Enable session recording with AWS and Vault

Start by logging in to HCP Boundary within the terminal.

1. Log in to the HCP portal.

2. From the HCP Portal's Boundary page, click Open Admin UI - a new page will open.

3. Enter the admin username and password you created when you deployed the new instance and click Authenticate.

Next, set up a new testing org and project scope.

1. Navigate to the Orgs page and click New Org.

2. Fill out the new org form with a Name of recording-org and Description of Session recording test org. Click Save.

3. From within the new org, click New Project.

4. Fill out the new project form with a Name of recording-project and Description of SSH and RDP recording testing. Click Save.

Create a host catalog

You can use a dynamic host catalog to import the hosts created by Terraform into Boundary. These hosts will be used later on when configuring an SSH target.

1. Select Host Catalogs from the left navigation panel.

2. Choose New.

3. Enter aws-recording-catalog in the Name field, and enter a description of aws session recording host catalog.

4. Select the Dynamic type. Select the AWS provider, and enter the following details:

   • AWS Region: <YOUR_AWS_REGION>
   • Access Key ID: <YOUR_host_catalog_access_key_id>
   • Secret Access Key: <YOUR_host_catalog_secret_access_key>

   The host_catalog_access_key_id and host_catalog_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

   Open the shell session where Terraform was deployed, and execute the following:

   $ export HOST_CATALOG_ACCESS_KEY_ID=$(jq -r ".outputs.host_catalog_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
     echo "HOST_CATALOG_ACCESS_KEY_ID=$HOST_CATALOG_ACCESS_KEY_ID" ; \
     export HOST_CATALOG_SECRET_ACCESS_KEY=$(jq -r ".outputs.host_catalog_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
     echo "HOST_CATALOG_SECRET_ACCESS_KEY=$HOST_CATALOG_SECRET_ACCESS_KEY"
   

   Copy these values into their fields.

   Lastly, check the box beside Disable credential rotation.

5. Click Save.

Create the SSH host set

A host set can be used to sort hosts by environment, target type, or any other catalog you want to implement.

Start by creating a host set for the SSH host.

1. Select the Host Sets tab, and then select New.

2. Enter ssh_host_set in the Name field.

3. Next, define the instance that should belong to the ssh host set. This can be done by examining the instance tags, which are printed in the Terraform output:

   $ make terraform_output
   ...
   ...
   ...
   ssh_target_instance_tags = {
     "i-03d7e0370f00e005b" = tomap({
       "Name" = "ssh-host-user@test.com"
       "User" = "user@test.com"
       "env" = "prod"
       "platform" = "linux"
       "protocol" = "ssh"
       "workspace" = "test"
     })
   }
   ...
   ...
   ...
   

   Notice the instance tagged as "protocol" = "ssh".

   To select it for the host set, enter the following in the Filter field:

   tag:protocol=ssh
   

4. Click Save.

5. Click the Hosts tab, and verify that the ssh-host host appears as expected. If it's missing, wait a few moments and refresh the page.

Create the RDP host set

Next, create a host set for the RDP host.

1. Navigate back to the aws-recording-catalog host catalog. Click Manage, and select New Host Set.

2. Enter rdp_host_set in the Name field.

3. Define the instances that should belong to the RDP host set by selecting the instance tagged as "protocol" = "rdp".

   To select it for the host set, enter the following in the Filter field,

   tag:protocol=rdp
   

4. Click Save.

5. Click the Hosts tab, and verify that the ssh-host host appears as expected. If it's missing, wait a few moments and refresh the page.

Create a credential store

Next, create a Vault credential store within Boundary using the VAULT_CRED_STORE_TOKEN value, defined when you set up Vault. The vault credential store type is used for Vault integration, but you can also use static credential stores with credential injection.

When you set up a worker, it's important to create a filter for the credential store. A worker filter will identify workers that should be used as proxies for the new credential store, and ensure these credentials are brokered from the private Vault.

Navigate to the global scope within the UI, and select the Workers page.

Select aws-vault-worker, and notice its Worker Tags:

"type" = ["s3", "vault", "worker"]

With the tags and VAULT_CRED_STORE_TOKEN value, set up a new credential store.

1. Navigate back to the recording-org, and select the recording-project.

2. Select the Credential Stores page, and click New.

3. Enter the Name Vault AWS Host Credentials.

4. Select the type Vault, and enter the following details:

   • Address: <YOUR_VAULT_ADDR>
   • Worker Filter: "vault" in "/tags/type"
   • Token: <YOUR_VAULT_CRED_STORE_TOKEN>

   The VAULT_ADDR and VAULT_CRED_STORE_TOKEN values were exported as environment variables when executing make vault_init in the Write policies and create a client token section. Check their values in the terminal session used to apply Terraform:

   $ echo $VAULT_ADDR; echo $VAULT_CRED_STORE_TOKEN
   

   Copy these values into their fields.

5. Click Save.

Create the credential libraries

A credential library is used to determine what credentials should be accessed from Vault, and the path to query for them.

Create the SSH credential library

Create a new credential library of type ssh_private_key within Boundary using the credential store ID and passing the vault-path of secret/data/ssh_host.

1. Navigate back to the recording-org, and select the recording-project.

2. Select the Credential Stores page, and click on the Vault AWS Host Credentials credential store.

3. Click the Credential Libraries tab, then click New Credential Library.

4. Enter the Name Vault SSH Host Cred Library, and enter the following details:

   • Type: Generic Secrets
   • Vault Path: secret/data/ssh_host
   • Credential Type: SSH Private Key
   • HTTP Method: Get

   The Vault Path is defined in the scripts/setup.sh file when you executed make vault_init. The Vault policy for these paths is defined in the vault/kv-read.hcl file, which allows for read access to the secret path.

5. Click Save.

Navigate back to the Credential Stores page.

From the Vault AWS Host Credentials host catalog, click the Credential Libraries tab. Verify that the Vault SSH Host Cred Library was created successfully, and click on its name to verify its details.

Create the RDP credential library

Create a new credential library of type Username and Password within Boundary using the credential store ID and passing the vault-path of secret/data/rdp_host.

1. Navigate back to the recording-org, and select the recording-project.

2. Select the Credential Stores page, and click on the Vault AWS Host Credentials credential store.

3. Click the Credential Libraries tab, then click the Manage dropdown. Select New Credential Library.

4. Enter the Name Vault RDP Host Cred Library, and enter the following details:

   • Type: Generic Secrets
   • Vault Path: secret/data/rdp_host
   • Credential Type: Username and Password
   • HTTP Method: Get

5. Click Save.

Navigate back to the Credential Stores page.

From the Vault AWS Host Credentials host catalog, click the Credential Libraries tab. Verify that the Vault RDP Host Cred Library was created successfully, and click on its name to verify its details.

Open the terminal session used to deploy Terraform.

Start by logging in to Boundary as the admin user.

$ boundary authenticate
Please enter the login name (it will be hidden):
Please enter the password (it will be hidden):
Authentication information:
  Account ID:      acctpw_VOeNSFX8pQ
  Auth Method ID:  ampw_wxzojlKJLN
  Expiration Time: Mon, 13 July 2026 12:35:32 MST
  User ID:         u_1vUkf5fPs9
The token was successfully stored in the chosen keyring and is not displayed here.

Set up a new org and project

Create a new org named recording-org. The following command executes boundary scopes create, prints the result, selects the org ID with jq, and stores the value as an environment variable. The jq utility is used to reduce the amount of copy-paste for IDs for the rest of this tutorial.

$ ORG_ID=$(boundary scopes create \
  -scope-id=global \
  -name=recording-org \
  -description="Session recording test org" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "ORG_ID=$ORG_ID"

Example output:

$ ORG_ID=$(boundary scopes create \
  -scope-id=global \
  -name=recording-org \
  -description="Session recording test org" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "ORG_ID=$ORG_ID"
{"status_code":200,"item":{"id":"o_FLId90vAvh","scope_id":"global","scope":{"id":"global","type":"global","name":"global","description":"Global Scope"},"name":"recording-org","description":"Session recording test org","created_time":"2026-07-21T23:34:58.886435Z","updated_time":"2026-07-21T23:34:58.886435Z","version":1,"type":"org","authorized_actions":["delete","attach-storage-policy","detach-storage-policy","set-alias-suffix","remove-alias-suffix","no-op","read","update"]}}
ORG_ID=o_FLId90vAvh

Create a new project scope named recording-project within the recording-org. The following command also exports the PROJECT_ID environment variable.

$ PROJECT_ID=$(boundary scopes create \
  -scope-id=$ORG_ID \
  -name=recording-project \
  -description="Session recording test org" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROJECT_ID=$PROJECT_ID"

Example output:

$ PROJECT_ID=$(boundary scopes create \
  -scope-id=$ORG_ID \
  -name=recording-project \
  -description="Boundary session recordings" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROJECT_ID=$PROJECT_ID"
{"status_code":200,"item":{"id":"p_8aMSXdsg2b","scope_id":"o_FLId90vAvh","scope":{"id":"o_FLId90vAvh","type":"org","name":"recording-org","description":"Session recording test org","parent_scope_id":"global"},"name":"recording-project","description":"Session recording test org","created_time":"2026-07-21T23:35:24.259707Z","updated_time":"2026-07-21T23:35:24.259707Z","version":1,"type":"project","authorized_actions":["delete","set-alias-suffix","remove-alias-suffix","no-op","read","update"],"authorized_collection_actions":{"aliases":["create","list"],"credential-stores":["create","list"],"groups":["create","list"],"host-catalogs":["create","list"],"roles":["create","list"],"scopes":["list-keys","rotate-keys","list-key-version-destruction-jobs","destroy-key-version"],"sessions":["list"],"targets":["create","list"]}}}
PROJECT_ID=p_8aMSXdsg2b

Create a host catalog

You can use a dynamic host catalog to import the hosts created by Terraform into Boundary. These hosts will be used later on when configuring an SSH target.

To create a host catalog, an AWS access key ID and secret access key are required. These should be associated with a user that has the required permissions to call the DescribeInstances API. This user has been pre-configured as part of the lab environment, and its policies can be viewed in the infra/iam.tf file.

Refer to the Dynamic host catalogs on AWS tutorial to learn more.

The host_catalog_access_key_id and host_catalog_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Open the shell session where Terraform was deployed, and execute the following:

$ export HOST_CATALOG_ACCESS_KEY_ID=$(jq -r ".outputs.host_catalog_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "HOST_CATALOG_ACCESS_KEY_ID=$HOST_CATALOG_ACCESS_KEY_ID"; \
  export HOST_CATALOG_SECRET_ACCESS_KEY=$(jq -r ".outputs.host_catalog_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "HOST_CATALOG_SECRET_ACCESS_KEY=$HOST_CATALOG_SECRET_ACCESS_KEY"

Create the AWS host catalog. The following command also exports the HOST_CATALOG_ID environment variable.

$ HOST_CATALOG_ID=$(boundary host-catalogs create plugin \
  -scope-id $PROJECT_ID \
  -plugin-name aws \
  -attr disable_credential_rotation=true \
  -attr region=$AWS_REGION \
  -secret access_key_id=env://HOST_CATALOG_ACCESS_KEY_ID \
  -secret secret_access_key=env://HOST_CATALOG_SECRET_ACCESS_KEY \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "HOST_CATALOG_ID=$HOST_CATALOG_ID"

Example output:

$ HOST_CATALOG_ID=$(boundary host-catalogs create plugin \
  -scope-id $PROJECT_ID \
  -plugin-name aws \
  -attr disable_credential_rotation=true \
  -attr region=$AWS_REGION \
  -secret access_key_id=env://HOST_CATALOG_ACCESS_KEY_ID \
  -secret secret_access_key=env://HOST_CATALOG_SECRET_ACCESS_KEY \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "HOST_CATALOG_ID=$HOST_CATALOG_ID"
{"status_code":200,"item":{"id":"hcplg_Rx7olVcjDQ","scope_id":"p_8aMSXdsg2b","scope":{"id":"p_8aMSXdsg2b","type":"project","name":"recording-project","description":"Session recording test org","parent_scope_id":"o_FLId90vAvh"},"plugin_id":"pl_HxZCh1wAO4","plugin":{"id":"pl_HxZCh1wAO4","name":"aws","description":"Built-in AWS host plugin"},"created_time":"2026-07-21T23:36:36.654852Z","updated_time":"2026-07-21T23:36:36.654852Z","version":1,"type":"plugin","attributes":{"disable_credential_rotation":true,"region":"us-east-1"},"secrets_hmac":"6aDDdRrxFUg5KXNf7TujTB5gjQ5EpFBtjsQd45RnTpPJ","authorized_actions":["no-op","read","update","delete"],"authorized_collection_actions":{"host-sets":["create","list"],"hosts":["list"]}}}
HOST_CATALOG_ID=hcplg_Rx7olVcjDQ

Create the SSH host set

You can use a host set to sort hosts by environment.

Start creating a host set for the dev hosts by defining the instances tagged with "protocol" = "ssh". This can be done by examining the instance tags, which are printed in the Terraform output:

$ make terraform_output
...
...
...
target_instance_tags = {
  "i-03d7e0370f00e005b" = tomap({
    "Name" = "ssh-host-user@test.com"
    "User" = "user@test.com"
    "protocol" = "rdp"
    "platform" = "linux"
    "protocol" = "ssh"
    "workspace" = "test"
  })
...
...
...

Notice the instance tagged as "protocol" = "ssh". To select it for the host set, you can use the following filter:

`tag:protocol=ssh`

Next, create a host set for the dev hosts. The following command also exports the SSH_HOST_SET_ID environment variable.

$ SSH_HOST_SET_ID=$(boundary host-sets create plugin \
  -name ssh_host_set \
  -host-catalog-id $HOST_CATALOG_ID \
  -attr filters=tag:protocol=ssh \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "SSH_HOST_SET_ID=$SSH_HOST_SET_ID"

Example output:

$ SSH_HOST_SET_ID=$(boundary host-sets create plugin \
  -name ssh_host_set \
  -host-catalog-id $HOST_CATALOG_ID \
  -attr filters=tag:protocol=ssh \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "SSH_HOST_SET_ID=$SSH_HOST_SET_ID"
{"status_code":200,"item":{"id":"hsplg_zFoBUqcQE3","host_catalog_id":"hcplg_Rx7olVcjDQ","scope":{"id":"p_8aMSXdsg2b","type":"project","name":"recording-project","description":"Session recording test org","parent_scope_id":"o_FLId90vAvh"},"plugin":{"id":"pl_HxZCh1wAO4","name":"aws","description":"Built-in AWS host plugin"},"name":"ssh_host_set","created_time":"2026-07-21T23:38:23.030237Z","updated_time":"2026-07-21T23:38:23.030237Z","version":1,"type":"plugin","attributes":{"filters":["tag:protocol=ssh"]},"authorized_actions":["no-op","read","update","delete"]}}
SSH_HOST_SET_ID=hsplg_zFoBUqcQE3

Verify that the new host set was created correctly:

$ boundary host-sets read -id $SSH_HOST_SET_ID

Host Set information:
  Created Time:        Tue, 21 Jul 2026 17:38:23 MDT
  Host Catalog ID:     hcplg_Rx7olVcjDQ
  ID:                  hsplg_zFoBUqcQE3
  Name:                ssh_host_set
  Type:                plugin
  Updated Time:        Tue, 21 Jul 2026 17:38:23 MDT
  Version:             2

  Scope:
    ID:                p_8aMSXdsg2b
    Name:              recording-project
    Parent Scope ID:   o_FLId90vAvh
    Type:              project

  Plugin:
    ID:                pl_HxZCh1wAO4
    Name:              aws

  Attributes:
    filters:           [tag:protocol=ssh]

  Authorized Actions:
    read
    update
    delete
    no-op

  Host IDs:
    hplg_SeKyx6aYgJ

Lastly, verify that the Host ID listed refers to the ssh-host host:

$ boundary hosts read -id hplg_SeKyx6aYgJ

Host information:
  Created Time:        Tue, 21 Jul 2026 17:38:23 MDT
  External ID:         i-03d7e0370f00e005b
  External Name:       ssh-host-user@test.com
  Host Catalog ID:     hcplg_Rx7olVcjDQ
  ID:                  hplg_SeKyx6aYgJ
  Type:                plugin
  Updated Time:        Tue, 21 Jul 2026 17:38:23 MDT
  Version:             1

  Scope:
    ID:                p_8aMSXdsg2b
    Name:              recording-project
    Parent Scope ID:   o_FLId90vAvh
    Type:              project

  Plugin:
    ID:                pl_HxZCh1wAO4
    Name:              aws

  Authorized Actions:
    no-op
    read

  Host Set IDs:
    hsplg_zFoBUqcQE3

  IP Addresses:
    10.0.200.201
    32.197.42.xxx

  DNS Names:
    ec2-32-197-42-xxx.compute-1.amazonaws.com
    ip-10-0-200-201.ec2.internal

Create the RDP host set

Follow the same process for the prod hosts by defining the instances tagged with "protocol" = "rdp".

Create a host set for the prod hosts. The following command also exports the RDP_HOST_SET_ID environment variable.

$ RDP_HOST_SET_ID=$(boundary host-sets create plugin \
  -name rdp_host_set \
  -host-catalog-id $HOST_CATALOG_ID \
  -attr filters=tag:protocol=rdp \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_HOST_SET_ID=$RDP_HOST_SET_ID"

Example output:

$ RDP_HOST_SET_ID=$(boundary host-sets create plugin \
  -name rdp_host_set \
  -host-catalog-id $HOST_CATALOG_ID \
  -attr filters=tag:protocol=rdp \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_HOST_SET_ID=$RDP_HOST_SET_ID"
{"status_code":200,"item":{"id":"hsplg_hL9m5aCvrJ","host_catalog_id":"hcplg_Rx7olVcjDQ","scope":{"id":"p_8aMSXdsg2b","type":"project","name":"recording-project","description":"Session recording test org","parent_scope_id":"o_FLId90vAvh"},"plugin":{"id":"pl_HxZCh1wAO4","name":"aws","description":"Built-in AWS host plugin"},"name":"rdp_host_set","created_time":"2026-07-21T23:41:12.246266Z","updated_time":"2026-07-21T23:41:12.246266Z","version":1,"type":"plugin","attributes":{"filters":["tag:protocol=rdp"]},"authorized_actions":["update","delete","no-op","read"]}}
RDP_HOST_SET_ID=hsplg_hL9m5aCvrJ

Create a credential store

Next, set up a Vault credential store using the VAULT_CRED_STORE_TOKEN. This value was exported as an environment variable when executing make vault_init in the Write policies and create a client token section.

When creating a Vault credential store, you need to construct a worker filter. This tells Boundary which worker is deployed in the same network as Vault.

Recall the tags associated with the vault-worker:

Tags:
  Configuration:
    type: ["s3", "vault" "worker"]
  Canonical:
    type: ["worker" "vault", "s3"]

The tags for this worker are:

"type" = ["s3", "vault" "worker"]

An appropriate filter to select this worker is:

"vault" in "/tags/type"

Create the Vault credential store. The following command also exports the VAULT_CRED_STORE_ID environment variable.

$ VAULT_CRED_STORE_ID=$(boundary credential-stores create vault \
  -scope-id $PROJECT_ID \
  -vault-address $VAULT_ADDR \
  -vault-token $VAULT_CRED_STORE_TOKEN \
  -worker-filter='"vault" in "/tags/type"' \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "VAULT_CRED_STORE_ID=$VAULT_CRED_STORE_ID"

Example output:

$ VAULT_CRED_STORE_ID=$(boundary credential-stores create vault \
  -scope-id $PROJECT_ID \
  -vault-address $VAULT_ADDR \
  -vault-token $VAULT_CRED_STORE_TOKEN \
  -worker-filter='"vault" in "/tags/type"' \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "VAULT_CRED_STORE_ID=$VAULT_CRED_STORE_ID"
{"status_code":200,"item":{"id":"csvlt_8BeCahqgKg","scope_id":"p_8aMSXdsg2b","scope":{"id":"p_8aMSXdsg2b","type":"project","name":"recording-project","description":"Session recording test org","parent_scope_id":"o_FLId90vAvh"},"created_time":"2026-07-21T23:50:02.441503Z","updated_time":"2026-07-21T23:50:02.441503Z","version":1,"type":"vault","attributes":{"address":"http://ec2-35-172-236-144.compute-1.amazonaws.com:8200","token_hmac":"p_XeSXGeSx1mkvttrigOUjp-5q4rx7xev__hLAbxMkM","token_status":"current","worker_filter":"\"vault\" in \"/tags/type\""},"authorized_actions":["update","delete","no-op","read"],"authorized_collection_actions":{"credential-libraries":["list","create"]}}}
VAULT_CRED_STORE_ID=csvlt_8BeCahqgKg

Create the SSH credential library

A credential library is used to determine what credentials should be accessed from Vault, and the path to query for them.

Create an ssh_private_key type credential library at the secret/data/ssh_host Vault path. The following command also exports the SSH_CRED_LIB_ID environment variable.

$ SSH_CRED_LIB_ID=$(boundary credential-libraries create vault-generic \
  -credential-store-id $VAULT_CRED_STORE_ID \
  -vault-path "secret/data/ssh_host" \
  -name "ssh-cred-library" \
  -credential-type ssh_private_key \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "SSH_CRED_LIB_ID=$SSH_CRED_LIB_ID"

Example output:

$ SSH_CRED_LIB_ID=$(boundary credential-libraries create vault-generic \
  -credential-store-id $VAULT_CRED_STORE_ID \
  -vault-path "secret/data/ssh_host" \
  -name "ssh-cred-library" \
  -credential-type ssh_private_key \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "SSH_CRED_LIB_ID=$SSH_CRED_LIB_ID"
{"status_code":200,"item":{"id":"clvlt_KoArBsTbEN","credential_store_id":"csvlt_8BeCahqgKg","scope":{"id":"p_8aMSXdsg2b","type":"project","name":"recording-project","description":"Session recording test org","parent_scope_id":"o_FLId90vAvh"},"name":"ssh-cred-library","created_time":"2026-07-21T23:52:03.263857Z","updated_time":"2026-07-21T23:52:03.263857Z","version":1,"type":"vault-generic","attributes":{"http_method":"GET","path":"secret/data/ssh_host"},"authorized_actions":["no-op","read","update","delete"],"credential_type":"ssh_private_key"}}
SSH_CRED_LIB_ID=clvlt_KoArBsTbEN

Create the RDP credential library

Create a username_password type credential library at the secret/data/rdp_host Vault path. The following command also exports the RDP_CRED_LIB_ID environment variable.

$ RDP_CRED_LIB_ID=$(boundary credential-libraries create vault-generic \
  -credential-store-id $VAULT_CRED_STORE_ID \
  -vault-path "secret/data/rdp_host" \
  -name "rdp-cred-library" \
  -credential-type username_password \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_CRED_LIB_ID=$RDP_CRED_LIB_ID"

Example output:

$ RDP_CRED_LIB_ID=$(boundary credential-libraries create vault-generic \
  -credential-store-id $VAULT_CRED_STORE_ID \
  -vault-path "secret/data/rdp_host" \
  -name "rdp-cred-library" \
  -credential-type username_password \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_CRED_LIB_ID=$RDP_CRED_LIB_ID"
{"status_code":200,"item":{"id":"clvlt_gqE5QGV4cl","credential_store_id":"csvlt_8BeCahqgKg","scope":{"id":"p_8aMSXdsg2b","type":"project","name":"recording-project","description":"Session recording test org","parent_scope_id":"o_FLId90vAvh"},"name":"rdp-cred-library","created_time":"2026-07-21T23:55:05.466105Z","updated_time":"2026-07-21T23:55:05.466105Z","version":1,"type":"vault-generic","attributes":{"http_method":"GET","path":"secret/data/rdp_host"},"authorized_actions":["read","update","delete","no-op"],"credential_type":"username_password"}}
RDP_CRED_LIB_ID=clvlt_gqE5QGV4cl

This configuration references Terraform resources documented in the Boundary Terraform provider.

There is an example boundary-example.tf file in the learn-boundary-session-rec-aws-vault folder that you can reference as you build this config.

To simplify lab cleanup, create a new Terraform configuration file called boundary.tf in the top of the learn-boundary-session-rec-aws-vault/ repo. Do not place this config in the nested infra/ folder.

$ touch boundary.tf

Verify that the file was created in the correct location:

$ pwd && ls
~/learn-boundary-session-rec-aws-vault
Makefile    README.md   boundary.tf infra       scripts     vault

Next, open boundary.tf in your text editor.

Set up the provider

Start by defining Boundary as a required provider, and setting up the provider's input variables.

provider "boundary" {
  addr                   = var.BOUNDARY_ADDR
  auth_method_id         = var.BOUNDARY_AUTH_METHOD_ID
  auth_method_login_name = var.BOUNDARY_USERNAME
  auth_method_password   = var.BOUNDARY_PASSWORD
}

terraform {
  required_version = ">= 1.3.0"
  required_providers {
    boundary = {
      source  = "hashicorp/boundary",
      version = "1.6.0"
    }
  }
}

Define the input variables

The following variables will be passed to Terraform. Locate the values of the following input variables used by the provider, including:

• BOUNDARY_ADDR
• BOUNDARY_AUTH_METHOD_ID
• BOUNDARY_USERNAME
• BOUNDARY_PASSWORD
• AWS_REGION
• VAULT_ADDR
• VAULT_CRED_STORE_TOKEN

Locate the following values in your shell session:

$ echo $BOUNDARY_ADDR ; \
  echo $BOUNDARY_AUTH_METHOD_ID ; \
  echo $BOUNDARY_USERNAME ; \
  echo $BOUNDARY_PASSWORD ; \
  echo $AWS_REGION ; \
  echo $VAULT_ADDR ; \
  echo $VAULT_CRED_STORE_TOKEN

All of the variables except the BOUNDARY_AUTH_METHOD_ID were previously defined. You can copy them directly into your boundary.tfvars file.

You can locate the admin password auth method ID using the CLI or the Admin Web UI.

$ boundary authenticate

$ boundary auth-methods list

Auth Method information:
  ID:                     ampw_AQSr776Hnm
    Version:              1
    Type:                 password
    Name:                 password
    Description:          Password auth method
    Is Primary For Scope: true
    Authorized Actions:
      no-op
      read
      update
      delete
      authenticate

Create a new file called boundary.tfvars in ~/learn-boundary-session-rec-aws-vault. This file is used to pass the required variables to Terraform.

There is an example boundary-example.tf file in the learn-boundary-session-rec-aws-vault folder that you can reference as you build this config.

AWS_REGION = "<YOUR_AWS_REGION>"

BOUNDARY_ADDR = "<YOUR_BOUNDARY_ADDR>"

BOUNDARY_USERNAME = "<YOUR_ADMIN_USERNAME>"

BOUNDARY_PASSWORD = "<YOUR_ADMIN_PASSWORD>"

BOUNDARY_AUTH_METHOD_ID = "<YOUR_AUTH_METHOD_ID>"

BOUNDARY_CLUSTER_ID = "<YOUR_CLUSTER_ID>"

VAULT_ADDR = "<YOUR_VAULT_ADDR>"

VAULT_CRED_STORE_TOKEN = "<YOUR_VAULT_CRED_STORE_TOKEN>"

The following variables will also be defined later on:

• HOST_CATALOG_ACCESS_KEY_ID
• HOST_CATALOG_SECRET_ACCESS_KEY
• recording_bucket_name
• recording_storage_user_access_key_id
• recording_storage_user_secret_access_key

Set up a new org and project

Define the global scope ID, then create a new org named recording-org with an associated password auth method.

resource "boundary_scope" "global" {
  global_scope = true
  scope_id     = "global"
}

resource "boundary_scope" "org" {
  name        = "recording-org"
  description = "Session recording test org"
  scope_id    = boundary_scope.global.id
  auto_create_admin_role   = true
  auto_create_default_role = true
}

resource "boundary_auth_method_password" "password" {
  name        = "org_password_auth"
  description = "Password auth method for org"
  type        = "password"
  scope_id    = boundary_scope.org.id
}

resource "boundary_scope" "recording-project" {
  name                   = "recording-project"
  description            = "Boundary session recordings"
  scope_id               = boundary_scope.org.id
  auto_create_admin_role = true
}

Create a host catalog

You can use a dynamic host catalog to import the hosts created by Terraform into Boundary. These hosts will be used later on when configuring an SSH target.

To create a host catalog, an AWS access key ID and secret access key are required. These should be associated with a user that has the required permissions to call the DescribeInstances API. This user has been pre-configured as part of the lab environment, and its policies can be viewed in the infra/iam.tf file.

Refer to the Dynamic host catalogs on AWS tutorial to learn more.

The host_catalog_access_key_id and host_catalog_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Open the shell session where Terraform was deployed, and execute the following:

$ export HOST_CATALOG_ACCESS_KEY_ID=$(jq -r ".outputs.host_catalog_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "HOST_CATALOG_ACCESS_KEY_ID=$HOST_CATALOG_ACCESS_KEY_ID"; \
  export HOST_CATALOG_SECRET_ACCESS_KEY=$(jq -r ".outputs.host_catalog_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "HOST_CATALOG_SECRET_ACCESS_KEY=$HOST_CATALOG_SECRET_ACCESS_KEY"

Copy these values and define them in your boundary.tfvars file.

HOST_CATALOG_ACCESS_KEY_ID = "<YOUR_HOST_CATALOG_ACCESS_KEY_ID>"

HOST_CATALOG_SECRET_ACCESS_KEY = "<YOUR_HOST_CATALOG_SECRET_ACCESS_KEY>"

Next, return to the boundary.tf configuration file.

Set up a host catalog plugin of type aws. Pass the AWS_REGION and disable_credential_rotation as JSON attributes, and the host catalog access key ID and secret access key as JSON secrets.

resource "boundary_host_catalog_plugin" "aws_hosts" {
  name            = "aws-recording-catalog"
  description     = "AWS session recording host catalog"
  scope_id        = boundary_scope.recording-project.id
  plugin_name     = "aws"
  attributes_json = jsonencode({
    "region"=var.AWS_REGION,
    "disable_credential_rotation"=true,
  })
  secrets_json = jsonencode({
    "access_key_id"     = var.HOST_CATALOG_ACCESS_KEY_ID,
    "secret_access_key" = var.HOST_CATALOG_SECRET_ACCESS_KEY
  })
}

Create the SSH host set

You can use a host set to sort hosts by environment.

Start by creating a host set for the ssh host by defining the instance tagged with "protocol" = "ssh". This can be done by examining the instance tags, which are printed in the Terraform output:

$ make terraform_output
...
...
...
ssh_target_instance_tags = {
  "i-03d7e0370f00e005b" = tomap({
    "Name" = "ssh-host-user@test.com"
    "User" = "user@test.com"
    "env" = "prod"
    "platform" = "linux"
    "protocol" = "ssh"
    "workspace" = "test"
  })
}
...
...
...

Notice the instance is tagged with "protocol" = "ssh". To select it for the host set, use the following filter:

`tag:protocol=ssh`

Now create a host set for the dev hosts using the filter.

resource "boundary_host_set_plugin" "ssh" {
  name            = "ssh_host_set"
  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id
  attributes_json = jsonencode({ "filters" = ["tag:protocol=ssh"] })
}

Create the RDP host set

Follow the same process for the prod hosts by defining the instances tagged with "protocol" = "rdp".

Create a host set for the prod hosts.

resource "boundary_host_set_plugin" "rdp" {
  name            = "rdp_host_set"
  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id
  attributes_json = jsonencode({ "filters" = ["tag:protocol=rdp"] })
}

Create a credential store

Next, set up a Vault credential store using the VAULT_CRED_STORE_TOKEN and VAULT_ADDR. This value was exported as an environment variable when executing make vault_init in the Write policies and create a client token section.

When you create a Vault credential store, you need to construct a worker filter. The worker filter tells Boundary which worker is deployed in the same network as Vault.

Recall the tags associated with the vault-worker:

Tags:
  Configuration:
    type: ["s3", "vault" "worker"]
  Canonical:
    type: ["worker" "vault", "s3"]

The tags for this worker are:

"type" = ["s3", "vault" "worker"]

An appropriate filter to select this worker is:

"vault" in "/tags/type"

Create the Vault credential store.

resource "boundary_credential_store_vault" "vault_host_cred_store" {
  name        = "Vault AWS Host Credentials"
  address     = var.VAULT_ADDR
  token       = var.VAULT_CRED_STORE_TOKEN
  scope_id    = boundary_scope.recording-project.id
}

Create the SSH credential library

A credential library is used to determine what credentials should be accessed from Vault, and the path to query for them.

Create a credential library of type ssh_private_key associated with the ssh_host_cred_store credential store at the secret/data/ssh_host Vault path.

resource "boundary_credential_library_vault" "vault_ssh_host_cred_library" {
  name                = "Vault SSH Host Cred Library"
  credential_store_id = boundary_credential_store_vault.vault_host_cred_store.id
  credential_type     = "ssh_private_key"
  path                = "secret/data/ssh_host"
  http_method         = "GET"
}

Create the RDP credential library

Create a credential library of type username_password associated with the rdp_host_cred_store credential store at the secret/data/rdp_host Vault path.

resource "boundary_credential_library_vault" "vault_rdp_host_cred_library" {
  name                = "Vault RDP Host Cred Library"
  credential_store_id = boundary_credential_store_vault.vault_host_cred_store.id
  credential_type     = "username_password"
  path                = "secret/data/rdp_host"
  http_method         = "GET"
}

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, Amazon S3. You must create a Boundary storage bucket associated with an external store before enabling session recording.

1. Navigate to the global scope, and then the Storage Buckets page.

2. Click New Storage Bucket. Fill out the following details:

   • Name: boundary-test-bucket
   • Scope: recording-org
   • Bucket name: YOUR_S3_BUCKET_NAME
   • Region: YOUR_AWS_REGION
   • Access key ID: YOUR_recording_storage_user_access_key_id
   • Secret access key: YOUR_recording_storage_user_secret_access_key
   • Worker filter: "s3" in "/tags/type"

   The recording_storage_user_access_key_id and recording_storage_user_secret_access_key values are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

   Additionally, the name of the Amazon S3 bucket is required from the Terraform outputs.

   Open the shell session where Terraform was deployed, and execute the following:

   $ export recording_bucket_name=$(jq -r ".outputs.recording_bucket_name.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
     echo "recording_bucket_name=$recording_bucket_name"; \
     echo "AWS_REGION=$AWS_REGION"; \
     export recording_storage_user_access_key_id=$(jq -r ".outputs.recording_storage_user_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
     echo "recording_storage_user_access_key_id=$recording_storage_user_access_key_id"; \
     export recording_storage_user_secret_access_key=$(jq -r ".outputs.recording_storage_user_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
     echo "recording_storage_user_secret_access_key=$recording_storage_user_secret_access_key"
   

   Copy these values into their fields.

   For the Worker Filter, a worker with access to the S3 storage bucket is needed. A public S3 bucket is used for this tutorial, meaning any worker will have access. In the case of a private S3 bucket, a worker with appropriate network access should be deployed and registered with Boundary, then entered here.

   Select the worker tagged with "type" = ["s3", "vault", "worker"], which also provides access to Vault. The following filter will select this worker:

   "s3" in "/tags/type"
   

   Lastly, check the box next to Disable credential rotation.

3. Click Save.

Create a storage policy

A storage policy defines how long session recordings should be retained before they can be deleted. By default, recordings cannot be deleted until a storage policy allowing for it is attached to the org scope.

To delete session recordings, you must define a storage policy that allows for zero retention. In a real-world scenario, you would likely retain your recordings for an amount of time defined by your organization.

Create a storage policy that allows for immediate deletion:

1. Navigate back to the Global scope, and click on Storage Policies.

2. Click New Storage Policy.

3. Enter the following details:

   • Name: Delete Policy
   • Retention Policy: Do not protect, allow deletion any time
   • Deletion Policy: Custom
     • Delete after: 1 days

4. Click Save.

Attach the storage policy to your org:

1. Navigate back Global and click on Orgs. Select the recording-org.

2. Click on Org Settings in the left sidebar. From the Details view, click on Add Storage Policy.

3. Select the Delete Policy, and click Save.

Create an SSH target

To finish setting up recordings, create an SSH target for the ssh-host host.

1. Navigate to the Targets page within recording-project and click New.

2. Fill out the New Target form. Select a Type of SSH.

   • Name: ssh-target
   • Type: SSH
   • Default Port: 22
   • Maximum Connections: -1

3. Click Save.

4. Click the Workers tab for the new target.

5. Next to Egress workers, click Edit worker filter.

   An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

   Recall the tags associated with the aws-target-worker, which provides access to the ssh-host host:

   Tags:
     Configuration:
       env: ["dev"]
       platform: ["ubuntu"]
       protocol: ["rdp" "ssh"]
       type: ["worker" "s3" "rdp" "ssh"]
     Canonical:
       env: ["dev"]
       platform: ["ubuntu"]
       protocol: ["rdp" "ssh"]
       type: ["ssh" "worker" "s3" "rdp"]
   

   The tags for this worker include:

   type: ["worker" "s3" "rdp" "ssh"]

   An appropriate filter to select this worker is:

   "ssh" in "/tags/type"
   

   • Egress worker filter: "ssh" in "/tags/type"

   Paste the filter expression in and click Save.

Now associate ssh-target with ssh-host-set.

1. Select the Host Sources tab for ssh-target.

2. Click Add Host Sources.

3. Check the box next to the host set named ssh_host_set, then click Add Host Sources.

Now associate the SSH target with the Vault credential library.

1. Select the Injected Application Credentials tab for ssh-target.

2. Click +Add Injected Application Credentials.

3. Check the box next to the credential library named vault-cred-library, then click Add Injected Application Credentials.

Enable session recording

Finally, enable session recording for the ssh-target.

1. Navigate back to the ssh-target Details page.

2. Under Session Recording, click Enable recording.

3. On the Enable Session Recording for Target page, toggle the switch next to Record sessions for this target.

4. For the AWS storage buckets, select the boundary-test-bucket.

5. Click Save.

Under the ssh-target Details page, the boundary-test-bucket should now be listed under Session Recording.

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, Amazon S3. You must create a Boundary storage bucket associated with an external store before enabling session recording.

The following details are needed to set up a Boundary storage bucket:

• Name: boundary-test-bucket
• Scope: recording-org
• Bucket name: YOUR_S3_BUCKET_NAME
• Region: YOUR_AWS_REGION
• Access key ID: YOUR_recording_storage_user_access_key_id
• Secret access key: YOUR_recording_storage_user_secret_access_key
• Worker filter: "s3" in "/tags/type"

The recording_storage_user_access_key_id and recording_storage_user_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Additionally, the name of the Amazon S3 bucket is required from the Terraform outputs.

Open the shell session where Terraform was deployed, and execute the following to display these values:

$ export recording_bucket_name=$(jq -r ".outputs.recording_bucket_name.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "recording_bucket_name=$recording_bucket_name"; \
  echo "AWS_REGION=$AWS_REGION"; \
  export recording_storage_user_access_key_id=$(jq -r ".outputs.recording_storage_user_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "recording_storage_user_access_key_id=$recording_storage_user_access_key_id"; \
  export recording_storage_user_secret_access_key=$(jq -r ".outputs.recording_storage_user_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "recording_storage_user_secret_access_key=$recording_storage_user_secret_access_key"

For the Worker Filter, a worker with access to the S3 storage bucket is needed. A public S3 bucket is used for this tutorial, meaning any worker will have access. In the case of a private S3 bucket, a worker with appropriate network access should be deployed and registered with Boundary, then entered here.

Select the worker tagged with "type" = ["s3", "vault", "worker"], which also provides access to Vault. The following filter will select this worker:

"s3" in "/tags/type"

Create a new storage bucket named boundary-test-bucket. Set the plugin name to aws, the AWS bucket name, and the worker filter. Pass the AWS_REGION and disable_credential_rotation=true as attributes, and the access_key_id and secret_access_key as secrets.

$ boundary storage-buckets create -scope-id $ORG_ID \
  -name "boundary-test-bucket" \
  -plugin-name aws \
  -bucket-name $recording_bucket_name \
  -worker-filter '"s3" in "/tags/type"' \
  -attributes "{\"region\":\"${AWS_REGION}\", \"disable_credential_rotation\":true}" \
  -secrets "{\"access_key_id\":\"${recording_storage_user_access_key_id}\", \"secret_access_key\":\"${recording_storage_user_secret_access_key}\"}"

Example output:

$ boundary storage-buckets create -scope-id $ORG_ID \
  -name "boundary-test-bucket" \
  -plugin-name aws \
  -bucket-name $recording_bucket_name \
  -worker-filter '"s3" in "/tags/type"' \
  -attributes "{\"region\":\"${AWS_REGION}\", \"disable_credential_rotation\":true}" \
  -secrets "{\"access_key_id\":\"${recording_storage_user_access_key_id}\", \"secret_access_key\":\"${recording_storage_user_secret_access_key}\"}"

Storage Bucket information:
  Bucket Name:                   demobucket832340674
  Created Time:                  Tue, 21 Jul 2026 18:25:19 MDT
  ID:                            sb_9WOgVKg5vv
  Name:                          boundary-test-bucket
  Plugin ID:                     pl_HxZCh1wAO4
  Secrets HMAC:                  CubjDMevLw5UVkjMYbiBAhYdP5XHnzPmQYA4Fb59Ghyo
  Updated Time:                  Tue, 21 Jul 2026 18:25:19 MDT
  Version:                       1
  Worker Filter:                 "s3" in "/tags/type"

  Scope:
    ID:                          o_FLId90vAvh
    Name:                        recording-org
    Parent Scope ID:             global
    Type:                        org

  Plugin:
    ID:                          pl_HxZCh1wAO4
    Name:                        aws

  Attributes:
    Region:                      us-east-1
    disable_credential_rotation: true

  Authorized Actions:
    no-op
    read
    update
    delete

Copy the ID from the output and export it as the $STORAGE_BUCKET_ID variable.

$ export STORAGE_BUCKET_ID=sb_9WOgVKg5vv

$ export STORAGE_BUCKET_ID=`boundary storage-buckets create -scope-id $ORG_ID -name "boundary-test-bucket" -plugin-name aws -bucket-name $recording_bucket_name -worker-filter '"s3" in "/tags/type"' -attributes "{\"region\":\"${AWS_REGION}\", \"disable_credential_rotation\":true}" -secrets "{\"access_key_id\":\"${recording_storage_user_access_key_id}\", \"secret_access_key\":\"${recording_storage_user_secret_access_key}\"}" -format json | jq -r '.item.id'`

Create a storage policy

A storage policy defines how long session recordings should be retained before they can be deleted. By default, recordings cannot be deleted until a storage policy allowing for it is attached to the org scope.

To delete session recordings, you must define a storage policy that allows for zero retention. In a real-world scenario, you would likely retain your recordings for an amount of time defined by your organization.

Create a storage policy that allows for immediate deletion:

$ boundary policies create storage \
  -name "delete_policy" \
  -description "Allow session recording deletion" \
  -delete-after-days 1

Example output:

$ boundary policies create storage \
  -name "delete_policy" \
  -description "Allow session recording deletion" \
  -delete-after-days 1

Policy information:
  Created Time:        Tue, 21 Jul 2026 18:47:44 MDT
  Description:         Allow session recording deletion
  ID:                  pst_WQZEOOqYhU
  Name:                delete_policy
  Type:                storage
  Updated Time:        Tue, 21 Jul 2026 18:47:44 MDT
  Version:             1

  Scope:
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    delete
    no-op
    read
    update

  Attributes:
    Storage Deletion:
      Days:              1
      Overridable:       false

Copy the ID from the output and export it as the $STORAGE_POLICY_ID variable.

$ export STORAGE_POLICY_ID=pst_WQZEOOqYhU

$ export STORAGE_POLICY_ID=`boundary policies create storage -name "delete_policy" -description "Allow session recording deletion" -delete-after-days 1 -format json | jq -r '.item.id'`

Attach the storage policy to your org scope:

$ boundary scopes attach-storage-policy \
  -id $ORG_ID \
  -storage-policy-id $STORAGE_POLICY_ID

Example output:

$ boundary scopes attach-storage-policy \
  -id $ORG_ID \
  -storage-policy-id $STORAGE_POLICY_ID

Scope information:
  Created Time:        Tue, 21 Jul 2026 17:34:58 MDT
  Description:         Session recording test org
  ID:                  o_FLId90vAvh
  Name:                recording-org
  Storage Policy ID:   pst_WQZEOOqYhU
  Updated Time:        Tue, 21 Jul 2026 18:54:44 MDT
  Version:             2

  Scope (parent):
    ID:                global
    Name:              global
    Type:              global

  Authorized Actions:
    detach-storage-policy
    set-alias-suffix
    remove-alias-suffix
    no-op
    read
    update
    delete
    attach-storage-policy

Create an SSH target

To finish setting up recordings, create a target for the ssh-host host.

An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

Recall the tags associated with the aws-target-worker, which provides access to the ssh-host host:

Tags:
  Configuration:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["worker" "s3" "rdp" "ssh"]
  Canonical:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["ssh" "worker" "s3" "rdp"]

You could select from any of these tags:

type: ["ssh" "worker" "s3" "rdp"]

An appropriate filter to select this worker is:

"ssh" in "/tags/type"

Create a new target of type ssh named ssh-target. Set the default port to 22, enable session recording, and pass the storage bucket ID and egress worker filter.

$ boundary targets create ssh -scope-id $PROJECT_ID \
  -name "ssh-target" \
  -session-connection-limit -1 \
  -default-port 22 \
  -egress-worker-filter '"ssh" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Example output:

$ boundary targets create ssh -scope-id $PROJECT_ID \
  -name "ssh-target" \
  -session-connection-limit -1 \
  -default-port 22 \
  -egress-worker-filter '"ssh" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Target information:
  Created Time:               Tue, 21 Jul 2026 18:26:32 MDT
  Egress Worker Filter:       "ssh" in "/tags/type"
  ID:                         tssh_RJUJbYGBHd
  Name:                       ssh-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       ssh
  Updated Time:               Tue, 21 Jul 2026 18:26:32 MDT
  Version:                    1

  Scope:
    ID:                       p_8aMSXdsg2b
    Name:                     recording-project
    Parent Scope ID:          o_FLId90vAvh
    Type:                     project

  Authorized Actions:
    read
    set-host-sources
    remove-host-sources
    add-credential-sources
    no-op
    update
    delete
    set-credential-sources
    remove-credential-sources
    add-host-sources
    authorize-session

  Attributes:
    Default Port:             22
    Enable Session Recording: true
    Storage Bucket ID:        sb_9WOgVKg5vv

Copy the ID from the output and export it as the $SSH_TARGET_ID variable.

$ export SSH_TARGET_ID=tssh_vO60a7TwpI

$ export SSH_TARGET_ID=`boundary targets create ssh -scope-id $PROJECT_ID -name "ssh-target" -session-connection-limit -1 -default-port 22 -egress-worker-filter '"ssh" in "/tags/type"' -storage-bucket-id=$STORAGE_BUCKET_ID -enable-session-recording=true -format json | jq -r '.item.id'`

Next, add the ssh-host-set as a host source for ssh-target.

$ boundary targets add-host-sources -id $SSH_TARGET_ID -host-source $SSH_HOST_SET_ID

Target information:
  Created Time:               Tue, 21 Jul 2026 18:26:32 MDT
  Egress Worker Filter:       "ssh" in "/tags/type"
  ID:                         tssh_RJUJbYGBHd
  Name:                       ssh-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       ssh
  Updated Time:               Tue, 21 Jul 2026 18:27:47 MDT
  Version:                    2

  Scope:
    ID:                       p_8aMSXdsg2b
    Name:                     recording-project
    Parent Scope ID:          o_FLId90vAvh
    Type:                     project

  Authorized Actions:
    authorize-session
    update
    remove-credential-sources
    no-op
    read
    delete
    set-host-sources
    remove-host-sources
    add-credential-sources
    set-credential-sources
    add-host-sources

  Host Sources:
    Host Catalog ID:          hcplg_Rx7olVcjDQ
    ID:                       hsplg_zFoBUqcQE3

  Attributes:
    Default Port:             22
    Enable Session Recording: true
    Storage Bucket ID:        sb_9WOgVKg5vv

Now associate ssh-target with the Vault credential library.

$ boundary targets add-credential-sources -id $SSH_TARGET_ID -injected-application-credential-source $SSH_CRED_LIB_ID

Target information:
  Created Time:               Tue, 21 Jul 2026 18:26:32 MDT
  Egress Worker Filter:       "ssh" in "/tags/type"
  ID:                         tssh_RJUJbYGBHd
  Name:                       ssh-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       ssh
  Updated Time:               Tue, 21 Jul 2026 18:28:06 MDT
  Version:                    3

  Scope:
    ID:                       p_8aMSXdsg2b
    Name:                     recording-project
    Parent Scope ID:          o_FLId90vAvh
    Type:                     project

  Authorized Actions:
    update
    set-host-sources
    add-credential-sources
    set-credential-sources
    no-op
    delete
    add-host-sources
    remove-host-sources
    authorize-session
    remove-credential-sources
    read

  Host Sources:
    Host Catalog ID:          hcplg_Rx7olVcjDQ
    ID:                       hsplg_zFoBUqcQE3

  Injected Application Credential Sources:
    Credential Store ID:      csvlt_8BeCahqgKg
    ID:                       clvlt_KoArBsTbEN

  Attributes:
    Default Port:             22
    Enable Session Recording: true
    Storage Bucket ID:        sb_9WOgVKg5vv

The SSH target now has a host source, injected credentials, and a storage bucket configured. Session recording is fully enabled.

Create an RDP target

To finish setting up recordings, create a target for the rdp-host host.

Recall the tags associated with the aws-target-worker, which provides access to the rdp-host host:

Tags:
  Configuration:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["worker" "s3" "rdp" "ssh"]
  Canonical:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["ssh" "worker" "s3" "rdp"]

An appropriate filter to select this worker is:

"rdp" in "/tags/type"

You could also have used "ssh" for this worker because it is the same worker for the ssh-host, but in a real-world deployment you would likely be using different workers.

Create a new target of type rdp named rdp-target. Set the default port to 3389, enable session recording, and pass the storage bucket ID and egress worker filter.

$ boundary targets create rdp -scope-id $PROJECT_ID \
  -name "rdp-target" \
  -session-connection-limit -1 \
  -default-port 3389 \
  -egress-worker-filter '"rdp" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Example output:

$ boundary targets create rdp -scope-id $PROJECT_ID \
  -name "rdp-target" \
  -session-connection-limit -1 \
  -default-port 3389 \
  -egress-worker-filter '"rdp" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Target information:
  Created Time:               Tue, 21 Jul 2026 18:32:18 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_6XHi9nq1gC
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Tue, 21 Jul 2026 18:32:18 MDT
  Version:                    1

  Scope:
    ID:                       p_8aMSXdsg2b
    Name:                     recording-project
    Parent Scope ID:          o_FLId90vAvh
    Type:                     project

  Authorized Actions:
    update
    set-credential-sources
    no-op
    delete
    remove-credential-sources
    set-host-sources
    remove-host-sources
    add-credential-sources
    authorize-session
    add-host-sources
    read

  Attributes:
    Default Port:             3389
    Enable Session Recording: true
    Storage Bucket ID:        sb_9WOgVKg5vv

Copy the ID from the output and export it as the $RDP_TARGET_ID variable.

$ export RDP_TARGET_ID=trdp_6XHi9nq1gC

$ export RDP_TARGET_ID=`boundary targets create rdp -scope-id $PROJECT_ID -name "rdp-target" -session-connection-limit -1 -default-port 3389 -egress-worker-filter '"rdp" in "/tags/type"' -storage-bucket-id=$STORAGE_BUCKET_ID -enable-session-recording=true -format json | jq -r '.item.id'`

Next, add the rdp-host-set as a host source for rdp-target.

$ boundary targets add-host-sources -id $RDP_TARGET_ID -host-source $RDP_HOST_SET_ID

Target information:
  Created Time:               Tue, 21 Jul 2026 18:32:18 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_6XHi9nq1gC
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Tue, 21 Jul 2026 18:34:17 MDT
  Version:                    2

  Scope:
    ID:                       p_8aMSXdsg2b
    Name:                     recording-project
    Parent Scope ID:          o_FLId90vAvh
    Type:                     project

  Authorized Actions:
    no-op
    authorize-session
    read
    delete
    remove-credential-sources
    add-host-sources
    update
    set-host-sources
    remove-host-sources
    add-credential-sources
    set-credential-sources

  Host Sources:
    Host Catalog ID:          hcplg_Rx7olVcjDQ
    ID:                       hsplg_hL9m5aCvrJ

  Attributes:
    Default Port:             3389
    Enable Session Recording: true
    Storage Bucket ID:        sb_9WOgVKg5vv

Now associate rdp-target with the Vault credential library.

$ boundary targets add-credential-sources -id $RDP_TARGET_ID -injected-application-credential-source $RDP_CRED_LIB_ID

Target information:
  Created Time:               Tue, 21 Jul 2026 18:32:18 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_6XHi9nq1gC
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Tue, 21 Jul 2026 18:34:47 MDT
  Version:                    3

  Scope:
    ID:                       p_8aMSXdsg2b
    Name:                     recording-project
    Parent Scope ID:          o_FLId90vAvh
    Type:                     project

  Authorized Actions:
    set-host-sources
    remove-host-sources
    add-credential-sources
    set-credential-sources
    authorize-session
    delete
    add-host-sources
    read
    update
    no-op
    remove-credential-sources

  Host Sources:
    Host Catalog ID:          hcplg_Rx7olVcjDQ
    ID:                       hsplg_hL9m5aCvrJ

  Injected Application Credential Sources:
    Credential Store ID:      csvlt_8BeCahqgKg
    ID:                       clvlt_gqE5QGV4cl

  Attributes:
    Default Port:             3389
    Enable Session Recording: true
    Storage Bucket ID:        sb_9WOgVKg5vv

The RDP target now has a host source, injected credentials, and a storage bucket configured. Session recording is fully enabled.

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, Amazon S3. You must create a Boundary storage bucket associated with an external store before enabling session recording.

To create a storage bucket, the following details are required:

• Name: boundary-test-bucket
• Scope: recording-org
• Bucket name: YOUR_recording_bucket_name
• Region: YOUR_AWS_REGION
• Access key ID: YOUR_recording_storage_user_access_key_id
• Secret access key: YOUR_recording_storage_user_secret_access_key
• Worker filter: "s3" in "/tags/type"

The recording_storage_user_access_key_id and recording_storage_user_secret_access_key are sensitive Terraform outputs. This means you will have to manually extract their contents from the terraform.tfstate file.

Additionally, the name of the Amazon S3 bucket is required from the Terraform outputs.

Open the shell session where Terraform was deployed, and execute the following to display these values and export them as environment variables:

$ export recording_bucket_name=$(jq -r ".outputs.recording_bucket_name.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "recording_bucket_name=$recording_bucket_name"; \
  echo "AWS_REGION=$AWS_REGION"; \
  export recording_storage_user_access_key_id=$(jq -r ".outputs.recording_storage_user_access_key_id.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "recording_storage_user_access_key_id=$recording_storage_user_access_key_id"; \
  export recording_storage_user_secret_access_key=$(jq -r ".outputs.recording_storage_user_secret_access_key.value" "./infra/terraform.tfstate.d/boundary-recording-$(whoami)/terraform.tfstate"); \
  echo "recording_storage_user_secret_access_key=$recording_storage_user_secret_access_key"

Copy these values and define them in your boundary.tfvars file.

recording_bucket_name = "<YOUR_recording_bucket_name>"

recording_storage_user_access_key_id = "<YOUR_storage_user_access_key_id>"

recording_storage_user_secret_access_key = "<YOUR_storage_user_secret_access_key>"

Save the boundary.tfvars file.

For the Worker Filter, a worker with access to the S3 storage bucket is needed. A public S3 bucket is used for this tutorial, meaning any worker will have access. In the case of a private S3 bucket, a worker with appropriate network access should be deployed and registered with Boundary, then entered here.

Select the worker tagged with "type" = ["s3", "vault", "worker"], which also provides access to Vault. The following filter will select this worker:

"s3" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"s3\" in \"/tags/type\""

Create a new storage bucket with a plugin_name of aws and pass in the recording_bucket_name. Pass the AWS_REGION and disable_credential_rotation=trueas a JSON attributes, and the recording_storage_user_access_key_id and recording_storage_user_secret_access_key as JSON secrets. Lastly, supply the worker filter.

resource "boundary_storage_bucket" "aws_bucket" {
  name            = "boundary-test-bucket"
  description     = "SSH session recording test bucket"
  scope_id        = boundary_scope.org.id
  plugin_name     = "aws"
  bucket_name     = var.recording_bucket_name
  attributes_json = jsonencode({
    "region" = "${var.AWS_REGION}",
    "disable_credential_rotation" = true
  })

  secrets_json = jsonencode({
    "access_key_id"     = "${var.recording_storage_user_access_key_id}",
    "secret_access_key" = "${var.recording_storage_user_secret_access_key}"
  })

  worker_filter = "\"s3\" in \"/tags/type\""
}

Create a storage policy

A storage policy defines how long session recordings should be retained before they can be deleted. By default, recordings cannot be deleted until a storage policy allowing for it is attached to the org scope.

To delete session recordings, you must define a storage policy that allows for zero retention. In a real-world scenario, you would likely retain your recordings for an amount of time defined by your organization.

Create a storage policy that allows for immediate deletion:

resource "boundary_policy_storage" "delete_policy" {
  name              = "delete-policy"
  description       = "Allow session recording deletion"
  scope_id          = boundary_scope.org.id
  delete_after_days = 1
}

Attach the storage policy to your org:

resource "boundary_scope_policy_attachment" "attach_delete_policy" {
  scope_id  = boundary_scope.org.id
  policy_id = boundary_policy_storage.delete_policy.id
}

Create an SSH target

To finish setting up recordings, create a target for the ssh-host host.

An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

Recall the tags associated with the aws-target-worker, which provides access to the ssh-host host:

Tags:
  Configuration:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["worker" "s3" "rdp" "ssh"]
  Canonical:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["ssh" "worker" "s3" "rdp"]

You could select from any of these tags:

type: ["ssh" "worker" "s3" "rdp"]

An appropriate filter to select this worker is:

"ssh" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"ssh\" in \"/tags/type\""

Create a new target with the following parameters:

• type: ssh
• name: ssh-target
• default_port: 22
• egress_worker_filter: "\"ssh\" in \"/tags/type\""
• host_source_ids: [boundary_host_set_plugin.dev.id]
• injected_application_credential_source_ids = [boundary_credential_library_vault.vault_host_cred_library.id]
• enable_session_recording: true
• storage_bucket_id: boundary_storage_bucket.aws_bucket

resource "boundary_target" "ssh" {
  name         = "ssh-target"
  description  = "SSH target"
  type         = "ssh"
  default_port = "22"
  scope_id     = boundary_scope.recording-project.id
  egress_worker_filter     = "\"ssh\" in \"/tags/type\""
  host_source_ids = [
    boundary_host_set_plugin.ssh.id
  ]
  injected_application_credential_source_ids = [
    boundary_credential_library_vault.vault_ssh_host_cred_library.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.aws_bucket.id
}

Create an RDP target

To finish setting up recordings, create a target for the rdp-host host.

Recall the tags associated with the aws-target-worker, which provides access to the rdp-host host:

Tags:
  Configuration:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["worker" "s3" "rdp" "ssh"]
  Canonical:
    env: ["dev"]
    platform: ["ubuntu"]
    protocol: ["rdp" "ssh"]
    type: ["ssh" "worker" "s3" "rdp"]

You could select from any of these tags:

type: ["ssh" "worker" "s3" "rdp"]

An appropriate filter to select this worker is:

"rdp" in "/tags/type"

You could also use the "ssh" tag, but in a real-world example you would probably use different workers for each target.

When using HCL, this filter must be rewritten using escape syntax:

"\"rdp\" in \"/tags/type\""

Create a new target with the following parameters:

• type: rdp
• name: rdp-target
• default_port: 3389
• egress_worker_filter: "\"rdp\" in \"/tags/type\""
• host_source_ids: [boundary_host_set_plugin.dev.id]
• injected_application_credential_source_ids = [boundary_credential_library_vault.vault_host_cred_library.id]
• enable_session_recording: true
• storage_bucket_id: boundary_storage_bucket.aws_bucket

resource "boundary_target" "rdp" {
  name         = "rdp-target"
  description  = "RDP target"
  type         = "rdp"
  default_port = "3389"
  scope_id     = boundary_scope.recording-project.id
  egress_worker_filter     = "\"rdp\" in \"/tags/type\""
  host_source_ids = [
    boundary_host_set_plugin.rdp.id
  ]
  injected_application_credential_source_ids = [
    boundary_credential_library_vault.vault_rdp_host_cred_library.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.aws_bucket.id
}

Once all the Boundary provider resources have been added, save this file.

Expand the accordion below to see a completed version of the Terraform configuration files for Boundary. For reference, an example of these files with all resources commented out is also included with the lab repository, at learn-boundary-session-rec-aws-vault/boundary-example.tf and learn-boundary-session-rec-aws-vault/boundary-example.tfvars.

provider "boundary" {
  addr                   = var.BOUNDARY_ADDR
  auth_method_id         = var.BOUNDARY_AUTH_METHOD_ID
  auth_method_login_name = var.BOUNDARY_USERNAME
  auth_method_password   = var.BOUNDARY_PASSWORD
}

terraform {
  required_version = ">= 1.3.0"
  required_providers {
    boundary = {
      source  = "hashicorp/boundary",
      version = "1.6.0"
    }
  }
}

variable "BOUNDARY_ADDR" {
    type = string
}

variable "BOUNDARY_CLUSTER_ID" {
    type = string
}

variable "BOUNDARY_AUTH_METHOD_ID" {
    type = string
}

variable "BOUNDARY_USERNAME" {
    type = string
}

variable "BOUNDARY_PASSWORD" {
    type = string
}

variable "HOST_CATALOG_ACCESS_KEY_ID" {
    type = string
}

variable "HOST_CATALOG_SECRET_ACCESS_KEY" {
    type = string
}

variable "AWS_REGION" {
    type = string
}

variable "VAULT_ADDR" {
    type = string
}

variable "VAULT_CRED_STORE_TOKEN" {
    type = string
}

variable "recording_bucket_name" {
    type = string
}

variable "recording_storage_user_access_key_id" {
    type = string
}

variable "recording_storage_user_secret_access_key" {
    type = string
}

resource "boundary_scope" "global" {
  global_scope = true
  scope_id     = "global"
}

resource "boundary_scope" "org" {
  name        = "recording-org"
  description = "Session recording test org"
  scope_id    = boundary_scope.global.id
  auto_create_admin_role   = true
  auto_create_default_role = true
}

resource "boundary_auth_method_password" "password" {
  name        = "org_password_auth"
  description = "Password auth method for org"
  type        = "password"
  scope_id    = boundary_scope.org.id
}

resource "boundary_scope" "recording-project" {
  name                   = "recording-project"
  description            = "Boundary session recordings"
  scope_id               = boundary_scope.org.id
  auto_create_admin_role = true
}

resource "boundary_host_catalog_plugin" "aws_hosts" {
  name            = "aws-recording-catalog"
  description     = "AWS session recording host catalog"
  scope_id        = boundary_scope.recording-project.id
  plugin_name     = "aws"
  attributes_json = jsonencode({
    "region"=var.AWS_REGION,
    "disable_credential_rotation"=true,
  })
  secrets_json = jsonencode({
    "access_key_id"     = var.HOST_CATALOG_ACCESS_KEY_ID,
    "secret_access_key" = var.HOST_CATALOG_SECRET_ACCESS_KEY
  })
}

resource "boundary_host_set_plugin" "ssh" {
  name            = "ssh_host_set"
  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id
  attributes_json = jsonencode({ "filters" = ["tag:protocol=ssh"] })
}
resource "boundary_host_set_plugin" "rdp" {
  name            = "rdp_host_set"
  host_catalog_id = boundary_host_catalog_plugin.aws_hosts.id
  attributes_json = jsonencode({ "filters" = ["tag:protocol=rdp"] })
}

resource "boundary_credential_store_vault" "vault_host_cred_store" {
  name        = "Vault AWS Host Credentials"
  address     = var.VAULT_ADDR
  token       = var.VAULT_CRED_STORE_TOKEN
  scope_id    = boundary_scope.recording-project.id
}

resource "boundary_credential_library_vault" "vault_ssh_host_cred_library" {
  name                = "Vault SSH Host Cred Library"
  credential_store_id = boundary_credential_store_vault.vault_host_cred_store.id
  credential_type     = "ssh_private_key"
  path                = "secret/data/ssh_host"
  http_method         = "GET"
}

resource "boundary_credential_library_vault" "vault_rdp_host_cred_library" {
  name                = "Vault RDP Host Cred Library"
  credential_store_id = boundary_credential_store_vault.vault_host_cred_store.id
  credential_type     = "username_password"
  path                = "secret/data/rdp_host"
  http_method         = "GET"
}

resource "boundary_storage_bucket" "aws_bucket" {
  name            = "boundary-test-bucket"
  description     = "Session recording test bucket"
  scope_id        = boundary_scope.org.id
  plugin_name     = "aws"
  bucket_name     = var.recording_bucket_name
  attributes_json = jsonencode({
    "region" = "${var.AWS_REGION}",
    "disable_credential_rotation" = true
  })

  secrets_json = jsonencode({
    "access_key_id"     = "${var.recording_storage_user_access_key_id}",
    "secret_access_key" = "${var.recording_storage_user_secret_access_key}"
  })
  
  worker_filter = "\"s3\" in \"/tags/type\""
}

resource "boundary_policy_storage" "delete_policy" {
  name              = "delete-policy"
  description       = "Allow session recording deletion"
  scope_id          = boundary_scope.org.id
  delete_after_days = 1
}

resource "boundary_scope_policy_attachment" "attach_delete_policy" {
  scope_id  = boundary_scope.org.id
  policy_id = boundary_policy_storage.delete_policy.id
}

resource "boundary_target" "ssh" {
  name         = "ssh-target"
  description  = "SSH target"
  type         = "ssh"
  default_port = "22"
  scope_id     = boundary_scope.recording-project.id
  egress_worker_filter     = "\"ssh\" in \"/tags/type\""
  host_source_ids = [
    boundary_host_set_plugin.ssh.id
  ]
  injected_application_credential_source_ids = [
    boundary_credential_library_vault.vault_ssh_host_cred_library.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.aws_bucket.id
}

resource "boundary_target" "rdp" {
  name         = "rdp-target"
  description  = "RDP target"
  type         = "rdp"
  default_port = "3389"
  scope_id     = boundary_scope.recording-project.id
  egress_worker_filter     = "\"rdp\" in \"/tags/type\""
  host_source_ids = [
    boundary_host_set_plugin.rdp.id
  ]
  injected_application_credential_source_ids = [
    boundary_credential_library_vault.vault_rdp_host_cred_library.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.aws_bucket.id
}