What is Boundary?

HashiCorp Boundary is an identity-based access management tool that provides secure, authenticated access to servers, databases, applications, and other cloud or on-premises infrastructure without requiring users to access the underlying network directly. It centralizes access control, uses identity providers to authenticate users, applies role-based permissions, and creates auditable sessions while keeping sensitive credentials and network details protected.

With Boundary you can:

• Enforce just-in-time and least privilege network access
• Streamline user access to approved target applications, services and other private resources
• Enable passwordless access to simplfy user connection experience and prevent credential exposure
• Generate short-lived dynamic credentials via HashiCorp Vault
• Automate discovery, onboarding, offboarding, and updates of target systems
• Record, playback, and manage privileged sessions
• Standardize your team's access workflow with a consistent experience for any type of hyrbid cloud infrastructure across any provider

How does Boundary work?

Boundary provides secure access to hosts and critical systems without distributing credentials, configuring firewalls, or exposing the organization's private network. Traditionally, for users to access their resources, it's required that organizations establish and maintain SSH bastion hosts and VPNs.

The illustration below displays Boundary's core workflow.

The core Boundary workflow consists of four stages:

• User Authentication: The user logs in with a trusted identity (based on the rules and policies) with a trust identity platform such as Azure Active Directory, Okta, Ping, or any other trust identity platforms supporting OpenID Connect.
• Granular Authorization: Boundary authenticates and authorizes users based on their roles and logical services, and tightly controls access to target systems.
• User-preferred client tools: Users connect using existing client tools (command-line SSH client, PuTTY, Remote Desktop, database clients, web browsers, and others) without changing workflows.
• Access: Boundary streamlines access by proxing connection into private network and injecting credentials onto target systems for passwordless experience.

Which edition of Boundary is right for me?

• HCP Boundary: a managed Boundary offering with commercial features. HashiCorp hosts Boundary's control plane and you have the option of running private proxies (called Boundary workers) within your environment.
• Boundary Enterprise: a self-managed Boundary offering with full feature parity to HCP Boundary.

If you're not sure which edition is right for you, we recommend HCP Boundary because it simplfies and reduces deployment operations.

Regardless of which server edition of Boundary you use, all editions require the same Desktop and CLI clients, which you can download from the Install Boundary downloads page.

Get started

Refer to the Boundary tutorials to learn how to set up, configure, and administer Boundary.

Community

We welcome questions and suggestions from the community.

• Ask questions in HashiCorp Discuss.
• Submit an issue for bugs and feature requests.