hashicorp/boundary

Features

• Infrastructure Access Proxies - Brokers secure network connections to private hosts and services without exposing the underlying network or requiring a VPN.
• Identity-Aware Proxies - Brokers secure network connections to infrastructure by verifying user identity and permissions without requiring a VPN.
• Encrypted Session Recordings - Encrypts session recording data and verifies integrity using dedicated keys for security compliance.
• Permission Scoping - Organizes permissions into a nested structure of containers to implement inherited access control.
• Local Proxy Connection Establishment - Creates a local proxy to authorized target systems and returns the connection address and port to the client.
• Service Exposure - Maps internal IP addresses and host sets to secure endpoints to provide connectivity to internal services.
• Access Auditing - Tracks and records the full lifecycle of administrative sessions to ensure compliance and support incident investigations.
• Resource Containers - Organizes resources and permissions into a hierarchical structure of containers to limit the impact of security breaches.
• Identity Authentication - Exchanges credentials via defined authentication methods and recovery workflows to obtain system access tokens.
• External Identity Provider Integrations - Integrates with external identity providers via OpenID Connect to verify user identities.
• Credential Injection - Integrates with secret stores to automatically inject short-lived credentials during session initialization.
• Identity-Based Access Control - Implements network-level access control by mapping verified user identities to granular infrastructure permissions.
• Credential Brokering - Surfaces short-lived static or dynamic secrets from credential stores to users during session initialization.
• Just-in-Time Access - Enforces least-privilege access by granting temporary, time-limited network permissions to private resources based on roles.
• OIDC Identity Integrations - Delegates authentication to external OIDC providers and maps token claims to internal access policies.
• Privileged Access Management - Provides secure, audited connectivity to critical systems using just-in-time access and session recording.
• Role-Based Access Control - Implements a security model where permissions are explicitly granted through roles assigned to principals.
• SSL/TLS Connection Security - Establishes mutually authenticated TLS 1.3 connections between clients and workers using dynamic certificates.
• User Identity Management - Creates and organizes users and groups into principals assigned specific capabilities across organizational levels.
• Remote Session Audits - Records and tracks administrative activities performed during remote sessions to maintain a compliance trail.
• Forensic Event Timelines - Produces chronological sequences of authorized and terminated events to reconstruct attacker activity during incidents.
• Target Discovery - Locates cloud hosts and endpoints automatically to enable secure communication without manual entry.
• Administrative Session Recording - The product captures and stores session activity using S3-compatible storage backends for auditing and security compliance.
• Cloud Resource Discovery - Programmatically identifies and catalogs target systems and workloads as they are deployed across cloud platforms.
• Private Network Bridge Workers - Registers worker nodes to bridge connectivity between the proxy and targets located in private networks.
• Tag-Based Worker Routing - Controls which proxy workers handle specific resources by matching worker metadata tags against filter expressions.
• Agent-Based Session Proxies - Provides network access to hosts and systems via a client agent to ensure compatibility with security software.
• Connection and Session Management - Regulates the duration and number of simultaneous connections to target systems to prevent resource exhaustion.
• Worker Node Routing - Routes traffic through worker nodes using metadata tags to bridge connectivity to private networks.
• User Behavior Anomaly Detection - Identifies suspicious behavior such as lateral movement and data exfiltration via volume spikes.
• External Key Integration - Integrates with external Key Management Services to handle encryption keys for secure data storage.
• Data Encryption - Ensures that all sensitive system and session information is encrypted while residing on disk.
• Encrypted Secret Management - Protects sensitive configuration values using an external key management system or transit engine.
• Encryption Key Management - Automatically generates new key versions and re-encrypts existing data to maintain cryptographic security.
• Key Hierarchies - Protects secrets using a hierarchy of root keys and data encryption keys across operational scopes.
• Federated Identity Brokers - Brokers access by mapping claims from external OIDC providers to internal resource permissions.
• RDP - Provides target credentials directly to users during RDP sessions to enable passwordless access.
• Dynamic Target Mapping - Automatically discovers cloud targets and maps them to secure endpoints for authorized users.
• Infrastructure Component Authentication - Uses shared keys to verify the identity of workers connecting to controllers in multi-hop deployments.
• Network Connection Security - Utilizes TLS to encrypt communication channels between clients and the proxy to prevent interception.
• Secure Token Storage - Saves session tokens in platform-specific secure credential stores to minimize manual authentication prompts.
• Mutual TLS Transport Encryption - Establishes encrypted tunnels between clients and workers using dynamically generated certificates for mutual authentication.
• Encrypted Communication Channels - Encrypts traffic between clients and the controller using PKI and optional client certificates.
• Claim Filtering - Restricts user access based on specific claims extracted from OIDC identity provider tokens or UserInfo endpoints.
• Inactive Account Reviews - Identifies inactive or orphaned accounts for access certification and security auditing.
• Audit Logs - Captures session lifecycles and connection events into structured logs for SQL-based analytics.

Star history