HashiConf 2025 Don't miss the live stream of HashiConf Day 2 happening now View live stream
Boundary Home

You are viewing documentation for version v0.21.x. View latest version.

Storage buckets

Enterprise

This feature requires HCP Boundary Plus or Boundary Enterprise.

A storage bucket stores session recordings in an external object store. A storage bucket's name is optional, but it must be unique if you define one. Storage buckets can be associated with zero to many targets.

Storage buckets exist in either the Global scope or an Org scope:

  • A storage bucket in the Global scope can be associated with any target.
  • A storage bucket in an Org scope can only be associated with targets in a project from the same Org scope. Boundary deletes any storage buckets associated with an Org scope when that Org is deleted.

Deleting a storage bucket in Boundary does not delete the bucket or its recordings from the external object store. The storage bucket's lifecycle does not affect the external object store bucket or its contents. When you delete a storage bucket, Boundary also deletes any session recording metadata associated with it.

You can configure storage buckets on Amazon S3, MinIO, and some S3-compliant cloud vendors.

Attributes

A storage bucket has the following configurable attributes:

  • name - (Optional) The name of the resource in Boundary. The name is optional, but if you set it, it must be unique within the scope ID.
  • description - (Optional) A description of the resource.
  • bucket_name - (Required) The name of the bucket in the external object store.
  • bucket_prefix - (Optional) The prefix used to organize the data that is stored in the external object store.
  • plugin_name - (Required) The plugin name must reference an installed plugin.
  • worker_filter - (Required) A filter to identify the worker or workers that can process requests for the storage bucket.
  • attributes - (Optional) A collection of fields the plugin uses to interface with the backing service.
  • secrets - (Optional) A collection of sensitive fields, like credentials, which the plugin uses to interface with the backing service. These fields are write only.

AWS S3 attributes and secrets

In AWS S3, a storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the secret key.

The AWS S3 storage bucket can use static or dynamic credentials. You can configure static credentials using an access key and secret key or dynamic credentials using the AWS AssumeRole API.

Attributes

AWS S3 buckets have the following attributes. The role_arn, role_external_id, role_session_name, and role_tags attributes apply when you use dynamic credentials.

  • region - (Required) The S3 region to configure the storage bucket in.
  • disable_credential_rotation - (Optional for static credentials, Required for dynamic credentials) If set to true, credential rotation is not performed. By default, the AWS plugin rotates credentials. The disable_credential_rotation attribute is required when you use dynamic credentials.
  • role_arn - (Optional) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on. The Role ARN is required if the AWS S3 bucket is configured to use dynamic credentials using AssumeRole.
  • role_external_id - (Optional) Required when you delegate third-party access to your AWS resources. For more information, refer to the AWS documentation for How to use an external ID when granting access to your AWS resources to a third party.
  • role_session_name - (Optional) A unique identifier for the AWS session. You can use the role_external_id value to control how IAM principals and applications name their role sessions when they assume an IAM role. A session name lets you track session actions in AWS CloudTrail logs. For more information, refer to the AWS documentation for Logging IAM and AWS STS API calls with AWS CloudTrail.
  • role_tags - (Optional) An object with key-value pair attributes that is passed when you assume an IAM role. For more information, refer to the AWS documentation for Passing session tags in AWS STS.

Secrets

AWS S3 buckets can have the following secrets:

  • access_key_id - (Optional) The access key ID for the IAM user to use with this storage bucket. Access keys are required if the AWS S3 bucket is configured to use static credentials.
  • secret_access_key - (Optional) The secret access key for the IAM user to use with this storage bucket. Secret access keys are required if the AWS S3 bucket is configured to use static credentials.

MinIO/S3-compliant attributes and secrets

A MinIO or S3-compliant storage bucket contains the bucket name, endpoint URL, and an optional region, as well as any credentials needed to access the bucket, such as the access key ID and secret access key.

S3-compliant storage providers use the MinIO plugin. Set plugin_name to minio for both MinIO and S3-compliant storage buckets.

The MinIO plugin supports only static credentials. It does not support dynamic credentials or temporary credentials that require a session token.

Attributes

MinIO and S3-compliant buckets have the following attributes:

  • endpoint_url - (Required) Fully-qualified endpoint pointing to a MinIO S3 or S3-compliant API. The URL must begin with http:// or https://. The plugin uses TLS to connect to endpoints that begin with https://.

  • region - (Optional) The region to configure the storage bucket for.

  • disable_credential_rotation - (Optional) Controls whether the plugin rotates the incoming credentials and manages a new service account. If you set the disable_credential_rotation attribute to false or omit it, the plugin rotates the incoming credentials to create a new service account, then deletes the incoming credentials.

    Credential rotation uses MinIO admin APIs, so it fails on S3-compliant providers that do not implement them. You must set the disable_credential_rotation attribute to true for Hitachi Content Platform.

Secrets

MinIO and S3-compliant buckets require the following secrets:

  • access_key_id - (Required) The service account's access key to use with this storage bucket.
  • secret_access_key - (Required) The service account's secret key to use with this storage bucket.

Referenced by

Service API docs

The following services are relevant to this resource:

Edit this page on GitHub