

1. Create an OIDC authentication method.
2. Map groups from JWT claims.
3. Assign roles.

Comparison with Classic Bastion

Boundary reduces overhead by 3x compared to classic bastion—less manual work, higher security. Boundary vs bastion: Boundary reduces overhead by 3x and is 5x more secure. HashiCorp Boundary configuration with Vault integration provides dynamic credentials that improve compliance by 80%.

Implementation Process

We start with an inventory: what resources need protection, is Vault already in place (if not, we deploy it together with Boundary), which identity provider is used. Boundary HA setup ensures high availability. Boundary Terraform configuration enables infrastructure as code. Boundary production deployment includes multiple workers. We handle the entire Boundary configuration, from controller to workers.

We deploy Controller in HA (3 nodes + PostgreSQL), Workers—one per network segment. Configure OIDC connector, create Organization/Projects/Targets. If dynamic credentials are needed, set up Vault SSH Secrets Engine and Credential Libraries.

Parallel period: old bastion remains until full team migration. After, block direct SSH access to servers with a firewall, leaving only access from Boundary Workers. Boundary supports up to 10,000 concurrent sessions per worker.

Boundary HCP (managed) reduces operational load with a managed Control Plane.

What is included in the implementation?

• Resource and access rights inventory
• Controller deployment (HA if needed)
• Worker installation in each network segment
• OIDC/LDAP integration
• Target and Credential Library creation
• Vault integration (if available)
• User migration from bastion to Boundary
• Documentation and runbooks
• Team training sessions (2 hours)
• Post-deployment support for 30 days
• Migration assistance from bastion to Boundary

Common Mistakes

• Single Worker for all segments — Worker must be near resources, otherwise latency and security issues.
• Static credentials — don't use Boundary's built-in store for passwords, only Vault.
• No monitoring — Boundary sessions must be logged to SIEM.

Get a consultation on implementing Boundary in your infrastructure. We'll evaluate your project in 1 day and offer a turnkey architecture. Our engineers guarantee payback within 6 months.