hashicorp / hashicorp/boundary

Time-Based Roles for Automated Access Management

Open
#4,973 0 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
4.1k
Forks
317
Avg merge
5h 10m
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**

Managing roles in HCP Boundary can be quite cumbersome because roles are permanent and need to be deleted manually to revoke access. This process can be time-consuming and is prone to human error, especially in environments with frequent role changes or temporary access needs.

**Describe the solution you'd like**

I would like to see a feature that allows setting a Time-To-Live (TTL) or a specific expiration timestamp for roles in HCP Boundary. When the specified time is reached, the role should be automatically deleted, thereby revoking access without the need for manual intervention. This would ensure that temporary access is automatically cleaned up, reducing administrative overhead.

**Describe alternatives you've considered**

- **Manual Deletion:** Continue with the current process of manually deleting roles, but this is inefficient and increases the risk of forgetting to revoke temporary access.
- **Scheduled Tasks:** Implement custom scripts or scheduled tasks to periodically check and delete expired roles, but this adds complexity and requires ongoing maintenance.
- **Audit Logs and Alerts:** Rely on audit logs and alerts to remind administrators to delete roles, but this still requires manual action and isn't as seamless as an automated solution.

**Explain any additional use-cases**

- **Temporary Project Roles:** Assign roles to team members for the duration of a project. Once the project is completed, the roles are automatically deleted, ensuring no lingering access.
- **Contractor Access:** Provide contractors with access for a specified period. Their access is automatically revoked after their contract ends, enhancing security.
- **Event-Based Roles:** Grant roles for specific events or time-bound activities. Once the event concludes, the roles are automatically removed, simplifying access management.

**Additional context**

Adding a TTL or expiration timestamp feature for roles would significantly enhance security by ensuring temporary access is properly managed and automatically revoked. It would also reduce the administrative burden on IT teams and improve overall efficiency in managing roles within HCP Boundary.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named in the issue. Start by mapping Boundary’s role and access-management implementation, then define the expiration behavior and verification needed for automatic revocation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authorization, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.