IBM HashiCorp Boundary

Why HashiCorp Boundary?

VPN gives full network access after authentication. Shared credentials for admin access. No visibility who did what. On-call engineers need quick, secure access. Traditional bastion hosts are management burden.

HashiCorp Boundary is Zero Trust remote access for infrastructure. Identity-based - access based on who you are, not where you are. Credential injection - users never see passwords. Session recording for full audit. Replace VPN with modern approach.

How does it work?

Identity-Based Access

Zero Trust model:

• User identity verification
• Device posture check
• Context-aware policies
• Role-based permissions
• Continuous authorization

Credential Brokering

Passwordless access:

• Vault integration
• Dynamic credential injection
• One-time credentials
• No credential exposure
• Automatic cleanup

Session Management

Complete visibility:

• Real-time monitoring
• Full session recording
• Keystroke capture
• Searchable audit
• Incident investigation

Main features

Transparent Sessions

• Seamless user experience
• Native client support
• Browser-based access
• SSH, RDP, Kubernetes
• Database connections

Access Control

• Scope-based permissions
• Target cataloging
• Dynamic host catalogs
• Groups and roles
• Time-bounded access

Credential Injection

• Vault credential brokering
• RDP passwordless (2025)
• SSH certificate injection
• Database credentials
• Automatic rotation

Audit & Compliance

• Session recording
• Event streaming
• SIEM integration
• Compliance reports
• Forensic analysis

Supported Protocols

Protocol	Features
SSH	Certificate injection, recording
RDP	Credential injection, recording
Kubernetes	kubectl exec, logs, port-forward
HTTP/HTTPS	Web application access
Database	PostgreSQL, MySQL, MSSQL

Deployment Options

Open Source:

• Core ZTNA features
• Self-managed
• Community support

Enterprise:

• Session recording
• Multi-hop workers
• Enterprise support

HCP Boundary:

• Fully managed SaaS
• Automatic scaling
• Global availability

Use Cases

On-Call Engineers:

• Incident-triggered access
• Just-in-time permissions
• Full session recording
• Auto-revocation

Remote Workers:

• Replace VPN
• Identity-based access
• Context-aware policies
• Secure from anywhere

Third-Party Vendors:

• Time-limited access
• Full audit trail
• Credential injection
• No credential sharing

For whom?

• Organizations replacing legacy VPN
• DevOps and SRE teams
• Security teams requiring Zero Trust
• Enterprises with regulatory compliance

Benefits

For Security: Zero Trust model, no shared credentials, full audit trail

For Operations: Replace VPN, simplified access, automated provisioning

For Compliance: Session recording, event logging, access reports

Specifications

Access	SSH, RDP, K8s, HTTP, Database
Auth	OIDC, LDAP, Azure AD, Okta
Recording	Video, keystroke, searchable
Deployment	OSS, Enterprise, HCP

FAQ

How does it differ from VPN? VPN: network-level access. Boundary: application-level, identity-based. Least privilege.

How does credential injection work? Boundary retrieves credential from Vault and injects into session. User never sees password.

Does it require agent on endpoints? No. Boundary is proxy-based. Optional lightweight client for desktop experience.

What does session recording look like? Full video recording + keystroke capture. Searchable, exportable, SIEM integration.

Does it integrate with Vault? Yes. Native integration. Vault provides dynamic credentials, Boundary injects them.

What does just-in-time access look like? Approval workflow → Time-bounded permission → Automatic revocation. PagerDuty integration.

Does it support multi-cloud? Yes. Workers can be deployed anywhere. Unified access to AWS, Azure, GCP, on-prem.

What does Kubernetes access look like? kubectl exec, logs, port-forward through Boundary. RBAC enforcement, audit.

How much does it cost? OSS free. Enterprise/HCP pricing per user/target. Contact for quote.

What does support look like? HashiCorp/IBM support. nFlo offers Boundary deployment and integration with existing infrastructure.