メニュー
Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/AgentFlocks/flocks --skill implementing-zero-trust-with-hashicorp-boundaryコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
深信服 EDR 登录态管理、首页仪表盘、威胁资产分析和资产清点分类统计 API 采集。用户提到深信服 EDR、EDR、资产清点或 sangfor EDR 时必须先加载本 skill。
统一处理浏览器使用任务，支持可见浏览器 CDP 直连、专用 headless CDP、agent-browser。Use when the user asks to browse websites, interact with pages, fill forms, capture screenshots, reuse an existing Chrome/Chromium/Edge login session, work with an already-open browser/sidebar browser, access login-only/internal/dynamic pages, or automate browser actions.
用于处理 OneSEC/OneDNS 终端安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSEC、微步 EDR等相关操纵需求时，必须先加载本 skill。本 skill 是 OneSEC 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesec_*` tool。
SOC 職業分類に基づく
SKILL.md を表示中
| name | implementing-zero-trust-with-hashicorp-boundary |
| description | Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration. |
| domain | cybersecurity |
| subdomain | zero-trust-architecture |
| tags | ["zero-trust","hashicorp","boundary","privileged-access","vault","identity-aware-proxy","session-recording","just-in-time-access"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"] |
HashiCorp Boundary is an identity-aware proxy that provides secure, zero trust access to infrastructure resources without traditional VPNs or direct network access. Boundary operates on a default-deny model -- users start with no access and must be explicitly granted permissions for specific resources. When integrated with HashiCorp Vault, Boundary can dynamically broker credentials, ensuring users never see or manage underlying secrets. This eliminates credential sprawl and enables just-in-time access with automatic credential revocation when sessions end. Boundary supports session recording for audit compliance, OIDC/LDAP authentication, and manages access through a hierarchical scope model of organizations and projects.
Identity Provider (OIDC)
|
Authentication
|
+--------+--------+
| Boundary |
| Controller |
| (Control Plane)|
+--------+--------+
|
+------------+------------+
| |
+--------+--------+ +--------+--------+
| Boundary Worker | | Boundary Worker |
| (Data Plane) | | (Data Plane) |
+--------+--------+ +--------+--------+
| |
+--------+--------+ +--------+--------+
| Target Hosts | | Target Hosts |
| (SSH, RDP, | | (Databases, |
| K8s, HTTP) | | APIs) |
+-----------------+ +-----------------+
Vault (Credential Brokering)
- Dynamic database credentials
- SSH certificate signing
- Credential libraries
# Install Boundary
curl -fsSL https://apt.releases.hashicorp.com/gpg | apt-key add -
apt-add-repository
apt-get update && apt-get install boundary
boundary database init \
-config=/etc/boundary/controller.hcl
boundary server -config=/etc/boundary/controller.hcl
# /etc/boundary/controller.hcl
controller {
name = "boundary-controller-1"
description = "Primary Boundary Controller"
database {
url = "postgresql://boundary:password@localhost:5432/boundary?sslmode=require"
}
public_cluster_addr = "boundary.example.com"
}
listener "tcp" {
address = "0.0.0.0:9200"
purpose = "api"
tls_cert_file = "/etc/boundary/tls/cert.pem"
tls_key_file = "/etc/boundary/tls/key.pem"
}
listener "tcp" {
address = "0.0.0.0:9201"
purpose = "cluster"
tls_cert_file = "/etc/boundary/tls/cert.pem"
tls_key_file = "/etc/boundary/tls/key.pem"
}
kms "aead" {
purpose = "root"
aead_type = "aes-gcm"
key = "sP1fnF5Xz85RrXM..." # Use Vault Transit in production
key_id = "global_root"
}
kms "aead" {
purpose = "worker-auth"
aead_type = "aes-gcm"
key = "8fZBjCUfN0TzjEG..."
key_id = "global_worker-auth"
}
kms "aead" {
purpose = "recovery"
aead_type = "aes-gcm"
key = "8fZBjCUfN0TzjEG..."
key_id = "global_recovery"
}
# /etc/boundary/worker.hcl
worker {
name = "boundary-worker-1"
description = "Worker in production VPC"
public_addr = "worker1.example.com"
controllers = [
"boundary.example.com:9201"
]
tags {
type = ["production"]
region = ["us-east-1"]
}
}
listener "tcp" {
address = "0.0.0.0:9202"
purpose = "proxy"
}
kms "aead" {
purpose = "worker-auth"
aead_type = "aes-gcm"
key = "8fZBjCUfN0TzjEG..."
key_id = "global_worker-auth"
}
# main.tf - Boundary resources via Terraform
terraform {
required_providers {
boundary = {
source = "hashicorp/boundary"
version = "~> 1.1"
}
}
}
provider "boundary" {
addr = "https://boundary.example.com:9200"
recovery_kms_hcl = file("recovery_kms.hcl")
}
# Organization scope
resource "boundary_scope" "org" {
scope_id = "global"
name = "production-org"
description = "Production organization scope"
auto_create_admin_role = true
auto_create_default_role = true
}
# Project scope
resource "boundary_scope" "production" {
name = "production"
description = "Production infrastructure project"
scope_id = boundary_scope.org.id
auto_create_admin_role = true
auto_create_default_role = true
}
# OIDC Auth Method (Okta example)
resource "boundary_auth_method_oidc" "okta" {
scope_id = boundary_scope.org.id
name = "okta"
description = "Okta OIDC authentication"
issuer = "https://company.okta.com/oauth2/default"
client_id = var.okta_client_id
client_secret = var.okta_client_secret
signing_algorithms = ["RS256"]
api_url_prefix = "https://boundary.example.com:9200"
claims_scopes = ["groups"]
account_claim_maps = ["oid=sub"]
is_primary_for_scope = true
}
# Managed group for auto-assignment
resource "boundary_managed_group" "sre_team" {
auth_method_id = boundary_auth_method_oidc.okta.id
name = "sre-team"
description = "SRE team members from Okta"
filter = "\"sre-team\" in \"/token/groups\""
}
resource "boundary_managed_group" "dev_team" {
auth_method_id = boundary_auth_method_oidc.okta.id
name = "dev-team"
description = "Development team from Okta"
filter = "\"dev-team\" in \"/token/groups\""
}
# Static host catalog for known infrastructure
resource "boundary_host_catalog_static" "production_servers" {
name = "production-servers"
scope_id = boundary_scope.production.id
}
resource "boundary_host_static" "web_server" {
name = "web-server-1"
host_catalog_id = boundary_host_catalog_static.production_servers.id
address = "10.0.1.10"
}
resource "boundary_host_static" "db_server" {
name = "db-server-1"
host_catalog_id = boundary_host_catalog_static.production_servers.id
address = "10.0.2.20"
}
# Host set grouping
resource "boundary_host_set_static" "web_servers" {
name = "web-servers"
host_catalog_id = boundary_host_catalog_static.production_servers.id
host_ids = [boundary_host_static.web_server.id]
}
resource "boundary_host_set_static" "db_servers" {
name = "database-servers"
host_catalog_id = boundary_host_catalog_static.production_servers.id
host_ids = [boundary_host_static.db_server.id]
}
# SSH target
resource "boundary_target" "ssh_production" {
name = "ssh-production-servers"
description = "SSH access to production servers"
type = "ssh"
scope_id = boundary_scope.production.id
default_port = 22
host_source_ids = [
boundary_host_set_static.web_servers.id
]
session_max_seconds = 3600 # 1 hour max session
session_connection_limit = 1
enable_session_recording = true
storage_bucket_id = boundary_storage_bucket.sessions.id
injected_application_credential_source_ids = [
boundary_credential_library_vault_ssh_certificate.ssh_cert.id
]
}
# Database target with Vault credential brokering
resource "boundary_target" "postgres_production" {
name = "postgres-production"
description = "PostgreSQL production database"
type = "tcp"
scope_id = boundary_scope.production.id
default_port = 5432
host_source_ids = [
boundary_host_set_static.db_servers.id
]
session_max_seconds = 1800 # 30 min max
session_connection_limit = 5
brokered_credential_source_ids = [
boundary_credential_library_vault.postgres_creds.id
]
}
# Vault credential store
resource "boundary_credential_store_vault" "vault" {
name = "vault-store"
scope_id = boundary_scope.production.id
address = "https://vault.example.com:8200"
token = var.vault_token
namespace = "production"
}
# Dynamic database credentials from Vault
resource "boundary_credential_library_vault" "postgres_creds" {
name = "postgres-dynamic-creds"
credential_store_id = boundary_credential_store_vault.vault.id
path = "database/creds/readonly"
http_method = "GET"
credential_type = "username_password"
}
# SSH certificate signing via Vault
resource "boundary_credential_library_vault_ssh_certificate" "ssh_cert" {
name = "ssh-certificate"
credential_store_id = boundary_credential_store_vault.vault.id
path = "ssh-client-signer/sign/production"
username = "admin"
key_type = "ed25519"
key_bits = 256
extensions = {
"permit-pty" = ""
}
}
# Session recording storage
resource "boundary_storage_bucket" "sessions" {
name = "session-recordings"
scope_id = "global"
plugin_name = "aws"
bucket_name = "boundary-session-recordings"
attributes_json = jsonencode({
"region" = "us-east-1"
"disable_credential_rotation" = true
})
secrets_json = jsonencode({
"access_key_id" = var.aws_access_key
"secret_access_key" = var.aws_secret_key
})
}
# SRE team role - full production access
resource "boundary_role" "sre_production" {
name = "sre-production-access"
scope_id = boundary_scope.production.id
grant_strings = [
"ids=*;type=target;actions=list,read,authorize-session",
"ids=*;type=session;actions=list,read,cancel",
"ids=*;type=host;actions=list,read",
]
principal_ids = [
boundary_managed_group.sre_team.id
]
}
# Dev team role - limited access
resource "boundary_role" "dev_staging" {
name = "dev-staging-access"
scope_id = boundary_scope.production.id
grant_strings = [
"ids=${boundary_target.ssh_production.id};type=target;actions=read,authorize-session",
]
principal_ids = [
boundary_managed_group.dev_team.id
]
}
# Authenticate via OIDC
boundary authenticate oidc \
-auth-method-id amoidc_xxxxx
# List available targets
boundary targets list -scope-id p_xxxxx
# Connect to SSH target (credentials injected by Vault)
boundary connect ssh \
-target-id ttcp_xxxxx
# Connect to database (credentials brokered by Vault)
boundary connect postgres \
-target-id ttcp_xxxxx \
-dbname production
# Use Boundary Desktop client for GUI access
# Download from: https://developer.hashicorp.com/boundary/install
# List session recordings
boundary session-recordings list \
-scope-id p_xxxxx
# Download session recording for review
boundary session-recordings download \
-id sr_xxxxx \
-output recording.cast
# Play back with asciinema
asciinema play recording.cast
# AWS dynamic host catalog - auto-discovers EC2 instances
resource "boundary_host_catalog_plugin" "aws_catalog" {
scope_id = boundary_scope.production.id
name = "aws-production"
plugin_name = "aws"
attributes_json = jsonencode({
"region" = "us-east-1"
"disable_credential_rotation" = true
})
secrets_json = jsonencode({
"access_key_id" = var.aws_access_key
"secret_access_key" = var.aws_secret_key
})
}
resource "boundary_host_set_plugin" "web_tier" {
host_catalog_id = boundary_host_catalog_plugin.aws_catalog.id
name = "web-tier"
attributes_json = jsonencode({
"filters" = [
"tag:Environment=production",
"tag:Tier=web"
]
})
}