Enable session recording with AWS and Vault

Start by logging in to HCP Boundary within the terminal.

1. Log in to the HCP portal.

2. From the HCP Portal's Boundary page, click Open Admin UI - a new page will open.

3. Enter the admin username and password you created when you deployed the new instance and click Authenticate.

Next, set up a new testing org and project scope.

1. Navigate to to the Orgs page and click New Org.

2. Fill out the new org form with a Name of ssh-recording-org and Description of SSH test org. Click Save.

3. From within the new org, click New Project.

4. Fill out the new project form with a Name of ssh-recording-project and Description of Secure Socket Handling recordings. Click Save.

Create a host catalog

You can use a dynamic host catalog to import the hosts created by Terraform into Boundary. These hosts will be used later on when configuring an SSH target.

1. Select Host Catalogs from the left navigation panel.

2. Choose New.

3. Enter aws-recording-catalog in the Name field, and enter a description of aws session recording host catalog.

4. Select the Dynamic type. Select the AWS provider, and enter the following details:

   • AWS Region: <YOUR_AWS_REGION>
   • Access Key ID: <YOUR_host_catalog_access_key_id>
   • Secret Access Key: <YOUR_host_catalog_secret_access_key>

   The host_catalog_access_key_id and host_catalog_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

   Open the shell session where Terraform was deployed, and execute the following:

   $ export HOST_CATALOG_ACCESS_KEY_ID=$(jq -r ".outputs.host_catalog_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "HOST_CATALOG_ACCESS_KEY_ID=$HOST_CATALOG_ACCESS_KEY_ID" ; \  export HOST_CATALOG_SECRET_ACCESS_KEY=$(jq -r ".outputs.host_catalog_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "HOST_CATALOG_SECRET_ACCESS_KEY=$HOST_CATALOG_SECRET_ACCESS_KEY"

   Copy these values into their fields.

   Lastly, check the box beside Disable credential rotation.

5. Click Save.

Create the dev host set

A host set can be used to sort hosts by environment.

Start by creating a host set for the dev hosts.

1. Select the Host Sets tab, and then select New.

2. Enter dev_host_set in the Name field.

3. Next, define the instances that should belong to the dev host set. This can be done by examining the instance tags, which are printed in the Terraform output:

   $ make terraform_output.........target_instance_tags = {  "i-04e6118b9e7ec37c7" = tomap({    "Name" = "boundary-host-2"    "User" = "aws_username"    "env" = "prod"    "workspace" = "username"  })  "i-0c3debf71c8a67661" = tomap({    "Name" = "boundary-host-1"    "User" = "aws_username"    "env" = "dev"    "workspace" = "username"  })}.........

   Notice the instance tagged as "env" = "dev".

   To select it for the host set, enter the following in the Filter field:

   tag:env=dev

4. Click Save.

5. Click the Hosts tab, and verify that the boundary-host-1 host appears as expected. If it's missing, wait a few moments and refresh the page.

Create the prod host set

Next, create a host set for the prod hosts.

1. Navigate back to the aws-recording-catalog host catalog. Click Manage, and select New Host Set.

2. Enter prod_host_set in the Name field.

3. Define the instances that should belong to the prod host set by selecting the instance tagged as "env" = "prod".

   To select it for the host set, enter the following in the Filter field,

   tag:env=prod

4. Click Save.

5. Click the Hosts tab, and verify that the boundary-host-2 host appears as expected. If it's missing, wait a few moments and refresh the page.

Create a credential store

Next, create a Vault credential store within Boundary using the VAULT_CRED_STORE_TOKEN value, defined when you set up Vault. The vault credential store type is used for Vault integration, but you can also use static credential stores with credential injection.

When you set up a worker, it's important to create a filter for the credential store. A worker filter will identify workers that should be used as proxies for the new credential store, and ensure these credentials are brokered from the private Vault.

Navigate to the global scope within the UI, and select the Workers page.

Select vault-worker, and notice its Worker Tags:

"type" = ["s3", "vault", "worker"]

With the tags and VAULT_CRED_STORE_TOKEN value, set up a new credential store.

1. Navigate back to the ssh-recording-org, and select the ssh-recording-project.

2. Select the Credential Stores page, and click New.

3. Enter the Name Vault AWS Host Credentials.

4. Select the type Vault, and enter the following details:

   • Address: <YOUR_VAULT_ADDR>
   • Worker Filter: "vault" in "/tags/type"
   • Token: <YOUR_VAULT_CRED_STORE_TOKEN>

   The VAULT_ADDR and VAULT_CRED_STORE_TOKEN values were exported as environment variables when executing make vault_init in the Write policies and create a client token section. Check their values in the terminal session used to apply Terraform:

   $ echo $VAULT_ADDR; echo $VAULT_CRED_STORE_TOKEN

   Copy these values into their fields.

5. Click Save.

Create a credential library

A credential library is used to determine what credentials should be accessed from Vault, and the path to query for them.

Create a new credential library of type ssh_private_key within Boundary using the credential store ID and passing the vault-path of secret/data/ssh_host.

To gather the CRED_STORE_ID, navigate to the Credential Stores page within the ssh-recording-project, and copy the Vault AWS Host Credentials credential store ID (such as csvlt_CixM26cMMn).

Return to the shell session used to deploy Terraform and log in to Boundary using your admin credentials. These were set as environment variables at the beginning of the tutorial as BOUNDARY_USERNAME and BOUNDARY_PASSWORD.

$ boundary authenticatePlease enter the login name (it will be hidden):Please enter the password (it will be hidden):Authentication information:  Account ID:      acctpw_byMkJ6gu9n  Auth Method ID:  ampw_AQSr776Hnm  Expiration Time: Tue, 26 Sep 2023 13:09:05 MDT  User ID:         u_IwFxiyB0I8The token was successfully stored in the chosen keyring and is not displayed here.

Next, create the credential library.

$ boundary credential-libraries create vault-generic \  -credential-store-id YOUR_CRED_STORE_ID \  -vault-path "secret/data/ssh_host" \  -name "vault-cred-library" \  -credential-type ssh_private_key

Example output:

$ boundary credential-libraries create vault-generic \  -credential-store-id csvlt_CixM26cMMn \  -vault-path "secret/data/ssh_host" \  -name "vault-cred-library" \  -credential-type ssh_private_keyCredential Library information:  Created Time:          Tue, 19 Sep 2023 13:09:29 MDT  Credential Store ID:   csvlt_CixM26cMMn  ID:                    clvlt_64hCzmT2yG  Name:                  vault-cred-library  Type:                  vault-generic  Updated Time:          Tue, 19 Sep 2023 13:09:29 MDT  Version:               1  Scope:    ID:                  p_ODNjhpjfl3    Name:                ssh-recording-project    Parent Scope ID:     o_Mk1iM4Gge8    Type:                project  Authorized Actions:    no-op    read    update    delete  Attributes:    HTTP Method:         GET    Path:                secret/data/ssh_host  Credential Type:    ssh_private_key

Open the Boundary Admin Web UI, and navigate back to the Credential Stores page.

From the Vault AWS Host Credentials host catalog, click the Credential Libraries tab. Verify that the vault-cred-library was created successfully, and click on its name to verify its details.

Open the terminal session used to deploy Terraform.

Start by logging in to Boundary as the admin user.

$ boundary authenticatePlease enter the login name (it will be hidden):Please enter the password (it will be hidden):Authentication information:  Account ID:      acctpw_VOeNSFX8pQ  Auth Method ID:  ampw_wxzojlKJLN  Expiration Time: Mon, 13 Feb 2023 12:35:32 MST  User ID:         u_1vUkf5fPs9The token was successfully stored in the chosen keyring and is not displayed here.

Set up a new org and project

Create a new org named ssh-recording-org. The following command executes boundary scopes create, prints the result, selects the org ID with jq, and stores the value as an environment variable. The jq utility is used to reduce the amount of copy-paste for IDs for the rest of this tutorial.

$ ORG_ID=$(boundary scopes create \  -scope-id=global \  -name=ssh-recording-org \  -description="SSH test org" \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "ORG_ID=$ORG_ID"

Example output:

$ ORG_ID=$(boundary scopes create \  -scope-id=global \  -name=ssh-recording-org \  -description="SSH test org" \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "ORG_ID=$ORG_ID"{"status_code":200,"item":{"id":"o_wYHjCRhcYD","scope_id":"global","scope":{"id":"global","type":"global","name":"global","description":"Global Scope"},"name":"ssh-recording-org-2","description":"SSH test org","created_time":"2023-09-19T21:36:30.134092Z","updated_time":"2023-09-19T21:36:30.134092Z","version":1,"type":"org","authorized_actions":["no-op","read","update","delete"]}}ORG_ID=o_wYHjCRhcYD

Create a new project scope named ssh-recording-project within the ssh-recording-org. The following command also exports the PROJECT_ID environment variable.

$ PROJECT_ID=$(boundary scopes create \  -scope-id=$ORG_ID \  -name=ssh-recording-project \  -description="SSH test machines" \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROJECT_ID=$PROJECT_ID"

Example output:

$ PROJECT_ID=$(boundary scopes create \  -scope-id=$ORG_ID \  -name=ssh-recording-project \  -description="SSH test machines" \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROJECT_ID=$PROJECT_ID"{"status_code":200,"item":{"id":"p_9XqgVGnMaQ","scope_id":"o_wYHjCRhcYD","scope":{"id":"o_wYHjCRhcYD","type":"org","name":"ssh-recording-org","description":"SSH test org","parent_scope_id":"global"},"name":"ssh-recording-project","description":"SSH test machines","created_time":"2023-09-19T21:44:32.166448Z","updated_time":"2023-09-19T21:44:32.166448Z","version":1,"type":"project","authorized_actions":["no-op","read","update","delete"]}}PROJECT_ID=p_9XqgVGnMaQ

Create a host catalog

You can use a dynamic host catalog to import the hosts created by Terraform into Boundary. These hosts will be used later on when configuring an SSH target.

To create a host catalog, an AWS access key ID and secret access key are required. These should be associated with a user that has the required permissions to call the DescribeInstances API. This user has been pre-configured as part of the lab environment, and its policies can be viewed in the infra/iam.tf file.

Refer to the Dynamic host catalogs on AWS tutorial to learn more.

The host_catalog_access_key_id and host_catalog_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Open the shell session where Terraform was deployed, and execute the following:

$ export HOST_CATALOG_ACCESS_KEY_ID=$(jq -r ".outputs.host_catalog_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "HOST_CATALOG_ACCESS_KEY_ID=$HOST_CATALOG_ACCESS_KEY_ID"; \  export HOST_CATALOG_SECRET_ACCESS_KEY=$(jq -r ".outputs.host_catalog_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "HOST_CATALOG_SECRET_ACCESS_KEY=$HOST_CATALOG_SECRET_ACCESS_KEY"

Create the AWS host catalog. The following command also exports the HOST_CATALOG_ID environment variable.

$ HOST_CATALOG_ID=$(boundary host-catalogs create plugin \  -scope-id $PROJECT_ID \  -plugin-name aws \  -attr disable_credential_rotation=true \  -attr region=$AWS_REGION \  -secret access_key_id=env://HOST_CATALOG_ACCESS_KEY_ID \  -secret secret_access_key=env://HOST_CATALOG_SECRET_ACCESS_KEY \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "HOST_CATALOG_ID=$HOST_CATALOG_ID"

Example output:

$ HOST_CATALOG_ID=$(boundary host-catalogs create plugin \  -scope-id $PROJECT_ID \  -plugin-name aws \  -attr disable_credential_rotation=true \  -attr region=$AWS_REGION \  -secret access_key_id=env://HOST_CATALOG_ACCESS_KEY_ID \  -secret secret_access_key=env://HOST_CATALOG_SECRET_ACCESS_KEY \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "HOST_CATALOG_ID=$HOST_CATALOG_ID"{"status_code":200,"item":{"id":"hcplg_G1Auj5onC3","scope_id":"p_9XqgVGnMaQ","scope":{"id":"p_9XqgVGnMaQ","type":"project","name":"ssh-recording-project","description":"SSH test machines","parent_scope_id":"o_wYHjCRhcYD"},"plugin_id":"pl_m8nWNSPfbY","plugin":{"id":"pl_m8nWNSPfbY","name":"aws","description":"Built-in AWS host plugin"},"created_time":"2023-09-19T23:37:58.631019Z","updated_time":"2023-09-19T23:37:58.631019Z","version":1,"type":"plugin","attributes":{"disable_credential_rotation":true,"region":"us-east-1"},"secrets_hmac":"Cfag9TcS5yVq8Dc2ApeLm4oxxVMubr5mwkreQpqFfe3k","authorized_actions":["no-op","read","update","delete"],"authorized_collection_actions":{"host-sets":["create","list"],"hosts":["list"]}}}HOST_CATALOG_ID=hcplg_G1Auj5onC3

Create the dev host set

You can use a host set to sort hosts by environment.

Start creating a host set for the dev hosts by defining the instances tagged with "env" = "dev". This can be done by examining the instance tags, which are printed in the Terraform output:

$ make terraform_output.........target_instance_tags = {  "i-04e6118b9e7ec37c7" = tomap({    "Name" = "boundary-host-2"    "User" = "aws_username"    "env" = "prod"    "workspace" = "username"  })  "i-0c3debf71c8a67661" = tomap({    "Name" = "boundary-host-1"    "User" = "aws_username"    "env" = "dev"    "workspace" = "username"  })}.........

Notice the instance tagged as "env" = "dev". To select it for the host set, you can use the following filter:

`tag:env=dev`

Next, create a host set for the dev hosts. The following command also exports the DEV_HOST_SET_ID environment variable.

$ DEV_HOST_SET_ID=$(boundary host-sets create plugin \  -name dev_host_set \  -host-catalog-id $HOST_CATALOG_ID \  -attr filters=tag:env=dev \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "DEV_HOST_SET_ID=$DEV_HOST_SET_ID"

Example output:

$ DEV_HOST_SET_ID=$(boundary host-sets create plugin \  -name dev_host_set \  -host-catalog-id $HOST_CATALOG_ID \  -attr filters=tag:env=dev \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "DEV_HOST_SET_ID=$DEV_HOST_SET_ID"{"status_code":200,"item":{"id":"hsplg_SmP0yLVJER","host_catalog_id":"hcplg_G1Auj5onC3","scope":{"id":"p_9XqgVGnMaQ","type":"project","name":"ssh-recording-project","description":"SSH test machines","parent_scope_id":"o_wYHjCRhcYD"},"plugin":{"id":"pl_m8nWNSPfbY","name":"aws","description":"Built-in AWS host plugin"},"name":"dev_host_set","created_time":"2023-09-19T23:44:21.160280Z","updated_time":"2023-09-19T23:44:21.160280Z","version":1,"type":"plugin","attributes":{"filters":["tag:env=dev"]},"authorized_actions":["no-op","read","update","delete"]}}DEV_HOST_SET_ID=hsplg_SmP0yLVJER

Verify that the new host set was created correctly:

$ boundary host-sets read -id $DEV_HOST_SET_IDHost Set information:  Created Time:        Tue, 19 Sep 2023 17:44:21 MDT  Host Catalog ID:     hcplg_G1Auj5onC3  ID:                  hsplg_SmP0yLVJER  Name:                dev_host_set  Type:                plugin  Updated Time:        Tue, 19 Sep 2023 17:44:21 MDT  Version:             2  Scope:    ID:                p_9XqgVGnMaQ    Name:              ssh-recording-project    Parent Scope ID:   o_wYHjCRhcYD    Type:              project  Plugin:    ID:                pl_m8nWNSPfbY    Name:              aws  Attributes:    filters:           [tag:env=dev]  Authorized Actions:    no-op    read    update    delete  Host IDs:    hplg_EQiYxHDgIb

Lastly, verify that the Host ID listed refers to the boundary-host-1 host:

$ boundary hosts read -id hplg_EQiYxHDgIbHost information:  Created Time:        Tue, 19 Sep 2023 17:44:21 MDT  External ID:         i-00cfc6df25a4e425f  External Name:       boundary-host-1  Host Catalog ID:     hcplg_G1Auj5onC3  ID:                  hplg_EQiYxHDgIb  Type:                plugin  Updated Time:        Tue, 19 Sep 2023 17:44:21 MDT  Version:             1  Scope:    ID:                p_9XqgVGnMaQ    Name:              ssh-recording-project    Parent Scope ID:   o_wYHjCRhcYD    Type:              project  Plugin:    ID:                pl_m8nWNSPfbY    Name:              aws  Authorized Actions:    no-op    read  Host Set IDs:    hsplg_SmP0yLVJER  IP Addresses:    10.0.47.15    3.215.142.99  DNS Names:    ec2-3-215-142-99.compute-1.amazonaws.com    ip-10-0-47-15.ec2.internal

Create the prod host set

Follow the same process for the prod hosts by defining the instances tagged with "env" = "prod".

Create a host set for the prod hosts. The following command also exports the PROD_HOST_SET_ID environment variable.

$ PROD_HOST_SET_ID=$(boundary host-sets create plugin \  -name prod_host_set \  -host-catalog-id $HOST_CATALOG_ID \  -attr filters=tag:env=prod \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROD_HOST_SET_ID=$PROD_HOST_SET_ID"

Example output:

$ PROD_HOST_SET_ID=$(boundary host-sets create plugin \  -name prod_host_set \  -host-catalog-id $HOST_CATALOG_ID \  -attr filters=tag:env=prod \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROD_HOST_SET_ID=$PROD_HOST_SET_ID"{"status_code":200,"item":{"id":"hsplg_Sv05NDr2A1","host_catalog_id":"hcplg_G1Auj5onC3","scope":{"id":"p_9XqgVGnMaQ","type":"project","name":"ssh-recording-project","description":"SSH test machines","parent_scope_id":"o_wYHjCRhcYD"},"plugin":{"id":"pl_m8nWNSPfbY","name":"aws","description":"Built-in AWS host plugin"},"name":"prod_host_set","created_time":"2023-09-19T23:50:06.376825Z","updated_time":"2023-09-19T23:50:06.376825Z","version":1,"type":"plugin","attributes":{"filters":["tag:env=prod"]},"authorized_actions":["no-op","read","update","delete"]}}PROD_HOST_SET_ID=hsplg_Sv05NDr2A1

Create a credential store

Next, set up a Vault credential store using the VAULT_CRED_STORE_TOKEN. This value was exported as an environment variable when executing make vault_init in the Write policies and create a client token section.

When creating a Vault credential store, you need to construct a worker filter. This tells Boundary which worker is deployed in the same network as Vault.

Recall the tags associated with the vault-worker:

Tags:  Configuration:    type: ["s3", "vault" "worker"]  Canonical:    type: ["worker" "vault", "s3"]

The tags for this worker are:

"type" = ["s3", "vault" "worker"]

An appropriate filter to select this worker is:

"vault" in "/tags/type"

Create the Vault credential store. The following command also exports the VAULT_CRED_STORE_ID environment variable.

$ VAULT_CRED_STORE_ID=$(boundary credential-stores create vault \  -scope-id $PROJECT_ID \  -vault-address $VAULT_ADDR \  -vault-token $VAULT_CRED_STORE_TOKEN \  -worker-filter='"vault" in "/tags/type"' \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "VAULT_CRED_STORE_ID=$VAULT_CRED_STORE_ID"

Example output:

$ VAULT_CRED_STORE_ID=$(boundary credential-stores create vault \  -scope-id $PROJECT_ID \  -vault-address $VAULT_ADDR \  -vault-token $VAULT_CRED_STORE_TOKEN \  -worker-filter='"vault" in "/tags/type"' \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "VAULT_CRED_STORE_ID=$VAULT_CRED_STORE_ID"{"status_code":200,"item":{"id":"csvlt_K9E5sXmF7s","scope_id":"p_9XqgVGnMaQ","scope":{"id":"p_9XqgVGnMaQ","type":"project","name":"ssh-recording-project","description":"SSH test machines","parent_scope_id":"o_wYHjCRhcYD"},"created_time":"2023-09-19T22:13:33.167801Z","updated_time":"2023-09-19T22:13:33.167801Z","version":1,"type":"vault","attributes":{"address":"http://ec2-3-239-162-213.compute-1.amazonaws.com:8200","token_hmac":"JU7GIHDj_MKBf6b9zXYl2A9MaMSn7UycoSBjJVmf6I8","token_status":"current","worker_filter":"\"vault\" in \"/tags/type\""},"authorized_actions":["no-op","read","update","delete"],"authorized_collection_actions":{"credential-libraries":["create","list"]}}}VAULT_CRED_STORE_ID=csvlt_K9E5sXmF7s

Create a credential library

A credential library is used to determine what credentials should be accessed from Vault, and the path to query for them.

Create a credential library at the secret/data/ssh_host Vault path. The following command also exports the VAULT_CRED_LIB_ID environment variable.

$ VAULT_CRED_LIB_ID=$(boundary credential-libraries create vault-generic \  -credential-store-id $VAULT_CRED_STORE_ID \  -vault-path "secret/data/ssh_host" \  -name "vault-cred-library" \  -credential-type ssh_private_key \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "VAULT_CRED_LIB_ID=$VAULT_CRED_LIB_ID"

Example output:

$ VAULT_CRED_LIB_ID=$(boundary credential-libraries create vault-generic \  -credential-store-id $VAULT_CRED_STORE_ID \  -vault-path "secret/data/ssh_host" \  -name "vault-cred-library" \  -credential-type ssh_private_key \  -format json | tee /dev/tty | jq -r '.item | .id') && echo "VAULT_CRED_LIB_ID=$VAULT_CRED_LIB_ID"{"status_code":200,"item":{"id":"clvlt_EcpfDBGuOl","credential_store_id":"csvlt_K9E5sXmF7s","scope":{"id":"p_9XqgVGnMaQ","type":"project","name":"ssh-recording-project","description":"SSH test machines","parent_scope_id":"o_wYHjCRhcYD"},"name":"vault-cred-library","created_time":"2023-09-19T22:18:09.092937Z","updated_time":"2023-09-19T22:18:09.092937Z","version":1,"type":"vault-generic","attributes":{"http_method":"GET","path":"secret/data/ssh_host"},"authorized_actions":["no-op","read","update","delete"],"credential_type":"ssh_private_key"}}VAULT_CRED_LIB_ID=clvlt_EcpfDBGuOl

This configuration references Terraform resources documented in the Boundary Terraform provider.

To simplify lab cleanup, create a new Terraform configuration file called boundary.tf in the top of the learn-boundary-session-rec-aws-vault/ repo. Do not place this config in the nested infra/ folder.

$ touch boundary.tf

Verify that the file was created in the correct location:

$ pwd && ls~/learn-boundary-session-rec-aws-vaultMakefile    README.md   boundary.tf infra       scripts     vault

Next, open boundary.tf in your text editor.

Set up the provider

Start by defining Boundary as a required provider, and setting up the provider's input variables.

provider "boundary" {  addr                   = var.BOUNDARY_ADDR  auth_method_id         = var.BOUNDARY_AUTH_METHOD_ID  auth_method_login_name = var.BOUNDARY_USERNAME  auth_method_password   = var.BOUNDARY_PASSWORD}terraform {  required_version = ">= 1.3.0"  required_providers {    boundary = {      source  = "hashicorp/boundary",      version = ">= 1.1.9"    }  }}

Define the input variables

The following variables will be passed to Terraform, so no default values are required. Define all these variables within the boundary.tf config file.

variable "BOUNDARY_ADDR" {    type = string}variable "BOUNDARY_AUTH_METHOD_ID" {    type = string}variable "BOUNDARY_USERNAME" {    type = string}variable "BOUNDARY_PASSWORD" {    type = string}variable "HOST_CATALOG_ACCESS_KEY_ID" {    type = string}variable "HOST_CATALOG_SECRET_ACCESS_KEY" {    type = string}variable "AWS_REGION" {    type = string}variable "VAULT_ADDR" {    type = string}variable "VAULT_CRED_STORE_TOKEN" {    type = string}variable "recording_bucket_name" {    type = string}variable "recording_storage_user_access_key_id" {    type = string}variable "recording_storage_user_secret_access_key" {    type = string}

Next, locate the values of the following input variables used by the provider, including:

• BOUNDARY_ADDR
• BOUNDARY_AUTH_METHOD_ID
• BOUNDARY_USERNAME
• BOUNDARY_PASSWORD
• AWS_REGION
• VAULT_ADDR
• VAULT_CRED_STORE_TOKEN

Locate the following values in your shell session:

$ echo $BOUNDARY_ADDR ; \  echo $BOUNDARY_AUTH_METHOD_ID ; \  echo $BOUNDARY_USERNAME ; \  echo $BOUNDARY_PASSWORD ; \  echo $AWS_REGION ; \  echo $VAULT_ADDR ; \  echo $VAULT_CRED_STORE_TOKEN

All of the variables except the BOUNDARY_AUTH_METHOD_ID were previously defined.

You can locate the admin password auth method ID using the CLI or the Admin Web UI.

$ boundary authenticate

$ boundary auth-methods listAuth Method information:  ID:                     ampw_AQSr776Hnm    Version:              1    Type:                 password    Name:                 password    Description:          Password auth method    Is Primary For Scope: true    Authorized Actions:      no-op      read      update      delete      authenticate

Create a new file called boundary.tfvars in ~/learn-boundary-session-rec-aws-vault. This file is used to pass the required variables to Terraform.

AWS_REGION = "<YOUR_AWS_REGION>"BOUNDARY_ADDR = "<YOUR_BOUNDARY_ADDR>"BOUNDARY_USERNAME = "<YOUR_ADMIN_USERNAME>"BOUNDARY_PASSWORD = "<YOUR_ADMIN_PASSWORD>"BOUNDARY_AUTH_METHOD_ID = "<YOUR_AUTH_METHOD_ID>"BOUNDARY_CLUSTER_ID = "<YOUR_CLUSTER_ID>"VAULT_ADDR = "<YOUR_VAULT_ADDR>"VAULT_CRED_STORE_TOKEN = "<YOUR_VAULT_CRED_STORE_TOKEN>"

The following variables will also be defined later on:

• HOST_CATALOG_ACCESS_KEY_ID
• HOST_CATALOG_SECRET_ACCESS_KEY
• recording_bucket_name
• recording_storage_user_access_key_id
• recording_storage_user_secret_access_key

Set up a new org and project

Define the global scope ID, then create a new org named ssh-recording-org with an associated password auth method.

resource "boundary_scope" "global" {  global_scope = true  scope_id     = "global"}resource "boundary_scope" "org" {  name        = "ssh-recording-org"  description = "SSH test org"  scope_id    = boundary_scope.global.id  auto_create_admin_role   = true  auto_create_default_role = true}resource "boundary_auth_method_password" "password" {  name        = "org_password_auth"  description = "Password auth method for org"  type        = "password"  scope_id    = boundary_scope.org.id}

Create a new project scope named ssh-recording-project within the ssh-recording-org.

resource "boundary_scope" "ssh" {  name                   = "ssh-recording-project"  description            = "Secure Socket Handling recordings"  scope_id               = boundary_scope.org.id  auto_create_admin_role = true}

Create a host catalog

You can use a dynamic host catalog to import the hosts created by Terraform into Boundary. These hosts will be used later on when configuring an SSH target.

To create a host catalog, an AWS access key ID and secret access key are required. These should be associated with a user that has the required permissions to call the DescribeInstances API. This user has been pre-configured as part of the lab environment, and its policies can be viewed in the infra/iam.tf file.

Refer to the Dynamic host catalogs on AWS tutorial to learn more.

The host_catalog_access_key_id and host_catalog_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Open the shell session where Terraform was deployed, and execute the following:

$ export HOST_CATALOG_ACCESS_KEY_ID=$(jq -r ".outputs.host_catalog_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "HOST_CATALOG_ACCESS_KEY_ID=$host_catalog_access_key_id"; \  export HOST_CATALOG_SECRET_ACCESS_KEY=$(jq -r ".outputs.host_catalog_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "HOST_CATALOG_SECRET_ACCESS_KEY=$host_catalog_secret_access_key"

Copy these values and define them in your boundary.tfvars file.

HOST_CATALOG_ACCESS_KEY_ID = "<YOUR_HOST_CATALOG_ACCESS_KEY_ID>"HOST_CATALOG_SECRET_ACCESS_KEY = "<YOUR_HOST_CATALOG_SECRET_ACCESS_KEY>"

Next, return to the boundary.tf configuration file.

Set up a host catalog plugin of type aws. Pass the AWS_REGION and disable_credential_rotation as JSON attributes, and the host catalog access key ID and secret access key as JSON secrets.

resource "boundary_host_catalog_plugin" "aws_hosts" {  name            = "aws-recording-catalog"  description     = "AWS session recording host catalog"  scope_id        = boundary_scope.ssh.id  plugin_name     = "aws"  attributes_json = jsonencode({    "region"=var.AWS_REGION,    "disable_credential_rotation"=true,  })  secrets_json = jsonencode({    "access_key_id"     = var.HOST_CATALOG_ACCESS_KEY_ID,    "secret_access_key" = var.HOST_CATALOG_SECRET_ACCESS_KEY  })}

Create the dev host set

You can use a host set to sort hosts by environment.

Start by creating a host set for the dev hosts by defining the instances tagged with "env" = "dev". This can be done by examining the instance tags, which are printed in the Terraform output:

$ make terraform_output.........target_instance_tags = {  "i-04e6118b9e7ec37c7" = tomap({    "Name" = "boundary-host-2"    "User" = "aws_username"    "env" = "prod"    "workspace" = "username"  })  "i-0c3debf71c8a67661" = tomap({    "Name" = "boundary-host-1"    "User" = "aws_username"    "env" = "dev"    "workspace" = "username"  })}.........

Notice the instance tagged as "env" = "dev". To select it for the host set, use the following filter:

`tag:env=dev`

Now create a host set for the dev hosts using the filter.

resource "boundary_host_set_plugin" "dev" {  name            = "dev_host_set"  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id  attributes_json = jsonencode({ "filters" = ["tag:env=dev"] })}

Create the prod host set

Follow the same process for the prod hosts by defining the instances tagged with "env" = "prod".

Create a host set for the prod hosts.

resource "boundary_host_set_plugin" "prod" {  name            = "prod_host_set"  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id  attributes_json = jsonencode({ "filters" = ["tag:env=prod"] })}

Create a credential store

Next, set up a Vault credential store using the VAULT_CRED_STORE_TOKEN and VAULT_ADDR. This value was exported as an environment variable when executing make vault_init in the Write policies and create a client token section.

When you create a Vault credential store, you need to construct a worker filter. The worker filter tells Boundary which worker is deployed in the same network as Vault.

Recall the tags associated with the vault-worker:

Tags:  Configuration:    type: ["s3", "vault" "worker"]  Canonical:    type: ["worker" "vault", "s3"]

The tags for this worker are:

"type" = ["s3", "vault" "worker"]

An appropriate filter to select this worker is:

"vault" in "/tags/type"

Create the Vault credential store.

resource "boundary_credential_store_vault" "vault_host_cred_store" {  name        = "Vault AWS Host Credentials"  address     = var.VAULT_ADDR  token       = var.VAULT_CRED_STORE_TOKEN  scope_id    = boundary_scope.ssh.id}

Create a credential library

A credential library is used to determine what credentials should be accessed from Vault, and the path to query for them.

Create a credential library associated with the vault_host_cred_store credential store at the secret/data/ssh_host Vault path.

resource "boundary_credential_library_vault" "vault_host_cred_library" {  name                = "Vault AWS Host Cred Library"  credential_store_id = boundary_credential_store_vault.vault_host_cred_store.id  credential_type     = "ssh_private_key"  path                = "secret/data/ssh_host" # change to Vault backend path  http_method         = "GET"}

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, Amazon S3. You must create a Boundary storage bucket associated with an external store before enabling session recording.

1. Navigate to to the global scope, and then the Storage Buckets page.

2. Click New Storage Bucket. Fill out the following details:

   • Name: ssh-test-bucket
   • Scope: ssh-recording-org
   • Bucket name: YOUR_S3_BUCKET_NAME
   • Region: YOUR_AWS_REGION
   • Access key ID: YOUR_recording_storage_user_access_key_id
   • Secret access key: YOUR_recording_storage_user_secret_access_key
   • Worker filter: "s3" in "/tags/type"

   The recording_storage_user_access_key_id and recording_storage_user_secret_access_key values are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

   Additionally, the name of the Amazon S3 bucket is required from the Terraform outputs.

   Open the shell session where Terraform was deployed, and execute the following:

   $ export recording_bucket_name=$(jq -r ".outputs.recording_bucket_name.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_bucket_name=$recording_bucket_name"; \  echo "AWS_REGION=$AWS_REGION"; \  export recording_storage_user_access_key_id=$(jq -r ".outputs.recording_storage_user_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_storage_user_access_key_id=$recording_storage_user_access_key_id"; \  export recording_storage_user_secret_access_key=$(jq -r ".outputs.recording_storage_user_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_storage_user_secret_access_key=$recording_storage_user_secret_access_key"

   Copy these values into their fields.

   For the Worker Filter, a worker with access to the S3 storage bucket is needed. A public S3 bucket is used for this tutorial, meaning any worker will have access. In the case of a private S3 bucket, a worker with appropriate network access should be deployed and registered with Boundary, then entered here.

   Select the worker tagged with "type" = ["s3", "vault", "worker"], which also provides access to Vault. The following filter will select this worker:

   "s3" in "/tags/type"

   Lastly, check the box next to Disable credential rotation.

3. Click Save.

Create an SSH target

To finish setting up recordings, create a target for the boundary-host-1 host.

1. Navigate to the Targets page within ssh-recording-project and click New.

2. Fill out the New Target form. Select a Type of SSH.

   • Name: dev-recording-target
   • Type: SSH
   • Default Port: 22
   • Maximum Connections: -1

3. Click Save.

4. Click the Workers tab for the new target.

5. Next to Egress workers, click Edit worker filter.

   An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

   Recall the tags associated with the aws-worker-1, which provides access to the boundary-host-1 host:

   Tags:  Configuration:    type: ["worker1" "dev-worker" "s3"]  Canonical:    type: ["dev-worker" "s3" "worker"]

   The tags for this worker are:

   "type" = ["worker1", "dev-worker", "s3"]

   An appropriate filter to select this worker is:

   "dev-worker" in "/tags/type"
   • Egress worker filter: "dev-worker" in "/tags/type"

   Paste the filter expression in and click Save.

Now associate dev-recording-target with dev-host-set.

1. Select the Host Sources tab for dev-recording-target.

2. Click Add Host Sources.

3. Check the box next to the host set named dev_host_set, then click Add Host Sources.

Now associate the SSH target with the Vault credential library.

1. Select the Injected Application Credentials tab for dev-recording-target.

2. Click +Add Injected Application Credentials.

3. Check the box next to the credential library named vault-cred-library, then click Add Injected Application Credentials.

Enable session recording

Finally, enable session recording for the dev-recording-target.

1. Navigate back to the dev-recording-target Details page.

2. Under Session Recording, click Enable recording.

3. On the Enable Session Recording for Target page, toggle the switch next to Record sessions for this target.

4. For the AWS storage buckets, select the ssh-test-bucket.

5. Click Save.

Under the dev-recording-target Details page, the ssh-test-bucket should now be listed under Session Recording.

Optionally, you may repeat the process with a new prod-recording-target. This target should be configured like the dev target, but should use the "prod-worker" in "/tags/type" worker filter instead. You can use the same storage bucket for both targets.

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, Amazon S3. You must create a Boundary storage bucket associated with an external store before enabling session recording.

The following details are needed to set up a Boundary storage bucket:

• Name: ssh-test-bucket
• Scope: ssh-recording-org
• Bucket name: YOUR_S3_BUCKET_NAME
• Region: YOUR_AWS_REGION
• Access key ID: YOUR_recording_storage_user_access_key_id
• Secret access key: YOUR_recording_storage_user_secret_access_key
• Worker filter: "s3" in "/tags/type"

The recording_storage_user_access_key_id and recording_storage_user_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Additionally, the name of the Amazon S3 bucket is required from the Terraform outputs.

Open the shell session where Terraform was deployed, and execute the following to display these values:

$ export recording_bucket_name=$(jq -r ".outputs.recording_bucket_name.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_bucket_name=$recording_bucket_name"; \  echo "AWS_REGION=$AWS_REGION"; \  export recording_storage_user_access_key_id=$(jq -r ".outputs.recording_storage_user_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_storage_user_access_key_id=$recording_storage_user_access_key_id"; \  export recording_storage_user_secret_access_key=$(jq -r ".outputs.recording_storage_user_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_storage_user_secret_access_key=$recording_storage_user_secret_access_key"

For the Worker Filter, a worker with access to the S3 storage bucket is needed. A public S3 bucket is used for this tutorial, meaning any worker will have access. In the case of a private S3 bucket, a worker with appropriate network access should be deployed and registered with Boundary, then entered here.

Select the worker tagged with "type" = ["s3", "vault", "worker"], which also provides access to Vault. The following filter will select this worker:

"s3" in "/tags/type"

Create a new storage bucket named ssh-test-bucket. Set the plugin name to aws, the AWS bucket name, and the worker filter. Pass the AWS_REGION and disable_credential_rotation=true as attributes, and the access_key_id and secret_access_key as secrets.

$ boundary storage-buckets create -scope-id $ORG_ID \  -name "ssh-test-bucket" \  -plugin-name aws \  -bucket-name $recording_bucket_name \  -worker-filter '"s3" in "/tags/type"' \  -attributes "{\"region\":\"${AWS_REGION}\", \"disable_credential_rotation\":true}" \  -secrets "{\"access_key_id\":\"${recording_storage_user_access_key_id}\", \"secret_access_key\":\"${recording_storage_user_secret_access_key}\"}"

Example output:

$ boundary storage-buckets create -scope-id $ORG_ID \  -name "ssh-test-bucket" \  -plugin-name aws \  -bucket-name $recording_bucket_name \  -worker-filter '"s3" in "/tags/type"' \  -attributes "{\"region\":\"${AWS_REGION}\", \"disable_credential_rotation\":true}" \  -secrets "{\"access_key_id\":\"${recording_storage_user_access_key_id}\", \"secret_access_key\":\"${recording_storage_user_secret_access_key}\"}"Storage Bucket information:  Bucket Name:                   demobucket591735460  Created Time:                  Wed, 20 Sep 2023 03:31:06 MDT  ID:                            sb_nzFv30oX2E  Name:                          ssh-test-bucket  Plugin ID:                     pl_m8nWNSPfbY  Secrets HMAC:                  3bQqPTK4ehJNKiuWkxuQEyPBJaPR5jxCnKQaRo4VTD1s  Updated Time:                  Wed, 20 Sep 2023 03:31:06 MDT  Version:                       1  Worker Filter:                 "s3" in "/tags/type"  Scope:    ID:                          o_JgJNBHHKro    Name:                        ssh-recording-org    Parent Scope ID:             global    Type:                        org  Plugin:    ID:                          pl_m8nWNSPfbY    Name:                        aws  Attributes:    Region:                      us-east-1    disable_credential_rotation: true  Authorized Actions:    no-op    read    update    delete

Copy the ID from the output and export it as the $STORAGE_BUCKET_ID variable.

$ export STORAGE_BUCKET_ID=sb_nzFv30oX2E

$ export STORAGE_BUCKET_ID=`boundary storage-buckets create -scope-id $ORG_ID -name "ssh-test-bucket" -plugin-name aws -bucket-name $recording_bucket_name -worker-filter '"s3" in "/tags/type"' -attributes "{\"region\":\"${AWS_REGION}\", \"disable_credential_rotation\":true}" -secrets "{\"access_key_id\":\"${recording_storage_user_access_key_id}\", \"secret_access_key\":\"${recording_storage_user_secret_access_key}\"}" -format json | jq -r '.item.id'`

Create an SSH target

To finish setting up recordings, create a target for the boundary-host-1 host.

An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

Recall the tags associated with the aws-worker-1, which provides access to the boundary-host-1 host:

Tags:  Configuration:    type: ["worker1" "dev-worker"]  Canonical:    type: ["dev-worker" "worker"]

The tags for this worker are:

"type" = ["worker1", "dev-worker"]

An appropriate filter to select this worker is:

"dev-worker" in "/tags/type"

Create a new target of type ssh named dev-recording-target. Set the default port to 22, enable session recording, and pass the storage bucket ID and egress worker filter.

$ boundary targets create ssh -scope-id $PROJECT_ID \  -name "dev-recording-target" \  -session-connection-limit -1 \  -default-port 22 \  -egress-worker-filter '"dev-worker" in "/tags/type"' \  -storage-bucket-id=$STORAGE_BUCKET_ID \  -enable-session-recording=true

Example output:

$ boundary targets create ssh -scope-id $PROJECT_ID \  -name "dev-recording-target" \  -session-connection-limit -1 \  -default-port 22 \  -egress-worker-filter '"dev-worker" in "/tags/type"' \  -storage-bucket-id=$STORAGE_BUCKET_ID \  -enable-session-recording=trueTarget information:  Created Time:               Tue, 19 Sep 2023 21:39:01 MDT  Egress Worker Filter:       "dev-worker" in "/tags/type"  ID:                         tssh_vO60a7TwpI  Name:                       dev-recording-target  Session Connection Limit:   -1  Session Max Seconds:        28800  Type:                       ssh  Updated Time:               Tue, 19 Sep 2023 21:39:01 MDT  Version:                    1  Scope:    ID:                       p_9XqgVGnMaQ    Name:                     ssh-recording-project    Parent Scope ID:          o_wYHjCRhcYD    Type:                     project  Authorized Actions:    no-op    read    update    delete    add-host-sources    set-host-sources    remove-host-sources    add-credential-sources    set-credential-sources    remove-credential-sources    authorize-session  Attributes:    Default Port:             22    Enable Session Recording: true    Storage Bucket ID:        sb_uQdsdZkWTO

Copy the ID from the output and export it as the $TARGET_ID variable.

$ export TARGET_ID=tssh_vO60a7TwpI

$ export TARGET_ID=`boundary targets create ssh -scope-id $PROJECT_ID -name "dev-recording-target" -session-connection-limit -1 -default-port 22 -egress-worker-filter '"dev-worker" in "/tags/type"' -storage-bucket-id=$STORAGE_BUCKET_ID -enable-session-recording=true -format json | jq -r '.item.id'`

Next, add the dev-host-set as a host source for dev-recording-target.

$ boundary targets add-host-sources -id $TARGET_ID -host-source $DEV_HOST_SET_IDTarget information:  Created Time:               Tue, 19 Sep 2023 21:39:01 MDT  Egress Worker Filter:       "dev-worker" in "/tags/type"  ID:                         tssh_vO60a7TwpI  Name:                       dev-recording-target  Session Connection Limit:   -1  Session Max Seconds:        28800  Type:                       ssh  Updated Time:               Tue, 19 Sep 2023 22:28:54 MDT  Version:                    3  Scope:    ID:                       p_9XqgVGnMaQ    Name:                     ssh-recording-project    Parent Scope ID:          o_wYHjCRhcYD    Type:                     project  Authorized Actions:    no-op    read    update    delete    add-host-sources    set-host-sources    remove-host-sources    add-credential-sources    set-credential-sources    remove-credential-sources    authorize-session  Host Sources:    Host Catalog ID:          hcplg_G1Auj5onC3    ID:                       hsplg_SmP0yLVJER  Attributes:    Default Port:             22    Enable Session Recording: true    Storage Bucket ID:        sb_uQdsdZkWTO

Now associate dev-recording-target with the Vault credential library.

$ boundary targets add-credential-sources -id $TARGET_ID -injected-application-credential-source $VAULT_CRED_LIB_IDTarget information:  Created Time:               Tue, 19 Sep 2023 21:39:01 MDT  Egress Worker Filter:       "dev-worker" in "/tags/type"  ID:                         tssh_vO60a7TwpI  Name:                       dev-recording-target  Session Connection Limit:   -1  Session Max Seconds:        28800  Type:                       ssh  Updated Time:               Tue, 19 Sep 2023 22:31:31 MDT  Version:                    5  Scope:    ID:                       p_9XqgVGnMaQ    Name:                     ssh-recording-project    Parent Scope ID:          o_wYHjCRhcYD    Type:                     project  Authorized Actions:    no-op    read    update    delete    add-host-sources    set-host-sources    remove-host-sources    add-credential-sources    set-credential-sources    remove-credential-sources    authorize-session  Host Sources:    Host Catalog ID:          hcplg_G1Auj5onC3    ID:                       hsplg_SmP0yLVJER  Injected Application Credential Sources:    Credential Store ID:      csvlt_6QOHpmciXI    ID:                       clvlt_jt5ZuKAPpq  Attributes:    Default Port:             22    Enable Session Recording: true    Storage Bucket ID:        sb_uQdsdZkWTO

The SSH target now has a host source, injected credentials, and a storage bucket configured. Session recording is fully enabled.

Optionally, you may repeat the process with a new prod-recording-target. This target should be configured like the dev target, but should use the "prod-worker" in "/tags/type" worker filter instead. The same storage bucket can be used for both targets.

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, Amazon S3. You must create a Boundary storage bucket associated with an external store before enabling session recording.

To create a storage bucket, the following details are required:

• Name: ssh-test-bucket
• Scope: ssh-recording-org
• Bucket name: YOUR_recording_bucket_name
• Region: YOUR_AWS_REGION
• Access key ID: YOUR_recording_storage_user_access_key_id
• Secret access key: YOUR_recording_storage_user_secret_access_key
• Worker filter: "s3" in "/tags/type"

The recording_storage_user_access_key_id and recording_storage_user_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Additionally, the name of the Amazon S3 bucket is required from the Terraform outputs.

Open the shell session where Terraform was deployed, and execute the following to display these values and export them as environment variables:

$ export recording_bucket_name=$(jq -r ".outputs.recording_bucket_name.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_bucket_name=$recording_bucket_name"; \  echo "AWS_REGION=$AWS_REGION"; \  export recording_storage_user_access_key_id=$(jq -r ".outputs.recording_storage_user_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_storage_user_access_key_id=$recording_storage_user_access_key_id"; \  export recording_storage_user_secret_access_key=$(jq -r ".outputs.recording_storage_user_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \  echo "recording_storage_user_secret_access_key=$recording_storage_user_secret_access_key"

Copy these values and define them in your boundary.tfvars file.

recording_bucket_name = "<YOUR_recording_bucket_name>"recording_storage_user_access_key_id = "<YOUR_storage_user_access_key_id>"recording_storage_user_secret_access_key = "<YOUR_storage_user_secret_access_key>"

Save the boundary.tfvars file.

For the Worker Filter, a worker with access to the S3 storage bucket is needed. A public S3 bucket is used for this tutorial, meaning any worker will have access. In the case of a private S3 bucket, a worker with appropriate network access should be deployed and registered with Boundary, then entered here.

Select the worker tagged with "type" = ["s3", "vault", "worker"], which also provides access to Vault. The following filter will select this worker:

"s3" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"s3\" in \"/tags/type\""

Create a new storage bucket with a plugin_name of aws and pass in the recording_bucket_name. Pass the AWS_REGION and disable_credential_rotation=trueas a JSON attributes, and the recording_storage_user_access_key_id and recording_storage_user_secret_access_key as JSON secrets. Lastly, supply the worker filter.

resource "boundary_storage_bucket" "aws_bucket" {  name            = "ssh-test-bucketw"  description     = "SSH session recording test bucket"  scope_id        = boundary_scope.org.id  plugin_name     = "aws"  bucket_name     = var.recording_bucket_name  attributes_json = jsonencode({    "region" = "${var.AWS_REGION}",    "disable_credential_rotation" = true  })  secrets_json = jsonencode({    "access_key_id"     = "${var.recording_storage_user_access_key_id}",    "secret_access_key" = "${var.recording_storage_user_secret_access_key}"  })  worker_filter = "\"s3\" in \"/tags/type\""}

Create an SSH target

To finish setting up recordings, create a target for the boundary-host-1 host.

An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

Recall the tags associated with the aws-worker-1, which provides access to the boundary-host-1 host:

Tags:  Configuration:    type: ["worker1" "dev-worker"]  Canonical:    type: ["dev-worker" "worker"]

The tags for this worker are:

"type" = ["worker1", "dev-worker"]

An appropriate filter to select this worker is:

"dev-worker" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"dev-worker\" in \"/tags/type\""

Create a new target with the following parameters:

• type: ssh
• name: dev-recording-target
• default_port: 22
• egress_worker_filter: "\"dev-worker\" in \"/tags/type\""
• host_source_ids: [boundary_host_set_plugin.dev.id]
• injected_application_credential_source_ids = [boundary_credential_library_vault.vault_host_cred_library.id]
• enable_session_recording: true
• storage_bucket_it: boundary_storage_bucket.aws_bucket

resource "boundary_target" "ssh" {  name         = "dev-recording-target"  description  = "SSH target"  type         = "ssh"  default_port = "22"  scope_id     = boundary_scope.ssh-recording-project.id  egress_worker_filter     = "\"dev-worker\" in \"/tags/type\""  host_source_ids = [    boundary_host_set_plugin.dev.id  ]  injected_application_credential_source_ids = [    boundary_credential_library_vault.vault_host_cred_library.id  ]  enable_session_recording = true  storage_bucket_id        = boundary_storage_bucket.aws_bucket.id}

Once all the Boundary provider resources have been added, save this file.

Expand the accordion below to see a completed version of the Terraform configuration files for Boundary. For reference, an example of these files with all resources commented out is also included with the lab repository, at learn-boundary-session-rec-aws-vault/boundary-example.tf and learn-boundary-session-rec-aws-vault/boundary-example.tfvars.

provider "boundary" {  addr                   = var.BOUNDARY_ADDR  auth_method_id         = var.BOUNDARY_AUTH_METHOD_ID  auth_method_login_name = var.BOUNDARY_USERNAME  auth_method_password   = var.BOUNDARY_PASSWORD}terraform {  required_version = ">= 1.3.0"  required_providers {    boundary = {      source  = "hashicorp/boundary",      version = ">= 1.1.9"    }  }}variable "BOUNDARY_ADDR" {    type = string}variable "BOUNDARY_AUTH_METHOD_ID" {    type = string}variable "BOUNDARY_USERNAME" {    type = string}variable "BOUNDARY_PASSWORD" {    type = string}variable "HOST_CATALOG_ACCESS_KEY_ID" {    type = string}variable "HOST_CATALOG_SECRET_ACCESS_KEY" {    type = string}variable "AWS_REGION" {    type = string}variable "VAULT_ADDR" {    type = string}variable "VAULT_CRED_STORE_TOKEN" {    type = string}variable "recording_bucket_name" {    type = string}variable "recording_storage_user_access_key_id" {    type = string}variable "recording_storage_user_secret_access_key" {    type = string}resource "boundary_scope" "global" {  global_scope = true  scope_id     = "global"}resource "boundary_scope" "org" {  name        = "ssh-recording-org"  description = "SSH test org"  scope_id    = boundary_scope.global.id  auto_create_admin_role   = true  auto_create_default_role = true}resource "boundary_auth_method_password" "password" {  name        = "org_password_auth"  description = "Password auth method for org"  type        = "password"  scope_id    = boundary_scope.org.id}resource "boundary_scope" "ssh-recording-project" {  name                   = "ssh-recording-project"  description            = "Secure Socket Handling recordings"  scope_id               = boundary_scope.org.id  auto_create_admin_role = true}resource "boundary_host_catalog_plugin" "aws_hosts" {  name            = "aws-recording-catalog"  description     = "AWS session recording host catalog"  scope_id        = boundary_scope.ssh-recording-project.id  plugin_name     = "aws"  attributes_json = jsonencode({    "region"=var.AWS_REGION,    "disable_credential_rotation"=true,  })  secrets_json = jsonencode({    "access_key_id"     = var.HOST_CATALOG_ACCESS_KEY_ID,    "secret_access_key" = var.HOST_CATALOG_SECRET_ACCESS_KEY  })}resource "boundary_host_set_plugin" "dev" {  name            = "dev_host_set"  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id  attributes_json = jsonencode({ "filters" = ["tag:env=dev"] })}resource "boundary_host_set_plugin" "prod" {  name            = "prod_host_set"  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id  attributes_json = jsonencode({ "filters" = ["tag:env=prod"] })}resource "boundary_credential_store_vault" "vault_host_cred_store" {  name        = "Vault AWS Host Credentials"  address     = var.VAULT_ADDR  token       = var.VAULT_CRED_STORE_TOKEN  scope_id    = boundary_scope.ssh-recording-project.id}resource "boundary_credential_library_vault" "vault_host_cred_library" {  name                = "Vault AWS Host Cred Library"  credential_store_id = boundary_credential_store_vault.vault_host_cred_store.id  credential_type     = "ssh_private_key"  path                = "secret/data/ssh_host"  http_method         = "GET"}resource "boundary_storage_bucket" "aws_bucket" {  name            = "ssh-test-bucket"  description     = "SSH session recording test bucket"  scope_id        = boundary_scope.org.id  plugin_name     = "aws"  bucket_name     = var.recording_bucket_name  attributes_json = jsonencode({    "region" = "${var.AWS_REGION}",    "disable_credential_rotation" = true  })  secrets_json = jsonencode({    "access_key_id"     = "${var.recording_storage_user_access_key_id}",    "secret_access_key" = "${var.recording_storage_user_secret_access_key}"  })  worker_filter = "\"s3\" in \"/tags/type\""}resource "boundary_target" "ssh" {  name         = "dev-recording-target"  description  = "SSH target"  type         = "ssh"  default_port = "22"  scope_id     = boundary_scope.ssh-recording-project.id  egress_worker_filter     = "\"dev-worker\" in \"/tags/type\""  host_source_ids = [    boundary_host_set_plugin.dev.id  ]  injected_application_credential_source_ids = [    boundary_credential_library_vault.vault_host_cred_library.id  ]  enable_session_recording = true  storage_bucket_id        = boundary_storage_bucket.aws_bucket.id}

AWS_REGION = "<YOUR_AWS_REGION>"BOUNDARY_ADDR = "<YOUR_BOUNDARY_ADDR>"BOUNDARY_USERNAME = "<YOUR_ADMIN_USERNAME>"BOUNDARY_PASSWORD = "<YOUR_ADMIN_PASSWORD>"BOUNDARY_AUTH_METHOD_ID = "<YOUR_AUTH_METHOD_ID>"BOUNDARY_CLUSTER_ID = "<YOUR_CLUSTER_ID>"HOST_CATALOG_ACCESS_KEY_ID = "<YOUR_HOST_CATALOG_ACCESS_KEY_ID>"HOST_CATALOG_SECRET_ACCESS_KEY = "<YOUR_HOST_CATALOG_SECRET_ACCESS_KEY>"VAULT_ADDR = "<YOUR_VAULT_ADDR>"VAULT_CRED_STORE_TOKEN = "<YOUR_VAULT_CRED_STORE_TOKEN>"recording_bucket_name = "<YOUR_recording_bucket_name>"recording_storage_user_access_key_id = "<YOUR_storage_user_access_key_id>"recording_storage_user_secret_access_key = "<YOUR_storage_user_secret_access_key>"