Create a storage bucket

As of Boundary 0.13.0, you can record and audit user sessions. A Boundary resource known as a storage bucket is used to store the recorded sessions. The storage bucket represents a bucket in an external store. Before you can enable session recording, you must create one or more storage buckets in Boundary and associate them with the external store.

A storage bucket can only belong to the Global scope or an Org scope. A storage bucket that is associated with the Global scope can be associated with any target. However, a storage bucket in an Org scope can only be associated with targets in a project from the same Org scope. Any storage buckets associated with an Org scope are deleted when the Org itself is deleted.

For more information about using session recording to audit user sessions, refer to Auditing.

Requirements

Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements. Session recording requires specific configuration for both the external store and the Boundary worker. At this time, the only supported storage is AWS S3.

AWS requirements

• An AWS S3 storage bucket

  You must associate the Boundary storage bucket with an AWS S3 storage bucket. An AWS S3 storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the access and secret key.

• An AWS IAM role policy with the following statement:

   {
     "Version": "2012-10-17",
     "Statement": [
        {
           "Action": [
              "s3:PutObject",
              "s3:GetObject",
              "s3:GetObjectAttributes"
           ],
           "Effect": "Allow",
           "Resource": "arn:aws:s3:::session_recording_storage/foo/bar/zoo/*"
        },
        {
           "Action": [
              "iam:DeleteAccessKey",
              "iam:GetUser",
              "iam:CreateAccessKey"
           ],
           "Effect": "Allow",
           "Resource": "arn:aws:iam::123456789012:user/JohnDoe"
        }
     ]
  }
  
  

• If you apply KMS encryption to the storage bucket, you must add these additional permissions to the role policy for the storage bucket's IAM user:

  {
     "Action": [
     "kms:Decrypt",
     "kms:GenerateDataKey",
     "kms:DescribeKey"
     ],
     "Effect": "Allow",
     "Resource": "arn:aws:kms:us-east-1:1234567890:key/uuid"
  }
  

  The following is an example working policy with KMS encryption configured on the S3 bucket:

  {
    "Version": "2012-10-17",
    "Statement": [
       {
          "Sid": "S3Permissions",
          "Effect": "Allow",
          "Action": [
             "s3:PutObject",
             "s3:GetObject",
             "s3:GetObjectAttributes"
          ],
          "Resource": [
             "arn:aws:s3:::test-session-recording-bucket/*"
          ]
       },
       {
          "Sid": "UserPermissions",
          "Effect": "Allow",
          "Action": [
             "iam:DeleteAccessKey",
             "iam:GetUser",
             "iam:CreateAccessKey"
          ],
          "Resource": [
             "arn:aws:iam::1234567890:user/test-boundary"
          ]
       },
       {
          "Sid": "KMSPermissions",
          "Effect": "Allow",
          "Action": [
             "kms:Decrypt",
             "kms:GenerateDataKey",
             "kms:DescribeKey"
          ],
          "Resource": [
             "arn:aws:kms:us-east-2:1234567890:key/4b887395-c376-4936-8f37-80c592ea582c"
          ]
       }
    ]
  }
  
  

Boundary workers requirements

Session recording requires at least one PKI worker that:

• Has access to the AWS S3 storage bucket
• Has an accessible directory defined by recording_storage_path for storing session recordings while they are in progress. On session closure, Boundary moves the local session recording to remote storage and deletes the local copy. For more details, refer to PKI workers.
• Has at least 1 MB of available disk space.
• Runs Darwin, Windows, or Linux. The following binaries are not supported for session recording: NetBSD, OpenBSD, Solaris.

Development example:

worker {
auth_storage_path="/boundary/demo-worker-1"
initial_upstreams = ["10.0.0.1"]
recording_storage_path="/local/storage/directory"
}

Complete the following steps to create a storage bucket in Boundary for session recording:

Boundary creates the storage bucket resource and provides you with the bucket's ID. Once the storage bucket is created in Boundary, you can use the bucket's ID to enable session recording on targets.