HCP Boundary: SSH Credential Injection and Private Vault Access
summary
HCP Boundary adds SSH credential injection (password or private key now; certificates soon) and private Vault access by routing encrypted Vault API requests through a chain of workers using a multi-hop worker architecture. Controllers issue single-use activation tokens, workers establish per-worker shared keys, and the controller encrypts credentials to the destination worker so credentials never reach the user; injected sessions are agentless and Vault leases are revoked at session end.
AI-written summary · about
chapters (7)
- 0:00Introduction to Boundary
- 1:38Boundary concepts
- 4:09Worker roles and topologies
- 8:40The multi-hop system
- 17:15Private Vault access
- 21:30Credential injection flow
- 28:30Security and considerations
related talks
24mEmpowering credential injection at scale using Boundary
15mBoundary: Then and Now [Abridged]
34mHashiCorp Boundary: Then & Now
39mExplore HashiCorp Boundary
34mHashiConf Europe 2022 Day 2 Keynote
42mHCP Vault Learn Lab: Operations with Terraform
42mZero-Knowledge Architecture, or Leak-Free Secrets, with HC Vault
51mRun modern PKI workflows with HCP Vault on AWS