hashicorp / hashicorp/boundary

Writing static secrets from Boundary to Vault

Open
#3,209 2 comments 0 reactions 1 assignee Claimed by @AdamBouhmad View on GitHub
enhancement
Dominant language
Go
Stars
4.1k
Forks
317
Avg merge
5h 10m
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
We want to leverage Boundary as one stop solution or all PAM capabilities which means apart from proxying connections to targets, also making Boundary capable of writing/reading static secrets to/from Vault.

Reading secrets from Vault isn't an issue with Boundary, the only constraint being we would end up creating targets (with dummy host address) for every vault/credential path.

But when it comes to writing secrets, we want to restrict access to Vault for writing/reading secrets. In turn, we want Boundary to be the interface even for writing secrets.
I checked if it's possible to create a static secret from Boundary into Vault. The answer is "YES" but not a great experience to do the same. Steps followed:

- Created a credential library stated below with the secret name and POST request with actual value to be written in this secret.
- Created a target and associated this library with the target.
- Granted user access to this target.
- User clicks on "Connect" on this target from the Boundary desktop application and the secret is created (had to update Boundary controller policy to write secrets rather than just reading secrets).

image

**Describe the solution you'd like**

The main challenge would be automating and making this developer friendly. If you notice, I had to create a credential library with an already known value of secret and its value, had to associate this with a target and then user clicks on connect to finally create a secret (it sends a POST request in the background on clicking connect).
It would have been really pleasant to see if the user was prompted with the path and the secret value while clicking on connect rather than configuring a credential path beforehand.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.