hashicorp / hashicorp/boundary
Writing static secrets from Boundary to Vault
- Dominant language
- Go
- Stars
- 4.1k
- Forks
- 317
- Avg merge
- 5h 10m
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
We want to leverage Boundary as one stop solution or all PAM capabilities which means apart from proxying connections to targets, also making Boundary capable of writing/reading static secrets to/from Vault.
Reading secrets from Vault isn't an issue with Boundary, the only constraint being we would end up creating targets (with dummy host address) for every vault/credential path.
But when it comes to writing secrets, we want to restrict access to Vault for writing/reading secrets. In turn, we want Boundary to be the interface even for writing secrets.
I checked if it's possible to create a static secret from Boundary into Vault. The answer is "YES" but not a great experience to do the same. Steps followed:
- Created a credential library stated below with the secret name and POST request with actual value to be written in this secret.
- Created a target and associated this library with the target.
- Granted user access to this target.
- User clicks on "Connect" on this target from the Boundary desktop application and the secret is created (had to update Boundary controller policy to write secrets rather than just reading secrets).

**Describe the solution you'd like**
The main challenge would be automating and making this developer friendly. If you notice, I had to create a credential library with an already known value of secret and its value, had to associate this with a target and then user clicks on connect to finally create a secret (it sends a POST request in the background on clicking connect).
It would have been really pleasant to see if the user was prompted with the path and the secret value while clicking on connect rather than configuring a credential path beforehand.
Contributor guide
Assessment
This issue has not been assessed yet.