Enable session recording with S3-compatible storage

25min
|
HCP
Terraform
Boundary
Video

Deployment

Boundary supports session recording using the MinIO storage backend. This support enables users who want to integrate an S3-compatible storage backend for monitoring Boundary session activity. Session recording is available for HCP Boundary Standard tier and Boundary Enterprise users, and provides insight into user actions over remote SSH and RDP sessions to meet regulatory requirements for organizations and prevent malicious behavior. Administrators can enable session recording on SSH and RDP targets in their Boundary environment and replay recordings back within the Boundary admin UI.

The MinIO plugin is S3 compatible and enables session recording for other Amazon S3 compatible storage providers, such as Hitachi Object Storage.

This tutorial demonstrates enabling SSH and RDP session recording using MinIO as the storage backend and Boundary's native credential management features.

Tutorial overview

Prerequisites

To show how session recording works, this tutorial provides two types of targets:

Linux target for SSH
Windows target for RDP

You will set up the SSH target (and Boundary worker) using Docker.

You can configure the Windows target using Vagrant and VirtualBox, or using AWS. If you only want to test SSH session recording, you can skip the RDP session recording prerequisites listed below.

Note

This tutorial was tested on 4 August 2026 using macOS 26.5, and in the Windows 11 Subsystem for Linux (WSL) with Ubuntu 24.04.

Before moving on, check that you have installed the following versions or greater.

This tutorial recommends completing the HCP Boundary administration tutorials first. The learner should have a working Boundary cluster and org running on HCP, or a licensed Boundary Enterprise cluster.
Docker is installed (Note: Learners may also bring their own target, instead of using Docker)
A Boundary binary version 1.0.0 or later in your PATH
Terraform 0.14.9 or greater provides an optional workflow to complete the lab. The binary must be available in your PATH.
The jq utility is recommended to simplify the CLI workflow. It should be installed and in your PATH.
The MinIO Client (mc) is required to configure the MinIO storage bucket and access key used in this tutorial. Install it with brew install minio-mc on macOS, or download a binary for your platform from the releases page. It should be installed and in your PATH.
Installing the Boundary Desktop App provides an optional workflow for this tutorial. The 2.0.0 version or above is recommended.

RDP session recording prerequisites

If you want to test RDP session recording, you will need the following:

Installing an RDP client enables you to connect to the RDP targets in this tutorial. You could use the Windows App on Windows on macOS systems, or any other RDP client you prefer.

This tutorial provides two ways to set up a Windows environment for testing session recording:

Vagrant and VirtualBox
- Vagrant 2.2 or later and VirtualBox version 7.2 or later are required if you want to test RDP session recording with local resources. Refer to Deploy an RDP target for setup details. Skip this prerequisite if you only want to test SSH session recording, or if you want to use an AWS instance to test RDP instead.
OR
Amazon Web Services (AWS) EC2
- An Amazon Web Services test account is only needed if you want to test RDP session recording with AWS instead of using Vagrant and VirtualBox.
  Warning
  This option creates cloud resources and incurs costs associated with deploying and managing them.
- Installing the AWS CLI is optional if you want to set up a Windows instance using AWS. You can use the AWS CLI or AWS Management Console to set up the Windows instance. If you use the AWS CLI, the binary should be available within your PATH.

Session recording background

Highly regulated environments commonly need a system of record that archives actions taken on the network so that organizations can improve their security posture and enhance compliance.

Session recording allows administrators to get insight into user actions over remote SSH and RDP sessions to meet regulatory requirements for organizations and prevent malicious behavior. Administrators can enable session recording on SSH and RDP targets in their Boundary environment, store signed recordings in their storage bucket, and replay recordings back within the Boundary admin UI.

Recorded sessions get converted into a Boundary session recording (BSR) file, a binary file format and specification created to define the structure of Boundary recording files.

BSR files are designed to:

Support the recording of both multiplexed and non-multiplexed protocols
Allow independent byte streams in a session to write in parallel
Support an optimal user experience during playback
Be extensible to support more protocols in the future

BSR contains all the data transmitted between a user and a target during a session and is available within your storage bucket. These files are signed to ensure they are tamper-proof.

SSH and RDP session recording is available as a part of the Standard tier in both HCP Boundary and Boundary Enterprise.

Get set up

You will configure the following components for this tutorial:

HCP Boundary Standard tier or Boundary Enterprise cluster
MinIO storage bucket
SSH host
RDP host
A worker instance to proxy and record your SSH and RDP sessions

Deploy an HCP Boundary Standard cluster

Session recording, credential injection, and SSH and RDP targets are features available in HCP Boundary Standard tier.

First, deploy an HCP Boundary cluster with the HCP Standard sku selected.

Launch the HCP Portal and log in.
Select your organization and project. From within that project, select Boundary from the Services menu in the left navigation.
Click Deploy Boundary.
In the Instance Name text box, provide a name for your Boundary instance.
Under Choose a tier, select the Standard option to enable session recording.
Under the Create an administrator account section, enter the Username and Password for the initial Boundary administrator account.
Click Deploy. Wait for the instance to initialize before proceeding.

Note

You should remember to delete the resources you create for this tutorial to avoid incurring any additional costs.

You will need the following values later. Copy the Boundary Cluster URL from the HCP Boundary portal.

Boundary address: the BOUNDARY_ADDR variable
Boundary Cluster ID: the BOUNDARY_CLUSTER_ID variable
Boundary admin username: the BOUNDARY_USERNAME variable
Boundary admin password: the BOUNDARY_PASSWORD variable

Store these values in a safe location.

Note

The Boundary cluster ID is part of the Boundary address. For example, if your cluster URL is:

https://abcd1234-e567-f890-1ab2-cde345f6g789.boundary.hashicorp.cloud

Your cluster id is abcd1234-e567-f890-1ab2-cde345f6g789.

Next, click Open Admin UI.

Navigate to the Auth Methods page using the left navigation panel. Locate the password auth method, and copy its ID (such as ampw_AQSr776Hnm).

If you follow the Terraform workflow, you will use this value later on:

Boundary auth method ID: the BOUNDARY_AUTH_METHOD_ID variable

Deploy targets and a Boundary worker

Deploy an openssh-server container as an SSH target for Boundary.

Note

You may also bring your own target for this tutorial. You can follow this guide to create a publicly accessible EC2 instance to use for this tutorial. If using a privately accessible target for testing, you must deploy a Boundary worker with network access to the target.

Ensure Docker is running, and then create a Docker network for the containers you deploy in this tutorial. Deploying the SSH target, MinIO, and the Boundary worker onto a shared network lets the worker reach the other containers by name, instead of relying on published host ports.

$ docker network create boundary-local

Deploy an openssh container to use as a target.

$ docker run -d \
  --name openssh-server \
  --network boundary-local \
  -e USER_NAME=ssh-admin \
  -e PASSWORD_ACCESS=true \
  -e USER_PASSWORD=password \
  -p 2222:2222 \
  lscr.io/linuxserver/openssh-server:latest

Note that the username for the openssh server is ssh-admin, the password is password, and the target is available on your localhost at port 2222 (127.0.0.1:2222). Later in this tutorial, you create a Boundary target that reaches this container over boundary-local using its container name, openssh-server, instead.

Export the openssh container password as an environment variable.

$ export OPENSSH_PASSWORD=password

Check that the container is running.

$ docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}"
CONTAINER ID   NAMES            IMAGE                                       STATUS
6e63f8178576   openssh-server   lscr.io/linuxserver/openssh-server:latest   Up 20 seconds

Note

RDP session recording works best against a real Windows target. Boundary's RDP credential injection relies on Windows-specific authentication (NLA, Kerberos, or NTLMv2), which a Linux-based RDP server cannot satisfy. This tutorial provides two options for deploying a Windows target: a local VM using Vagrant and VirtualBox, or a Windows Server instance on AWS.

If you only want to test SSH session recording, skip this section and the RDP-specific steps later in the tutorial.

Install Vagrant and VirtualBox

Vagrant creates and configures a virtual machine from a prebuilt image, called a box, so there's no Windows ISO to download and no installer screens to click through. Vagrant uses VirtualBox as the provider that runs the VM.

Install Vagrant version 2.2 or later.
Install VirtualBox version 7.2 or later.
- Windows and Linux hosts: VirtualBox has long-standing, stable support for running Windows virtual machines.
- Intel-based macOS hosts: also fully supported.
- Apple Silicon (M-series) macOS hosts: VirtualBox added Windows guest support on Apple Silicon in version 7.2. Vagrant automatically downloads the box variant that matches your host's CPU architecture, so the same Vagrantfile in the next step works unmodified on this host type.
- Windows on Arm hosts: VirtualBox is only available as an experimental developer preview on this host type.
On macOS, the first time you launch VirtualBox or start a VM, macOS blocks its kernel extension. Go to System Settings > Privacy & Security, click Allow next to the message about software from "Oracle America, Inc.", and restart your Mac if necessary. You do not need the separate VirtualBox Extension Pack for this tutorial.

Create the virtual machine

Create a directory for your Vagrant environment, and add a Vagrantfile:

$ mkdir boundary-rdp-vagrant && cd boundary-rdp-vagrant

boundary-rdp-vagrant/Vagrantfile

Vagrant.configure("2") do |config|
  config.vm.box = "gusztavvargadr/windows-11"

  config.vm.provider "virtualbox" do |vb|
    vb.gui = true
    vb.memory = "4096"
    vb.cpus = 2
  end
end

This uses the community-maintained gusztavvargadr/windows-11 box, a fully installed, unattended Windows 11 Pro image. vb.gui = true opens a window so you can watch the VM boot the first time; remove it once you've confirmed things work.

Start the VM:

$ vagrant up

Note

The first vagrant up downloads the box image (around 14 GB) before booting, which can take several minutes depending on your connection. Later runs reuse the cached box and start in seconds.

The box ships with Remote Desktop already enabled and a local administrator account with the username and password both set to vagrant. It also configures VirtualBox NAT port forwarding automatically, so no manual port-forwarding rule is required. By default, the VM's RDP port (3389) is forwarded to port 53389 on your host machine.

Export the account password as an environment variable.

$ export RDP_PASSWORD=vagrant

Verify the port forward works from a terminal on your host:

$ nc -zv 127.0.0.1 53389
Connection to 127.0.0.1 port 53389 [tcp/*] succeeded!

Note

The Boundary worker in this tutorial runs in a Docker container, which does not have direct access to the host's network the way you might expect. Later, when creating the RDP target, use the address host.docker.internal instead of 127.0.0.1. Docker Desktop (macOS and Windows) resolves this hostname to the real host machine from inside a container, while 127.0.0.1 inside the container refers to the container's own network namespace, not your Mac or PC. This is true even though the worker joins the boundary-local Docker network with the other containers, since the Vagrant VM runs directly on your host, not as a Docker container on that network. On Linux hosts, add --add-host=host.docker.internal:host-gateway to the worker's docker run command in the next section, since native Docker doesn't define this hostname automatically.

Launch a Windows instance

This tutorial uses a Windows Server instance, rather than Windows 11, as the RDP target on AWS. Unlike Windows 11 Home, every edition of Windows Server can host Remote Desktop connections out of the box, so there's no edition to select or verify.

Sign in to the AWS Console and open the EC2 service.
Click Launch instance.
Under Name, enter boundary-rdp-target.
Under Application and OS Images, select Microsoft Windows Server 2022 Base.
Under Instance type, select t3.large or larger. The Windows desktop experience needs more memory than Linux targets typically do.
Under Key pair, click Create new key pair, provide a name, and download the resulting .pem file. You'll use this to decrypt the instance's Administrator password later.
Under Network settings, click Edit, then create a security group that allows RDP traffic from My IP. This restricts inbound port 3389 to your current public IP address.
Click Launch instance.

Wait for the instance to enter the Running state and pass its status checks before continuing. This can take a few minutes for a Windows instance.

Create a key pair. You'll use this to decrypt the instance's Administrator password later.

$ aws ec2 create-key-pair --key-name boundary-rdp-target --query 'KeyMaterial' --output text > boundary-rdp-target.pem ;
chmod 400 boundary-rdp-target.pem

Create a security group that allows RDP traffic only from your current public IP address.

$ MY_IP=$(curl -s https://checkip.amazonaws.com) ;
SECURITY_GROUP_ID=$(aws ec2 create-security-group --group-name boundary-rdp-target-sg --description "Boundary RDP target" --query 'GroupId' --output text) ;
aws ec2 authorize-security-group-ingress --group-id $SECURITY_GROUP_ID --protocol tcp --port 3389 --cidr "${MY_IP}/32"

Look up the latest Windows Server 2022 AMI ID for your region.

$ AMI_ID=$(aws ssm get-parameters --names /aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base --query 'Parameters[0].Value' --output text)

Launch the instance.

$ INSTANCE_ID=$(aws ec2 run-instances \
  --image-id $AMI_ID \
  --instance-type t3.large \
  --key-name boundary-rdp-target \
  --security-group-ids $SECURITY_GROUP_ID \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=boundary-rdp-target}]' \
  --query 'Instances[0].InstanceId' --output text)

Wait for the instance to finish booting.

$ aws ec2 wait instance-running --instance-ids $INSTANCE_ID ;
aws ec2 wait instance-status-ok --instance-ids $INSTANCE_ID

Retrieve the instance details

Look up the instance's public IP address.

$ PUBLIC_IP=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID --query 'Reservations[0].Instances[0].PublicIpAddress' --output text) ;
echo $PUBLIC_IP

Note

If you used the AWS Console instead of the CLI, find $INSTANCE_ID on the instance's detail page, and $PUBLIC_IP in the Public IPv4 address field.

Decrypt the auto-generated Administrator password using your key pair.

$ aws ec2 get-password-data --instance-id $INSTANCE_ID --priv-launch-key boundary-rdp-target.pem --query 'PasswordData' --output text

Note

It can take several minutes after launch for AWS to generate the password. If the command returns an empty string, wait a bit and try again.

Export the decrypted password as an environment variable.

$ export RDP_PASSWORD='<paste the decrypted password here>'

Verify the instance is reachable on its RDP port from a terminal on your host:

$ nc -zv $PUBLIC_IP 3389
Connection to 203.0.113.10 port 3389 [tcp/ms-wbt-server] succeeded!

Note

Unlike the VirtualBox VM, this instance runs on its own machine, not on your host, so there's no host.docker.internal networking concern. When creating the RDP target later in this tutorial, use the instance's public IP address ($PUBLIC_IP) directly, and its default local administrator username, Administrator.

Deploy a worker

Session recording requires HCP Boundary or Boundary Enterprise. This tutorial uses Docker to deploy a Boundary worker to provide access to the target containers.

When using the boundary-enterprise image as a worker with HCP Boundary or Boundary Enterprise, you do not need to provide the license using an environment variable or config, but the worker must connect with a licensed controller.

Create a new file in your working directory called config.hcl. Supply the hcp_boundary_cluster_id, which is the UUID in the HCP Boundary cluster URL.

Tip

If your cluster is configured for multi-hop sessions, add an upstream worker using initial_upstreams to the worker{} stanza.

config.hcl

hcp_boundary_cluster_id = "<YOUR_HCP_CLUSTER_ID>"

listener "tcp" {
  address = "0.0.0.0:9202"
  purpose = "proxy"
}

worker {
  public_addr = "minio-worker"
  auth_storage_path = "/boundary/minio-worker"
  recording_storage_path = "/tmp/boundary/worker-recordings"
  tags {
    type = ["minio", "openssh", "rdp"]
  }
}

Save the config file.

Note

The listener address is set to 0.0.0.0:9202, not 127.0.0.1:9202. A process bound to 127.0.0.1 inside a container is only reachable from within that same container, so the worker's proxy listener must bind to all interfaces for the -p 9202:9202 port you publish in the next step to actually reach it.

Build a custom worker image

RDP session recording requires ffmpeg on the worker to process the recording. The published hashicorp/boundary-enterprise image does not include ffmpeg.

If you want to test RDP session recording, you should build a small custom Docker image that adds ffmpeg before deploying the worker.

Create a new file named Dockerfile in the same working directory as config.hcl.

Dockerfile

FROM hashicorp/boundary-enterprise
USER root
RUN apk add --no-cache ffmpeg
USER boundary

Build the image and tag it boundary-enterprise-ffmpeg.

$ docker build -t boundary-enterprise-ffmpeg .

Start and register the worker

Open a new terminal and switch to the directory with the config.hcl file, then deploy the worker container.

$ docker run \
  --name boundary-worker \
  --detach \
  --network boundary-local \
  -p 9202:9202 \
  --hostname=minio-worker \
  --add-host=host.docker.internal:host-gateway \
  -v "$(pwd)":/boundary/ \
  boundary-enterprise-ffmpeg

Note

If you're using the VirtualBox workflow from Deploy an RDP target, the --add-host=host.docker.internal:host-gateway flag lets the worker reach services running directly on your host machine, such as the RDP target's port forward from Create the virtual machine. Docker Desktop (macOS and Windows) defines this hostname automatically, but native Docker on Linux requires this flag to define it. This flag is harmless to leave in place if you're using the AWS workflow instead, because you are using a public IP address for the RDP target.

The worker also joins the boundary-local network created earlier, so it can reach the openssh-server and minio containers by name. The -p 9202:9202 flag publishes the worker's proxy listener so the boundary CLI on your host can still reach it.

When the worker starts it attempts to connect to the controller.

Retrieve the worker registration code from the container logs.

$ docker logs boundary-worker 2>&1 | grep "Worker Auth Registration Request:"

Worker Auth Registration Request: Gzusqck...EXAMPLESTRING...HpyLn8GkcKqmj

Copy the Worker Auth Registration Request value.

You can register the worker using the Admin Console Web UI or the CLI.

Authenticate to HCP Boundary as the admin user.

Log in to the HCP portal.
From the HCP Portal's Boundary page, click on Open Admin UI to open the management console in a new page.
Enter the admin username and password you created when you deployed the new instance and click Authenticate.

Once logged in, navigate to the Workers page.

Notice that only HCP workers are listed.

Click New.

The new workers page can be used to construct the contents of the worker.hcl file.

Do not fill in any of the worker fields.

Providing the following details will construct the worker config file contents for you:

Boundary Cluster ID
Worker Public Address
Config file path
Worker Tags

The instructions on this page provide details for installing the Boundary Enterprise binary and deploying the constructed config file.

Because the worker has already been deployed, only the Worker Auth Registration Request key needs to be provided on this page.

Scroll down to the bottom of the New Worker page and paste the Worker Auth Registration Request key you copied earlier.

Click Register Worker.

Click Done and notice the new worker on the Workers page.

Workers page with local worker

Ensure that the BOUNDARY_ADDR and BOUNDARY_AUTH_METHOD_ID environment variables are set.

$ export BOUNDARY_ADDR="https://c3a7a20a-f663-40f3-a8e3-1b2f69b36254.boundary.hashicorp.cloud"

$ export BOUNDARY_AUTH_METHOD_ID="ampw_KfLAjMS2CG"

$ boundary authenticate
Please enter the login name (it will be hidden):
Please enter the password (it will be hidden):
Authentication information:
  Account ID:      acctpw_kYOiyf8bmM
  Auth Method ID:  ampw_Vm9CQotObN
  Expiration Time: Tue, 11 Aug 2026 16:05:57 MDT
  User ID:         u_aa6IHWzDZW

The token name "default" was successfully stored in the chosen keyring and is not displayed here.

Next, export the Worker Auth Request Token value as an environment variable.

$ export WORKER_TOKEN="<Worker Auth Registration Request Value>"

Use the token to issue a create worker request that authorizes the worker to Boundary and make it available.

Create a new worker:

$ boundary workers create worker-led -worker-generated-auth-token=$WORKER_TOKEN

Worker information:
  Active Connection Count:   0
  Created Time:              Mon, 5 Aug 2026 19:40:57 MDT
  ID:                        w_CB3r4wOTOF
  Local Storage State:       unknown
  Type:                      pki
  Updated Time:              Wed, 5 Aug 2026 19:40:57 MDT
  Version:                   1

  Scope:
    ID:                      global
    Name:                    global
    Type:                    global

  Authorized Actions:
    update
    delete
    add-worker-tags
    set-worker-tags
    remove-worker-tags
    no-op
    read

Set up MinIO

This tutorial deploys MinIO using Docker. Alternatively, a MinIO server can be deployed locally on Linux, macOS, or Windows.

Note

MinIO's Community Edition project was archived in early 2026, so no further releases are coming. This tutorial pins the container to the last release ever published, RELEASE.2025-09-07T16-13-09Z, for reproducibility. That release, like the Community Edition builds before it, no longer includes a functional web console for managing buckets, policies, and access keys, so this tutorial configures MinIO using the mc CLI instead.

Deploy MinIO

Open a new terminal session and create a local config directory for MinIO.

$ mkdir -p ${HOME}/minio/data

Next, deploy a MinIO container using Docker.

$ docker run \
   -p 9000:9000 \
   --name minio \
   --network boundary-local \
   -e "MINIO_ROOT_USER=ROOTUSER" \
   -e "MINIO_ROOT_PASSWORD=CHANGEME123" \
   -v ${HOME}/minio/data:/data \
   quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z server /data

Open a new terminal session and verify that all three containers are running.

$ docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}"
CONTAINER ID   NAMES             IMAGE                                        STATUS
3af7a93654d3   minio             quay.io/minio/minio                          Up 3 minutes
49f1ec39b3d8   boundary-worker   boundary-enterprise-ffmpeg                   Up 11 minutes
6e63f8178576   openssh-server    lscr.io/linuxserver/openssh-server:latest    Up 17 minutes

Configure a MinIO storage bucket

Configure an mc alias pointing to your local MinIO server. Credentials are case sensitive.

$ mc alias set myminio http://127.0.0.1:9000 ROOTUSER CHANGEME123
Added `myminio` successfully.

Complete the following steps to configure a storage bucket:

Create a bucket named boundary-recordings.

$ mc mb myminio/boundary-recordings
Bucket created successfully `myminio/boundary-recordings`.

Export the bucket name as a variable in your terminal session.

$ export MINIO_BUCKET_NAME=boundary-recordings

Write an IAM policy that scopes access to just this bucket.

boundary-recordings-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Action": [
          "s3:PutObject",
          "s3:GetObject",
          "s3:GetObjectAttributes",
          "s3:DeleteObject"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::boundary-recordings/*"
     },
     {
        "Action": "s3:ListBucket",
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::boundary-recordings"
     }
  ]
}

Ensure that lines 12 and 17 contain the correct name of your bucket, such as boundary-recordings.

Create an access key scoped to the policy file. This single command replaces the old Console flow of creating an access key and pasting in a custom policy.

$ mc admin accesskey create myminio/ --name boundary-admin --policy boundary-recordings-policy.json

Example output:

$ mc admin accesskey create myminio/ --name boundary-admin --policy boundary-recordings-policy.json
Access Key: LJMRXGEWK7UD6H9QA363
Secret Key: BCx+JOIrrMlYiUvsSwKquthwc+etomFAVv8ejrgS
Expiration: NONE
Name: boundary-admin
Description:

Note

You will not be able to view the Secret Key again after this, so copy or record both values now.

Export the access key and secret key as variables in your terminal session.

$ export MINIO_ACCESS_KEY_ID=<your-copied-minio-access-key-id>
$ export MINIO_SECRET_ACCESS_KEY=<your-copied-minio-secret-access-key>

Set up Boundary

The following resources are used in Boundary to enable session recording for SSH and RDP targets:

A credential store
A credential library
A Boundary storage bucket
An SSH or RDP target type with credential injection enabled

These resources can be configured using the Admin Console UI, the CLI, or Terraform. Select a workflow below to continue setting up Boundary.

Start by logging in to the HCP Boundary Admin UI.

Log in to the HCP portal.
From the HCP Portal's Boundary page, click Open Admin UI - a new page will open.
Enter the admin username and password you created when you deployed the new instance and click Authenticate.

Next, set up a new testing org and project scope.

Navigate to the Orgs page and click New Org.
Fill out the new org form with a Name of recording-test-org and Description of Session recording test org. Click Save.
From within the new org, click New Project.
Fill out the new project form with a Name of recording-test-project and Description of Project for session recording targets. Click Save.

Create a credential store

Credential injection is required to enable session recording. You manage credentials using a Boundary credential store.

Navigate back to the recording-test-org, and select the recording-test-project.
Select the Credential Stores page, and click New.
Enter the Name SSH and RDP Credentials.
Select the type Static, and click Save.
Click the Credentials tab in the new credential store. Click New.
Under the New Credential page, enter the following details for the SSH target credential:
- Name: openssh-creds
- Type: Username & Password
- Username: ssh-admin
- Password: password
Click Save.
Click New again to add the RDP credential.
Under the New Credential page, enter the following details for the RDP target credential. Unlike the SSH credential, RDP credential injection requires a credential type that includes a domain, such as Username, Password & Domain.
- Name: rdp-creds
- Type: Username, Password & Domain
- Domain: .
Username: vagrant
Password: vagrant
Note
vagrant/vagrant are the default local administrator credentials on the gusztavvargadr/windows-11 Vagrant box used in Deploy an RDP target.
Note
Set the domain to a single period (.) for a local Windows account that isn't joined to an Active Directory domain, such as this one. This tells Boundary to authenticate using NTLMv2 against the target's local account database, instead of attempting Kerberos against a domain that doesn't exist.
Click Save.

Open a new terminal session.

Start by logging in to Boundary as the admin user.

$ boundary authenticate
Please enter the login name (it will be hidden):
Please enter the password (it will be hidden):
Authentication information:
  Account ID:      acctpw_kYOiyf8bmM
  Auth Method ID:  ampw_wxzojlKJLN
  Expiration Time: Tue, 11 Aug 2026 16:05:57 MDT
  User ID:         u_aa6IHWzDZW

The token name "default" was successfully stored in the chosen keyring and is not displayed here.

Set up a new org and project

Create a new org named recording-test-org. The following command executes boundary scopes create, prints the result, selects the org ID with jq, and stores the value as an environment variable. The jq utility reduces the amount of copy-paste for IDs for the rest of this tutorial.

$ ORG_ID=$(boundary scopes create \
  -scope-id=global \
  -name=recording-test-org \
  -description="Session recording test org" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "ORG_ID=$ORG_ID"

Example output:

$ ORG_ID=$(boundary scopes create \
  -scope-id=global \
  -name=recording-test-org \
  -description="Session recording test org" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "ORG_ID=$ORG_ID"
{"status_code":200,"item":{"id":"o_IcIMOX3itH","scope_id":"global","scope":{"id":"global","type":"global","name":"global","description":"Global Scope"},"name":"recording-test-org","description":"Session recording test org","created_time":"2026-08-05T17:38:03.626930Z","updated_time":"2026-08-05T17:38:03.626930Z","version":1,"type":"org","authorized_actions":["detach-storage-policy","set-alias-suffix","remove-alias-suffix","no-op","read","update","delete","attach-storage-policy"]}}
ORG_ID=o_IcIMOX3itH

Create a new project scope named recording-test-project within the recording-test-org. The following command also exports the PROJECT_ID environment variable.

$ PROJECT_ID=$(boundary scopes create \
  -scope-id=$ORG_ID \
  -name=recording-test-project \
  -description="SSH test machines" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROJECT_ID=$PROJECT_ID"

Example output:

$ PROJECT_ID=$(boundary scopes create \
  -scope-id=$ORG_ID \
  -name=recording-test-project \
  -description="SSH test machines" \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "PROJECT_ID=$PROJECT_ID"
{"status_code":200,"item":{"id":"p_ZLeNx8ftbC","scope_id":"o_IcIMOX3itH","scope":{"id":"o_IcIMOX3itH","type":"org","name":"recording-test-org","description":"Session recording test org","parent_scope_id":"global"},"name":"recording-test-project","description":"SSH test machines","created_time":"2026-08-05T17:38:04.712810Z","updated_time":"2026-08-05T17:38:04.712810Z","version":1,"type":"project","authorized_actions":["set-alias-suffix","remove-alias-suffix","no-op","read","update","delete"],"authorized_collection_actions":{"aliases":["create","list"],"credential-stores":["create","list"],"groups":["create","list"],"host-catalogs":["create","list"],"roles":["list","create"],"scopes":["list-key-version-destruction-jobs","destroy-key-version","list-keys","rotate-keys"],"sessions":["list"],"targets":["create","list"]}}}
PROJECT_ID=p_ZLeNx8ftbC

Create a credential store

Credential injection is required to enable session recording. You use a Boundary credential store to create credentials for targets.

Create the static credential store. The following command also exports the BOUNDARY_CRED_STORE_ID environment variable.

$ BOUNDARY_CRED_STORE_ID=$(boundary credential-stores create static \
  -name "SSH and RDP Credentials" \
  -scope-id $PROJECT_ID \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "BOUNDARY_CRED_STORE_ID=$BOUNDARY_CRED_STORE_ID"

Example output:

$ BOUNDARY_CRED_STORE_ID=$(boundary credential-stores create static \
  -name "SSH and RDP Credentials" \
  -scope-id $PROJECT_ID \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "BOUNDARY_CRED_STORE_ID=$BOUNDARY_CRED_STORE_ID"
{"status_code":200,"item":{"id":"csst_jlmy9TT7v9","scope_id":"p_ZLeNx8ftbC","scope":{"id":"p_ZLeNx8ftbC","type":"project","name":"recording-test-project","description":"SSH test machines","parent_scope_id":"o_IcIMOX3itH"},"name":"SSH and RDP Credentials","created_time":"2026-08-05T17:38:05.895439Z","updated_time":"2026-08-05T17:38:05.895439Z","version":1,"type":"static","authorized_actions":["update","delete","no-op","read"],"authorized_collection_actions":{"credentials":["create","list"]}}}
BOUNDARY_CRED_STORE_ID=csst_jlmy9TT7v9

Add the SSH credential to the credential store. The following command also exports the SSH_CREDENTIAL_ID environment variable.

The password attribute must be passed as an environment variable. If you do not have the OPENSSH_PASSWORD variable defined in your current shell session, refer back to the Deploy a target section to set the variable.

$ SSH_CREDENTIAL_ID=$(boundary credentials create username-password \
  -name "openssh credentials" \
  -credential-store-id $BOUNDARY_CRED_STORE_ID \
  -username ssh-admin \
  -password env://OPENSSH_PASSWORD \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "SSH_CREDENTIAL_ID=$SSH_CREDENTIAL_ID"

Example output:

$ SSH_CREDENTIAL_ID=$(boundary credentials create username-password \
  -name "openssh credentials" \
  -credential-store-id $BOUNDARY_CRED_STORE_ID \
  -username ssh-admin \
  -password env://OPENSSH_PASSWORD \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "SSH_CREDENTIAL_ID=$SSH_CREDENTIAL_ID"
{"status_code":200,"item":{"id":"credup_kSvc0NY2rF","credential_store_id":"csst_jlmy9TT7v9","scope":{"id":"p_ZLeNx8ftbC","type":"project","name":"recording-test-project","description":"SSH test machines","parent_scope_id":"o_IcIMOX3itH"},"name":"openssh credentials","created_time":"2026-08-05T17:38:06.909627Z","updated_time":"2026-08-05T17:38:06.909627Z","version":1,"type":"username_password","attributes":{"password_hmac":"wXlCmxOWfoYGkMmTDFbz7n-v8sjLwqATJVNkT_463oc","username":"ssh-admin"},"authorized_actions":["no-op","read","update","delete"]}}
SSH_CREDENTIAL_ID=credup_kSvc0NY2rF

Add the RDP credential to the same credential store. Unlike the SSH credential, RDP credential injection requires a username-password-domain credential, which includes a domain attribute alongside the username and password. The following command also exports the RDP_CREDENTIAL_ID environment variable.

The password attribute must be passed as an environment variable. If you do not have the RDP_PASSWORD variable defined in your current shell session, refer back to the Deploy an RDP target section to set the variable.

Note

Set -domain "." for a local Windows account that isn't joined to an Active Directory domain, such as the accounts used in this tutorial. The single-period value is a standard Windows convention that tells Boundary to authenticate against the target's local account database using NTLMv2, instead of attempting Kerberos against a domain that doesn't exist. If you use the target's computer name as the domain instead, Boundary attempts a Kerberos lookup that fails.

You may still see a benign AS Exchange Error referencing a Kerberos KDC lookup in the worker's logs when you connect, even with -domain "." set correctly. Boundary attempts Kerberos first and falls back to NTLMv2 automatically; this error doesn't indicate a failed connection.

$ RDP_CREDENTIAL_ID=$(boundary credentials create username-password-domain \
  -name "rdp credentials" \
  -credential-store-id $BOUNDARY_CRED_STORE_ID \
  -username vagrant \
  -password env://RDP_PASSWORD \
  -domain "." \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_CREDENTIAL_ID=$RDP_CREDENTIAL_ID"

Example output:

$ RDP_CREDENTIAL_ID=$(boundary credentials create username-password-domain \
  -name "rdp credentials" \
  -credential-store-id $BOUNDARY_CRED_STORE_ID \
  -username vagrant \
  -password env://RDP_PASSWORD \
  -domain "." \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_CREDENTIAL_ID=$RDP_CREDENTIAL_ID"
{"status_code":200,"item":{"id":"credupd_Dfg7Sc94It","credential_store_id":"csst_jlmy9TT7v9","scope":{"id":"p_ZLeNx8ftbC","type":"project","name":"recording-test-project","description":"SSH test machines","parent_scope_id":"o_IcIMOX3itH"},"name":"rdp credentials","created_time":"2026-08-05T17:39:55.883212Z","updated_time":"2026-08-05T17:39:55.883212Z","version":1,"type":"username_password_domain","attributes":{"password_hmac":"aBC1xWfoXGkNmUDFbz7n-v8sjLwqATJVNkT_789xy","username":"vagrant","domain":"."},"authorized_actions":["no-op","read","update","delete"]}}
RDP_CREDENTIAL_ID=credupd_Dfg7Sc94It

$ RDP_CREDENTIAL_ID=$(boundary credentials create username-password-domain \
  -name "rdp credentials" \
  -credential-store-id $BOUNDARY_CRED_STORE_ID \
  -username Administrator \
  -password env://RDP_PASSWORD \
  -domain "." \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_CREDENTIAL_ID=$RDP_CREDENTIAL_ID"

Example output:

$ RDP_CREDENTIAL_ID=$(boundary credentials create username-password-domain \
  -name "rdp credentials" \
  -credential-store-id $BOUNDARY_CRED_STORE_ID \
  -username Administrator \
  -password env://RDP_PASSWORD \
  -domain "." \
  -format json | tee /dev/tty | jq -r '.item | .id') && echo "RDP_CREDENTIAL_ID=$RDP_CREDENTIAL_ID"
{"status_code":200,"item":{"id":"credupd_D7V26vfq2a","credential_store_id":"csst_jlmy9TT7v9","scope":{"id":"p_ZLeNx8ftbC","type":"project","name":"recording-test-project","description":"SSH test machines","parent_scope_id":"o_IcIMOX3itH"},"name":"rdp credentials","created_time":"2026-08-05T17:40:32.025017Z","updated_time":"2026-08-05T17:40:32.025017Z","version":1,"type":"username_password_domain","attributes":{"password_hmac":"aBC1xWfoXGkNmUDFbz7n-v8sjLwqATJVNkT_789xy","username":"Administrator","domain":"."},"authorized_actions":["no-op","read","update","delete"]}}
RDP_CREDENTIAL_ID=credupd_D7V26vfq2a

Note

Terraform has no resource for registering a self-managed worker. Complete the Register the worker step above using the Admin UI or CLI before continuing, regardless of which workflow you use for the rest of the Boundary setup.

This configuration references Terraform resources documented in the Boundary Terraform provider.

To simplify lab cleanup, create a new directory to store the lab configuration.

$ mkdir learn-boundary-session-rec-minio && cd learn-boundary-session-rec-minio

Terraform configuration file called boundary.tf in the top of the learn-boundary-session-rec-minio/ directory.

$ touch boundary.tf

Next, open boundary.tf in your text editor.

Set up the provider

Start by defining Boundary as a required provider, and setting up the provider's input variables.

learn-boundary-session-rec-minio/boundary.tf

provider "boundary" {
  addr                   = var.BOUNDARY_ADDR
  auth_method_id         = var.BOUNDARY_AUTH_METHOD_ID
  auth_method_login_name = var.BOUNDARY_USERNAME
  auth_method_password   = var.BOUNDARY_PASSWORD
}

terraform {
  required_version = ">= 1.3.0"
  required_providers {
    boundary = {
      source  = "hashicorp/boundary",
      version = ">= 1.1.15"
    }
  }
}

Define the input variables

The following variables are passed to Terraform, so no default values are required. Define all these variables within the boundary.tf config file.

variable "BOUNDARY_ADDR" {
    type = string
}

variable "BOUNDARY_AUTH_METHOD_ID" {
    type = string
}

variable "BOUNDARY_USERNAME" {
    type = string
}

variable "BOUNDARY_PASSWORD" {
    type = string
}

variable "MINIO_ADDR" {
    type = string
}

variable "MINIO_BUCKET_NAME" {
    type = string
}

variable "MINIO_ACCESS_KEY_ID" {
    type = string
}

variable "MINIO_SECRET_ACCESS_KEY" {
    type = string
}

Next, locate the values of the following input variables used by the provider, including:

Locate the following values in your shell session:

$ echo $BOUNDARY_ADDR ; \
  echo $BOUNDARY_USERNAME ; \
  echo $BOUNDARY_PASSWORD

All of the variables except the BOUNDARY_AUTH_METHOD_ID were previously defined.

You can locate the admin password auth method ID using the CLI or the Admin Web UI.

Navigate to the global scope.
Navigate to the Auth Methods page.
Copy the ID beside the password auth method (such as ampw_AQSr776Hnm).

Authenticate to Boundary as the admin user.

$ boundary authenticate

List the available auth methods.

$ boundary auth-methods list

Auth Method information:
  ID:                     ampw_AQSr776Hnm
    Version:              1
    Type:                 password
    Name:                 password
    Description:          Password auth method
    Is Primary For Scope: true
    Authorized Actions:
      no-op
      read
      update
      delete
      authenticate

Copy the ID of the password auth method.

Create a new file called boundary.tfvars in ~/learn-boundary-session-rec-minio. This file will pass the required variables to Terraform.

learn-boundary-session-rec-minio/boundary.tfvars

BOUNDARY_ADDR = "<YOUR_BOUNDARY_ADDR>"

BOUNDARY_USERNAME = "<YOUR_ADMIN_USERNAME>"

BOUNDARY_PASSWORD = "<YOUR_ADMIN_PASSWORD>"

BOUNDARY_AUTH_METHOD_ID = "<YOUR_AUTH_METHOD_ID>"

MINIO_ADDR = "http://minio:9000"

MINIO_BUCKET_NAME = "<YOUR_MINIO_BUCKET_NAME>"

MINIO_ACCESS_KEY_ID = "<YOUR_MINIO_ACCESS_KEY_ID>"

MINIO_SECRET_ACCESS_KEY = "<YOUR_MINIO_SECRET_ACCESS_KEY>"

You copied the following environment variables from the mc mb and mc admin accesskey create output:

YOUR_MINIO_BUCKET_NAME
YOUR_MINIO_ACCESS_KEY_ID
YOUR_MINIO_SECRET_ACCESS_KEY

Set up a new org and project

Define the global scope ID, then create a new org named recording-test-org with an associated password auth method.

resource "boundary_scope" "global" {
  global_scope = true
  scope_id     = "global"
}

resource "boundary_scope" "recording_test_org" {
  name        = "recording-test-org"
  description = "Session recording test org"
  scope_id    = boundary_scope.global.id
  auto_create_admin_role   = true
  auto_create_default_role = true
}

resource "boundary_auth_method_password" "password" {
  name        = "org-password-auth"
  description = "Password auth method for org"
  type        = "password"
  scope_id    = boundary_scope.recording_test_org.id
}

Create a new project scope named recording-test-project within the recording-test-org.

resource "boundary_scope" "recording_test_project" {
  name                   = "recording-test-project"
  description            = "Project for session recording targets"
  scope_id               = boundary_scope.recording_test_org.id
  auto_create_admin_role = true
}

Create a credential store

Next, set up a static credential store.

resource "boundary_credential_store_static" "openssh_cred_store" {
  name        = "ssh-rdp-cred-store"
  scope_id    = boundary_scope.recording_test_project.id
}

Create target credentials

Static credentials can be added to the credential store, such as username/password, SSH private key, or JSON credentials.

Create a username/password credential for the SSH target associated with the openssh_cred_store credential store. You defined these credentials when you deployed the openssh Docker container.

resource "boundary_credential_username_password" "openssh_creds" {
  name                = "openssh-creds"
  credential_store_id = boundary_credential_store_static.openssh_cred_store.id
  username            = "ssh-admin"
  password            = "password"
}

Create a username/password/domain credential for the RDP target. Unlike the SSH credential, RDP credential injection requires a boundary_credential_username_password_domain resource. Set domain to "." for a local account that isn't joined to an Active Directory domain — this tells Boundary to authenticate using NTLMv2 against the target's local account database, instead of attempting Kerberos against a domain that doesn't exist.

These credentials match the default local administrator account (vagrant/vagrant) on the Vagrant-managed Windows VM you created in Deploy an RDP target.

resource "boundary_credential_username_password_domain" "rdp_creds" {
  name                = "rdp-creds"
  credential_store_id = boundary_credential_store_static.openssh_cred_store.id
  username            = "vagrant"
  password            = "vagrant"
  domain              = "."
}

These credentials match the built-in Administrator account. Substitute the password you decrypted in Retrieve the instance details.

resource "boundary_credential_username_password_domain" "rdp_creds" {
  name                = "rdp-creds"
  credential_store_id = boundary_credential_store_static.openssh_cred_store.id
  username            = "Administrator"
  password            = "<paste the decrypted password here>"
  domain              = "."
}

Enable session recording

To finish setting up session recording you need to:

Set up a Boundary storage bucket
Create an SSH target
Create an RDP target

The SSH and RDP targets require injected application credentials (supplied from the static credential store), and the Boundary storage bucket they should associate recordings with.

Create a storage bucket

Within Boundary, a storage bucket resource is used to store the recorded sessions. A storage bucket represents a bucket in an external store, in this case, MinIO. You must create a Boundary storage bucket associated with an external store before enabling session recording.

Navigate to the Global scope, and then the Storage Buckets page.
Click New Storage Bucket. Fill out the following details:
- Name: boundary-recording-bucket
- Scope: recording-test-org
- Provider: MinIO
- Endpoint URL: http://minio:9000
- Bucket name: boundary-recordings Note: this must match the name of the bucket in MinIO.
- Access key ID: YOUR_MINIO_ACCESS_KEY_ID
- Secret access key: YOUR_MINIO_SECRET_ACCESS_KEY
- Worker filter: "minio" in "/tags/type"
You copied the YOUR_MINIO_ACCESS_KEY_ID and YOUR_MINIO_SECRET_ACCESS_KEY values from the mc admin accesskey create output.
Note
Use http://minio:9000, not 127.0.0.1:9000. The Boundary worker runs in a Docker container on the boundary-local network alongside the minio container, so it can reach MinIO directly by container name. 127.0.0.1 inside the worker's container would refer to the container's own network namespace, not the minio container.
For the Worker Filter, specify a worker with access to the MinIO storage bucket. For this tutorial, the minio-worker was deployed locally using Docker to access the MinIO server, which is running in a separate container.
Select the worker tagged with "type" = ["minio", "openssh", "rdp"], which provides access to MinIO. The following filter will select this worker:
```
"minio" in "/tags/type"
```
Lastly, check the box next to Disable credential rotation.
Click Save.
If there are errors, double-check the Endpoint URL, Bucket name, Access keys, and Worker filter. If there are still problems, check the Access Key Policy for the MinIO bucket, and ensure the bucket name matches the Resource ARN.

To finish setting up recordings, create a target for the openssh-server container.

Navigate to the recording-test-org scope, and select the recording-test-project project.
Select the Targets page and click New.
Fill out the New Target form. Select a Type of SSH.
- Name: ssh-target
- Type: SSH
- Target Address: openssh-server
- Default Port: 2222
- Maximum Connections: -1
- Aliases: ssh.target
Note
Use openssh-server, the container's name, not 127.0.0.1. The Boundary worker reaches the SSH target over the boundary-local Docker network by container name.
Click Save.
Click the Workers tab. Click Edit worker filter for Egress workers.
An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.
Recall the tags associated with the minio-worker, which provides access to the openssh-server container:
```
Tags:
  Configuration:
    type: ["minio" "openssh" "rdp"]
  Canonical:
    type: ["minio" "openssh" "rdp"]
```
The tags for this worker are:
"type" = ["minio", "openssh", "rdp"]
An appropriate filter to select this worker is:
```
"openssh" in "/tags/type"
```
- Egress worker filter: "openssh" in "/tags/type"
Paste in the filter expression and click Save.

Next, add credential injection for the target.

Select the Injected Application Credentials tab for ssh-target.
Click +Add Injected Application Credentials.
Check the box next to the credential named openssh-creds, then click Add Injected Application Credentials.

Enable session recording

To enable session recording for the ssh-target:

Navigate back to the ssh-target Details page.
Under Session Recording, click Enable recording.
On the Enable Session Recording for Target page, toggle the switch next to Record sessions for this target.
For the Storage buckets, select the boundary-recording-bucket.
Click Save.

Under the ssh-target Details page, the boundary-recording-bucket should now be listed under Session Recording.

To finish setting up RDP recordings, create a target for the Windows VM you set up in Deploy an RDP target.

Navigate to the recording-test-org scope, and select the recording-test-project project.
Select the Targets page and click New.
Fill out the New Target form. Select a Type of RDP.
- Name: rdp-target
- Type: RDP
- Target Address: host.docker.internal
- Default Port: 53389
- Maximum Connections: -1
Note
Use host.docker.internal, not 127.0.0.1. The Boundary worker runs in a Docker container, so 127.0.0.1 would refer to the container's own network namespace instead of the host machine running your VirtualBox VM. See the note in Create the virtual machine for details.
- Target Address: $PUBLIC_IP (the AWS instance's public IP address from Retrieve the instance details)
- Default Port: 3389
- Maximum Connections: -1
- Aliases: rdp.target
Click Save.
Click the Workers tab. Click Edit worker filter for Egress workers.
Recall the tags associated with the minio-worker, which also provides access to your RDP target:
```
Tags:
  Configuration:
    type: ["minio" "openssh" "rdp"]
  Canonical:
    type: ["minio" "openssh" "rdp"]
```
The tags for this worker are:
"type" = ["minio", "openssh", "rdp"]
An appropriate filter to select this worker is:
```
"rdp" in "/tags/type"
```
- Egress worker filter: "rdp" in "/tags/type"
Paste in the filter expression and click Save.

Next, add credential injection for the RDP target.

Select the Injected Application Credentials tab for rdp-target.
Click +Add Injected Application Credentials.
Check the box next to the credential named rdp-creds, then click Add Injected Application Credentials.

Enable RDP session recording

To enable session recording for the rdp-target:

Navigate back to the rdp-target Details page.
Under Session Recording, click Enable recording.
On the Enable Session Recording for Target page, toggle the switch next to Record sessions for this target.
For the Storage buckets, select the boundary-recording-bucket.
Click Save.

Under the rdp-target Details page, the boundary-recording-bucket should now be listed under Session Recording.

Create a storage bucket

Within Boundary, a storage bucket resource stores the recorded sessions. A storage bucket represents a bucket in an external store, in this case, MinIO. You must create a Boundary storage bucket associated with an external store before enabling session recording.

The following details are needed to set up a Boundary storage bucket:

Name: boundary-recording-bucket
Scope: recording-test-org
Bucket name: YOUR_MINIO_BUCKET_NAME
Access key ID: YOUR_MINIO_ACCESS_KEY_ID
Secret access key: YOUR_MINIO_SECRET_ACCESS_KEY
Worker filter: "minio" in "/tags/type"

For the Worker Filter, specify a worker with access to the MinIO storage bucket.

Select the worker tagged with "type" = ["minio", "openssh"], which also provides access to the openssh target. The following filter will select this worker:

"minio" in "/tags/type"

Create a new storage bucket named boundary-recording-bucket. Set the plugin name to minio, the MinIO bucket name, and the worker filter. Pass disable_credential_rotation=true as an attribute, and the MINIO_ACCESS_KEY_ID and MINIO_SECRET_ACCESS_KEY as secrets.

Note

Use http://minio:9000 for the endpoint URL, not 127.0.0.1:9000. The Boundary worker runs in a Docker container on the boundary-local network alongside the minio container, so it can reach MinIO directly by container name. 127.0.0.1 inside the worker's container would refer to the container's own network namespace, not the minio container.

$ boundary storage-buckets create -scope-id $ORG_ID \
  -name "boundary-recording-bucket" \
  -plugin-name minio \
  -bucket-name ${MINIO_BUCKET_NAME} \
  -worker-filter '"minio" in "/tags/type"' \
  -attr endpoint_url="http://minio:9000" \
  -attr disable_credential_rotation=true \
  -secret access_key_id=${MINIO_ACCESS_KEY_ID} \
  -secret secret_access_key=${MINIO_SECRET_ACCESS_KEY}

Example output:

$ boundary storage-buckets create -scope-id $ORG_ID \
  -name "boundary-recording-bucket" \
  -plugin-name minio \
  -bucket-name ${MINIO_BUCKET_NAME} \
  -worker-filter '"minio" in "/tags/type"' \
  -attr endpoint_url="http://minio:9000" \
  -attr disable_credential_rotation=true \
  -secret access_key_id=${MINIO_ACCESS_KEY_ID} \
  -secret secret_access_key=${MINIO_SECRET_ACCESS_KEY}

Storage Bucket information:
  Bucket Name:                   boundary-recordings
  Created Time:                  Wed, 05 Aug 2026 11:38:08 MDT
  ID:                            sb_kpUzRj9J4p
  Name:                          boundary-recording-bucket
  Plugin ID:                     pl_VaZx2KuAS2
  Secrets HMAC:                  Etuytmn6FuqkQYgkVgCDVkxW1RAiGtTErJ6bSVombPyc
  Updated Time:                  Wed, 05 Aug 2026 11:38:08 MDT
  Version:                       1
  Worker Filter:                 "minio" in "/tags/type"

  Scope:
    ID:                          o_IcIMOX3itH
    Name:                        recording-test-org
    Parent Scope ID:             global
    Type:                        org

  Plugin:
    ID:                          pl_VaZx2KuAS2
    Name:                        minio

  Attributes:
    disable_credential_rotation: true
    endpoint_url:                http://minio:9000

  Authorized Actions:
    read
    update
    delete
    no-op

Copy the ID from the output and export it as the $STORAGE_BUCKET_ID variable.

$ export STORAGE_BUCKET_ID=sb_kpUzRj9J4p

Tip

If you have the jq utility installed, you can copy the output and export it in a single step with this command:

$ export STORAGE_BUCKET_ID=`boundary storage-buckets create -scope-id $ORG_ID -name "boundary-recording-bucket" -plugin-name minio -bucket-name $MINIO_BUCKET_NAME -worker-filter '"minio" in "/tags/type"' -attr endpoint_url="http://minio:9000" -attr disable_credential_rotation=true  -secret access_key_id=${MINIO_ACCESS_KEY_ID} -secret secret_access_key=${MINIO_SECRET_ACCESS_KEY} -format json | jq -r '.item.id'`

To finish setting up recordings, create a target for the openssh host.

An egress worker filter specifies which worker has access to the target, such as a worker deployed in the same network as the target. An ingress worker specifies how to route a Boundary client to the target network, and is not used in this example.

Recall the tags associated with the minio-worker, which also provides access to the openssh host:

Tags:
  Configuration:
    type: ["minio" "openssh" "rdp"]
  Canonical:
    type: ["minio" "openssh" "rdp"]

The tags for this worker are:

"type" = ["minio", "openssh", "rdp"]

An appropriate filter to select this worker is:

"openssh" in "/tags/type"

Create a new target of type ssh named ssh-target. Set the default port to 2222, enable session recording, and pass the storage bucket ID and egress worker filter.

Note

Use openssh-server, the container's name, not 127.0.0.1. The Boundary worker reaches the SSH target over the boundary-local Docker network by container name.

$ boundary targets create ssh -scope-id $PROJECT_ID \
  -name "ssh-target" \
  -with-alias-value "ssh.target" \
  -session-connection-limit -1 \
  -address "openssh-server" \
  -default-port 2222 \
  -egress-worker-filter '"openssh" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Example output:

$ boundary targets create ssh -scope-id $PROJECT_ID \
  -name "ssh-target" \
  -with-alias-value "ssh.target" \
  -session-connection-limit -1 \
  -address "openssh-server" \
  -default-port 2222 \
  -egress-worker-filter '"openssh" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true


Target information:
  Address:                    openssh-server
  Created Time:               Wed, 05 Aug 2026 11:38:09 MDT
  Egress Worker Filter:       "openssh" in "/tags/type"
  ID:                         tssh_DAg4AkKKmD
  Name:                       ssh-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       ssh
  Updated Time:               Wed, 05 Aug 2026 11:38:09 MDT
  Version:                    1

  Scope:
    ID:                       p_ZLeNx8ftbC
    Name:                     recording-test-project
    Parent Scope ID:          o_IcIMOX3itH
    Type:                     project

  Authorized Actions:
    add-host-sources
    remove-credential-sources
    update
    add-credential-sources
    set-credential-sources
    delete
    authorize-session
    read
    remove-host-sources
    no-op
    set-host-sources

  Aliases:
    ID:                       alt_oIzx41gzbV
    Value:                    ssh.target

  Attributes:
    Default Port:             2222
    Enable Session Recording: true
    Storage Bucket ID:        sb_kpUzRj9J4p

Copy the ID from the output and export it as the $TARGET_ID variable.

$ export TARGET_ID=tssh_DAg4AkKKmD

Tip

If you have the jq utility installed, you can copy the output and export it in a single step with this command:

$ export TARGET_ID=`boundary targets create ssh -scope-id $PROJECT_ID -name "ssh-target" -with-alias-value "ssh.target" -session-connection-limit -1 -address "openssh-server" -default-port 2222 -egress-worker-filter '"openssh" in "/tags/type"' -storage-bucket-id=$STORAGE_BUCKET_ID -enable-session-recording=true -format json | jq -r '.item.id'`

Now associate ssh-target with the SSH credential.

$ boundary targets add-credential-sources -id $TARGET_ID -injected-application-credential-source $SSH_CREDENTIAL_ID


Target information:
  Address:                    openssh-server
  Created Time:               Wed, 05 Aug 2026 11:38:09 MDT
  Egress Worker Filter:       "openssh" in "/tags/type"
  ID:                         tssh_DAg4AkKKmD
  Name:                       ssh-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       ssh
  Updated Time:               Wed, 05 Aug 2026 11:38:10 MDT
  Version:                    2

  Scope:
    ID:                       p_ZLeNx8ftbC
    Name:                     recording-test-project
    Parent Scope ID:          o_IcIMOX3itH
    Type:                     project

  Authorized Actions:
    delete
    remove-host-sources
    add-credential-sources
    no-op
    add-host-sources
    set-host-sources
    read
    remove-credential-sources
    authorize-session
    update
    set-credential-sources

  Injected Application Credential Sources:
    Credential Store ID:      csst_jlmy9TT7v9
    ID:                       credup_kSvc0NY2rF

  Attributes:
    Default Port:             2222
    Enable Session Recording: true
    Storage Bucket ID:        sb_kpUzRj9J4p

The SSH target now has injected credentials and a storage bucket configured. Session recording is fully enabled.

To finish setting up RDP recordings, create a target for the Windows VM you set up in Deploy an RDP target.

Recall the tags associated with the minio-worker, which also provides access to the Windows VM's forwarded RDP port:

Tags:
  Configuration:
    type: ["minio" "openssh" "rdp"]
  Canonical:
    type: ["minio" "openssh" "rdp"]

The tags for this worker are:

"type" = ["minio", "openssh", "rdp"]

An appropriate filter to select this worker is:

"rdp" in "/tags/type"

Create a new target of type rdp named rdp-target, enable session recording, and pass the storage bucket ID and egress worker filter. The address and default port depend on which RDP target you deployed.

Note

Use host.docker.internal as the target address, not 127.0.0.1. The Boundary worker runs in a Docker container, so 127.0.0.1 would refer to the container's own network namespace instead of the host machine running your VirtualBox VM. See the note in Create the virtual machine for details.

$ boundary targets create rdp -scope-id $PROJECT_ID \
  -name "rdp-target" \
  -with-alias-value "rdp.target" \
  -session-connection-limit -1 \
  -address "host.docker.internal" \
  -default-port 53389 \
  -egress-worker-filter '"rdp" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Example output:

$ boundary targets create rdp -scope-id $PROJECT_ID \
  -name "rdp-target" \
  -with-alias-value "rdp.target" \
  -session-connection-limit -1 \
  -address "host.docker.internal" \
  -default-port 53389 \
  -egress-worker-filter '"rdp" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Target information:
  Address:                    host.docker.internal
  Created Time:               Wed, 05 Aug 2026 11:39:57 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_Ehe8AQxTcp
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Wed, 05 Aug 2026 11:39:57 MDT
  Version:                    1

  Scope:
    ID:                       p_ZLeNx8ftbC
    Name:                     recording-test-project
    Parent Scope ID:          o_IcIMOX3itH
    Type:                     project

  Authorized Actions:
    add-host-sources
    remove-credential-sources
    update
    add-credential-sources
    set-credential-sources
    delete
    authorize-session
    read
    remove-host-sources
    no-op
    set-host-sources

  Aliases:
    ID:                       alt_QaxPSP59J1
    Value:                    rdp.target

  Attributes:
    Default Port:             53389
    Enable Session Recording: true
    Storage Bucket ID:        sb_kpUzRj9J4p

Copy the ID from the output and export it as the $RDP_TARGET_ID variable.

$ export RDP_TARGET_ID=trdp_Ehe8AQxTcp

Tip

If you have the jq utility installed, you can copy the output and export it in a single step with this command:

$ export RDP_TARGET_ID=`boundary targets create rdp -scope-id $PROJECT_ID -name "rdp-target" -with-alias-value "rdp.target" -session-connection-limit -1 -address "host.docker.internal" -default-port 53389 -egress-worker-filter '"rdp" in "/tags/type"' -storage-bucket-id=$STORAGE_BUCKET_ID -enable-session-recording=true -format json | jq -r '.item.id'`

Now associate rdp-target with the RDP credential.

$ boundary targets add-credential-sources -id $RDP_TARGET_ID -injected-application-credential-source $RDP_CREDENTIAL_ID

Target information:
  Address:                    host.docker.internal
  Created Time:               Wed, 05 Aug 2026 11:39:57 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_Ehe8AQxTcp
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Wed, 05 Aug 2026 11:39:58 MDT
  Version:                    2

  Scope:
    ID:                       p_ZLeNx8ftbC
    Name:                     recording-test-project
    Parent Scope ID:          o_IcIMOX3itH
    Type:                     project

  Authorized Actions:
    delete
    remove-host-sources
    add-credential-sources
    no-op
    add-host-sources
    set-host-sources
    read
    remove-credential-sources
    authorize-session
    update
    set-credential-sources

  Injected Application Credential Sources:
    Credential Store ID:      csst_jlmy9TT7v9
    ID:                       credupd_Dfg7Sc94It

  Attributes:
    Default Port:             53389
    Enable Session Recording: true
    Storage Bucket ID:        sb_kpUzRj9J4p

The RDP target now has injected credentials and a storage bucket configured. Session recording is fully enabled.

Use the AWS instance's public IP address ($PUBLIC_IP) as the target address, and port 3389.

In a production scenario, you would also deploy a worker in the same network as the target to proxy access and process session recordings. For this tutorial, we use the local Docker worker to proxy to the public instance IP address.

$ boundary targets create rdp -scope-id $PROJECT_ID \
  -name "rdp-target" \
  -with-alias-value "rdp.target" \
  -session-connection-limit -1 \
  -address "$PUBLIC_IP" \
  -default-port 3389 \
  -egress-worker-filter '"rdp" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Example output:

$ boundary targets create rdp -scope-id $PROJECT_ID \
  -name "rdp-target" \
  -with-alias-value "rdp.target" \
  -session-connection-limit -1 \
  -address "$PUBLIC_IP" \
  -default-port 3389 \
  -egress-worker-filter '"rdp" in "/tags/type"' \
  -storage-bucket-id=$STORAGE_BUCKET_ID \
  -enable-session-recording=true

Target information:
  Address:                    203.0.113.10
  Created Time:               Wed, 05 Aug 2026 11:40:33 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_PCmiYGbgp8
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Wed, 05 Aug 2026 11:40:33 MDT
  Version:                    1

  Scope:
    ID:                       p_ZLeNx8ftbC
    Name:                     recording-test-project
    Parent Scope ID:          o_IcIMOX3itH
    Type:                     project

  Authorized Actions:
    add-host-sources
    remove-credential-sources
    update
    add-credential-sources
    set-credential-sources
    delete
    authorize-session
    read
    remove-host-sources
    no-op
    set-host-sources

  Aliases:
    ID:                       alt_QaxPSP59J1
    Value:                    rdp.target

  Attributes:
    Default Port:             3389
    Enable Session Recording: true
    Storage Bucket ID:        sb_kpUzRj9J4p

Copy the ID from the output and export it as the $RDP_TARGET_ID variable.

$ export RDP_TARGET_ID=trdp_PCmiYGbgp8

Tip

If you have the jq utility installed, you can copy the output and export it in a single step with this command:

$ export RDP_TARGET_ID=`boundary targets create rdp -scope-id $PROJECT_ID -name "rdp-target" -with-alias-value "rdp.target" -session-connection-limit -1 -address "$PUBLIC_IP" -default-port 3389 -egress-worker-filter '"rdp" in "/tags/type"' -storage-bucket-id=$STORAGE_BUCKET_ID -enable-session-recording=true -format json | jq -r '.item.id'`

Now associate rdp-target with the RDP credential.

$ boundary targets add-credential-sources -id $RDP_TARGET_ID -injected-application-credential-source $RDP_CREDENTIAL_ID

Target information:
  Address:                    203.0.113.10
  Created Time:               Wed, 05 Aug 2026 11:40:33 MDT
  Egress Worker Filter:       "rdp" in "/tags/type"
  ID:                         trdp_PCmiYGbgp8
  Name:                       rdp-target
  Session Connection Limit:   -1
  Session Max Seconds:        28800
  Type:                       rdp
  Updated Time:               Wed, 05 Aug 2026 11:40:35 MDT
  Version:                    2

  Scope:
    ID:                       p_ZLeNx8ftbC
    Name:                     recording-test-project
    Parent Scope ID:          o_IcIMOX3itH
    Type:                     project

  Authorized Actions:
    delete
    remove-host-sources
    add-credential-sources
    no-op
    add-host-sources
    set-host-sources
    read
    remove-credential-sources
    authorize-session
    update
    set-credential-sources

  Injected Application Credential Sources:
    Credential Store ID:      csst_jlmy9TT7v9
    ID:                       credupd_D7V26vfq2a

  Attributes:
    Default Port:             3389
    Enable Session Recording: true
    Storage Bucket ID:        sb_kpUzRj9J4p

The RDP target now has injected credentials and a storage bucket configured. Session recording is fully enabled.

Create a storage bucket

To create a storage bucket, you need the following details:

Name: boundary-recording-bucket
Scope: recording-test-org
Bucket name: YOUR_MINIO_BUCKET_NAME
Endpoint URL: http://minio:9000
Access key ID: YOUR_MINIO_ACCESS_KEY_ID
Secret access key: YOUR_MINIO_SECRET_ACCESS_KEY
Worker filter: "minio" in "/tags/type"

You gathered the name of the MinIO bucket, YOUR_MINIO_ACCESS_KEY_ID, and YOUR_MINIO_SECRET_ACCESS_KEY from the mc admin accesskey create output.

These values should be defined in your boundary.tfvars file.

Note

MINIO_ADDR uses minio, the container's name on the boundary-local Docker network, not 127.0.0.1. The Boundary worker reaches MinIO by container name over that network.

learn-boundary-session-rec-minio/boundary.tfvars

MINIO_ADDR = "http://minio:9000"

MINIO_BUCKET_NAME = "<YOUR_MINIO_BUCKET_NAME>"

MINIO_ACCESS_KEY_ID = "<YOUR_MINIO_ACCESS_KEY_ID>"

MINIO_SECRET_ACCESS_KEY = "<YOUR_MINIO_SECRET_ACCESS_KEY>"

Save the boundary.tfvars file.

For the Worker Filter, a worker with access to the MinIO storage bucket is needed.

Select the worker tagged with "type" = ["minio", "openssh", "rdp"], which also provides access to the openssh and RDP targets. The following filter will select this worker:

"minio" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"minio\" in \"/tags/type\""

Create a new storage bucket with a plugin_name of minio and pass in the MINIO_BUCKET_NAME. Pass endpoint_url and disable_credential_rotation=trueas a JSON attributes, and MINIO_ACCESS_KEY_ID and MINIO_SECRET_ACCESS_KEY as JSON secrets. Lastly, supply the worker filter.

resource "boundary_storage_bucket" "minio_bucket" {
  name            = "boundary-recording-bucket"
  description     = "Session recording test bucket"
  scope_id        = boundary_scope.recording_test_org.id
  plugin_name     = "minio"
  bucket_name     = var.MINIO_BUCKET_NAME
  attributes_json = jsonencode({
    "endpoint_url" = "${var.MINIO_ADDR}",
    "disable_credential_rotation" = true
  })

  secrets_json = jsonencode({
    "access_key_id"     = "${var.MINIO_ACCESS_KEY_ID}",
    "secret_access_key" = "${var.MINIO_SECRET_ACCESS_KEY}"
  })
  
  worker_filter = "\"minio\" in \"/tags/type\""
}

Create a storage policy

A storage policy defines how long session recordings should be retained before they can be deleted. By default, recordings cannot be deleted until a storage policy allowing for it is attached to the org scope.

To delete session recordings, you must define a storage policy that allows for zero retention. In a real-world scenario, you would likely retain your recordings for an amount of time defined by your organization.

Create a storage policy that allows for immediate deletion:

resource "boundary_policy_storage" "recordings" {
  name              = "do-not-retain"
  description       = "delete after 1 day"
  scope_id          = boundary_scope.recording_test_org.id
  delete_after_days = 1
}

Attach the storage policy to your org:

resource "boundary_scope_policy_attachment" "attach_delete_policy" {
  scope_id  = boundary_scope.recording_test_org.id
  policy_id = boundary_policy_storage.recordings.id
}

Attaching the policy before any targets exist makes every recording eligible for deletion from the moment it's created. This lets terraform destroy clean up the storage bucket and org directly, without the manual policy workaround described in Cleanup and teardown.

To finish setting up recordings, create a target for the openssh host.

When you create a target, you can specify an egress worker filter. Targets with session recording enabled require an egress worker, because it stores the recording and uploads it to the storage bucket. The filter tells Boundary which worker is deployed in the same network as the target. An ingress worker is not used in this example.

Recall the tags associated with the minio-worker, which also provides access to the openssh host:

Tags:
  Configuration:
    type: ["minio" "openssh" "rdp"]
  Canonical:
    type: ["minio" "openssh" "rdp"]

The tags for this worker are:

"type" = ["minio", "openssh", "rdp"]

An appropriate filter to select this worker is:

"openssh" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"openssh\" in \"/tags/type\""

Create a new target with the following parameters:

type: ssh
name: ssh-target
default_port: 2222
address: openssh-server
egress_worker_filter: "\"openssh\" in \"/tags/type\""
injected_application_credential_source_ids: [boundary_credential_username_password.openssh_creds.id]
enable_session_recording: true
storage_bucket_id: boundary_storage_bucket.minio_bucket.id

Note

Use openssh-server, the container's name, not 127.0.0.1. The Boundary worker reaches the SSH target over the boundary-local Docker network by container name.

resource "boundary_target" "ssh_target" {
  name         = "ssh-target"
  description  = "SSH target"
  type         = "ssh"
  address      = "openssh-server"
  default_port = "2222"
  scope_id     = boundary_scope.recording_test_project.id
  egress_worker_filter     = "\"openssh\" in \"/tags/type\""
  injected_application_credential_source_ids = [
    boundary_credential_username_password.openssh_creds.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.minio_bucket.id
}

Create an alias so users can connect with boundary connect -target-id ssh.target instead of the target's generated ID. Target aliases are global-scoped resources, so scope_id must be "global".

resource "boundary_alias_target" "ssh_alias" {
  scope_id       = "global"
  value          = "ssh.target"
  destination_id = boundary_target.ssh_target.id
}

To finish setting up RDP recordings, create a target for the Windows VM you set up in Deploy an RDP target.

Recall the tags associated with the minio-worker, which also provides access to the Windows VM's forwarded RDP port:

Tags:
  Configuration:
    type: ["minio" "openssh" "rdp"]
  Canonical:
    type: ["minio" "openssh" "rdp"]

The tags for this worker are:

"type" = ["minio", "openssh", "rdp"]

An appropriate filter to select this worker is:

"rdp" in "/tags/type"

When using HCL, this filter must be rewritten using escape syntax:

"\"rdp\" in \"/tags/type\""

Create a new target with the following parameters. The address and default port depend on which RDP target you deployed.

type: rdp
name: rdp-target
egress_worker_filter: "\"rdp\" in \"/tags/type\""
injected_application_credential_source_ids: [boundary_credential_username_password_domain.rdp_creds.id]
enable_session_recording: true
storage_bucket_id: boundary_storage_bucket.minio_bucket.id

default_port: 53389
address: host.docker.internal

Note

resource "boundary_target" "rdp_target" {
  name         = "rdp-target"
  description  = "RDP target"
  type         = "rdp"
  address      = "host.docker.internal"
  default_port = "53389"
  scope_id     = boundary_scope.recording_test_project.id
  egress_worker_filter     = "\"rdp\" in \"/tags/type\""
  injected_application_credential_source_ids = [
    boundary_credential_username_password_domain.rdp_creds.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.minio_bucket.id
}

Create an alias so users can connect with boundary connect -target-id rdp.target instead of the target's generated ID.

resource "boundary_alias_target" "rdp_alias" {
  scope_id       = "global"
  value          = "rdp.target"
  destination_id = boundary_target.rdp_target.id
}

default_port: 3389
address: your AWS instance's public IP address from Retrieve the instance details

resource "boundary_target" "rdp_target" {
  name         = "rdp-target"
  description  = "RDP target"
  type         = "rdp"
  address      = "<your instance's public IP>"
  default_port = "3389"
  scope_id     = boundary_scope.recording_test_project.id
  egress_worker_filter     = "\"rdp\" in \"/tags/type\""
  injected_application_credential_source_ids = [
    boundary_credential_username_password_domain.rdp_creds.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.minio_bucket.id
}

Create an alias so users can connect with boundary connect -target-id rdp.target instead of the target's generated ID.

resource "boundary_alias_target" "rdp_alias" {
  scope_id       = "global"
  value          = "rdp.target"
  destination_id = boundary_target.rdp_target.id
}

Once all the Boundary provider resources have been added, save this file.

Expand the accordion below to see a completed version of the Terraform configuration files for Boundary. For reference, an example of these files with all resources commented out is also included with the lab repository, at learn-boundary-session-rec-minio/boundary-example.tf and learn-boundary-session-rec-minio/boundary-example.tfvars.

Completed Boundary provider config

This is a completed version of the boundary.tf file.

learn-boundary-session-rec-minio/boundary.tf

provider "boundary" {
  addr                   = var.BOUNDARY_ADDR
  auth_method_id         = var.BOUNDARY_AUTH_METHOD_ID
  auth_method_login_name = var.BOUNDARY_USERNAME
  auth_method_password   = var.BOUNDARY_PASSWORD
}

terraform {
  required_version = ">= 1.3.0"
  required_providers {
    boundary = {
      source  = "hashicorp/boundary",
      version = ">= 1.1.15"
    }
  }
}

variable "BOUNDARY_ADDR" {
    type = string
}

variable "BOUNDARY_AUTH_METHOD_ID" {
    type = string
}

variable "BOUNDARY_USERNAME" {
    type = string
}

variable "BOUNDARY_PASSWORD" {
    type = string
}

variable "MINIO_ADDR" {
    type = string
}

variable "MINIO_BUCKET_NAME" {
    type = string
}

variable "MINIO_ACCESS_KEY_ID" {
    type = string
}

variable "MINIO_SECRET_ACCESS_KEY" {
    type = string
}

resource "boundary_scope" "global" {
  global_scope = true
  scope_id     = "global"
}

resource "boundary_scope" "recording_test_org" {
  name        = "recording-test-org"
  description = "Session recording test org"
  scope_id    = boundary_scope.global.id
  auto_create_admin_role   = true
  auto_create_default_role = true
}

resource "boundary_auth_method_password" "password" {
  name        = "org-password-auth"
  description = "Password auth method for org"
  type        = "password"
  scope_id    = boundary_scope.recording_test_org.id
}

resource "boundary_scope" "recording_test_project" {
  name                   = "recording-test-project"
  description            = "Project for session recording targets"
  scope_id               = boundary_scope.recording_test_org.id
  auto_create_admin_role = true
}

resource "boundary_credential_store_static" "openssh_cred_store" {
  name        = "ssh-rdp-cred-store"
  scope_id    = boundary_scope.recording_test_project.id
}

resource "boundary_credential_username_password" "openssh_creds" {
  name                = "openssh-creds"
  credential_store_id = boundary_credential_store_static.openssh_cred_store.id
  username            = "ssh-admin"
  password            = "password"
}

# Shown for the VirtualBox RDP target. If you deployed the AWS RDP target instead,
# use username = "Administrator" and the password from "Retrieve the instance details".
resource "boundary_credential_username_password_domain" "rdp_creds" {
  name                = "rdp-creds"
  credential_store_id = boundary_credential_store_static.openssh_cred_store.id
  username            = "vagrant"
  password            = "vagrant"
  domain              = "."
}

resource "boundary_storage_bucket" "minio_bucket" {
  name            = "boundary-recording-bucket"
  description     = "Session recording test bucket"
  scope_id        = boundary_scope.recording_test_org.id
  plugin_name     = "minio"
  bucket_name     = var.MINIO_BUCKET_NAME
  attributes_json = jsonencode({
    "endpoint_url" = "${var.MINIO_ADDR}",
    "disable_credential_rotation" = true
  })

  secrets_json = jsonencode({
    "access_key_id"     = "${var.MINIO_ACCESS_KEY_ID}",
    "secret_access_key" = "${var.MINIO_SECRET_ACCESS_KEY}"
  })
  
  worker_filter = "\"minio\" in \"/tags/type\""
}

resource "boundary_policy_storage" "recordings" {
  name              = "do-not-retain"
  description       = "delete after 1 day"
  scope_id          = boundary_scope.recording_test_org.id
  delete_after_days = 1
}

resource "boundary_scope_policy_attachment" "attach_delete_policy" {
  scope_id  = boundary_scope.recording_test_org.id
  policy_id = boundary_policy_storage.recordings.id
}

resource "boundary_target" "ssh_target" {
  name         = "ssh-target"
  description  = "SSH target"
  type         = "ssh"
  address      = "openssh-server"
  default_port = "2222"
  scope_id     = boundary_scope.recording_test_project.id
  egress_worker_filter     = "\"openssh\" in \"/tags/type\""
  injected_application_credential_source_ids = [
    boundary_credential_username_password.openssh_creds.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.minio_bucket.id
}

resource "boundary_alias_target" "ssh_alias" {
  scope_id       = "global"
  value          = "ssh.target"
  destination_id = boundary_target.ssh_target.id
}

# Shown for the VirtualBox RDP target. If you deployed the AWS RDP target instead,
# use address = "<your instance's public IP>" and default_port = "3389".
resource "boundary_target" "rdp_target" {
  name         = "rdp-target"
  description  = "RDP target"
  type         = "rdp"
  address      = "host.docker.internal"
  default_port = "53389"
  scope_id     = boundary_scope.recording_test_project.id
  egress_worker_filter     = "\"rdp\" in \"/tags/type\""
  injected_application_credential_source_ids = [
    boundary_credential_username_password_domain.rdp_creds.id
  ]
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.minio_bucket.id
}

resource "boundary_alias_target" "rdp_alias" {
  scope_id       = "global"
  value          = "rdp.target"
  destination_id = boundary_target.rdp_target.id
}

output "org_id" {
  value = boundary_scope.recording_test_org.id
}

output "project_id" {
  value = boundary_scope.recording_test_project.id
}

output "storage_bucket_id" {
  value = boundary_storage_bucket.minio_bucket.id
}

output "storage_policy_id" {
  value = boundary_policy_storage.recordings.id
}

output "ssh_target_id" {
  value = boundary_target.ssh_target.id
}

output "rdp_target_id" {
  value = boundary_target.rdp_target.id
}

output "ssh_alias_id" {
  value = boundary_alias_target.ssh_alias.id
}

output "rdp_alias_id" {
  value = boundary_alias_target.rdp_alias.id
}

This is a completed version of the boundary.tfvars file.

learn-boundary-session-rec-minio/boundary.tfvars

BOUNDARY_ADDR = "<YOUR_BOUNDARY_ADDR>"

BOUNDARY_USERNAME = "<YOUR_ADMIN_USERNAME>"

BOUNDARY_PASSWORD = "<YOUR_ADMIN_PASSWORD>"

BOUNDARY_AUTH_METHOD_ID = "<YOUR_AUTH_METHOD_ID>"

MINIO_ADDR = "http://minio:9000"

MINIO_BUCKET_NAME = "<YOUR_MINIO_BUCKET_NAME>"

MINIO_ACCESS_KEY_ID = "<YOUR_MINIO_ACCESS_KEY_ID>"

MINIO_SECRET_ACCESS_KEY = "<YOUR_MINIO_SECRET_ACCESS_KEY>"

Apply Terraform

Note

The example output below reflects the VirtualBox RDP target's values (host.docker.internal, vagrant). If you deployed the AWS RDP target instead, your plan and apply output shows your instance's public IP address, port 3389, and the Administrator username in their place.

From the root of the learn-boundary-session-rec-minio, initialize Terraform.

$ terraform init

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/boundary versions matching ">= 1.1.15"...
- Installing hashicorp/boundary v1.6.0...
- Installed hashicorp/boundary v1.6.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Apply Terraform, passing in the required environment variables using the boundary.tfvars file.

$ terraform apply -var-file="boundary.tfvars"

Example output:

$ terraform apply -var-file="boundary.tfvars"

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # boundary_alias_target.rdp_alias will be created
  + resource "boundary_alias_target" "rdp_alias" {
      + destination_id = (known after apply)
      + id             = (known after apply)
      + scope_id       = "global"
      + type           = "target"
      + value          = "rdp.target"
    }

  # boundary_alias_target.ssh_alias will be created
  + resource "boundary_alias_target" "ssh_alias" {
      + destination_id = (known after apply)
      + id             = (known after apply)
      + scope_id       = "global"
      + type           = "target"
      + value          = "ssh.target"
    }

  # boundary_auth_method_password.password will be created
  + resource "boundary_auth_method_password" "password" {
      + description           = "Password auth method for org"
      + id                    = (known after apply)
      + min_login_name_length = (known after apply)
      + min_password_length   = (known after apply)
      + name                  = "org-password-auth"
      + scope_id              = (known after apply)
      + type                  = "password"
    }

  # boundary_credential_store_static.openssh_cred_store will be created
  + resource "boundary_credential_store_static" "openssh_cred_store" {
      + id       = (known after apply)
      + name     = "ssh-rdp-cred-store"
      + scope_id = (known after apply)
    }

  # boundary_credential_username_password.openssh_creds will be created
  + resource "boundary_credential_username_password" "openssh_creds" {
      + credential_store_id = (known after apply)
      + id                  = (known after apply)
      + name                = "openssh-creds"
      + password            = (sensitive value)
      + password_hmac       = (known after apply)
      + username            = "ssh-admin"
    }

  # boundary_credential_username_password_domain.rdp_creds will be created
  + resource "boundary_credential_username_password_domain" "rdp_creds" {
      + credential_store_id = (known after apply)
      + domain              = "."
      + id                  = (known after apply)
      + name                = "rdp-creds"
      + password            = (sensitive value)
      + password_hmac       = (known after apply)
      + username            = "vagrant"
    }

  # boundary_policy_storage.recordings will be created
  + resource "boundary_policy_storage" "recordings" {
      + delete_after_days = 1
      + description       = "delete after 1 day"
      + id                = (known after apply)
      + name              = "do-not-retain"
      + scope_id          = (known after apply)
    }

  # boundary_scope.global will be created
  + resource "boundary_scope" "global" {
      + global_scope = true
      + id           = (known after apply)
      + scope_id     = "global"
    }

  # boundary_scope.recording_test_org will be created
  + resource "boundary_scope" "recording_test_org" {
      + auto_create_admin_role   = true
      + auto_create_default_role = true
      + description              = "Session recording test org"
      + id                       = (known after apply)
      + name                     = "recording-test-org"
      + scope_id                 = (known after apply)
    }

  # boundary_scope.recording_test_project will be created
  + resource "boundary_scope" "recording_test_project" {
      + auto_create_admin_role = true
      + description            = "Project for session recording targets"
      + id                     = (known after apply)
      + name                   = "recording-test-project"
      + scope_id               = (known after apply)
    }

  # boundary_scope_policy_attachment.attach_delete_policy will be created
  + resource "boundary_scope_policy_attachment" "attach_delete_policy" {
      + id        = (known after apply)
      + policy_id = (known after apply)
      + scope_id  = (known after apply)
    }

  # boundary_storage_bucket.minio_bucket will be created
  + resource "boundary_storage_bucket" "minio_bucket" {
      + attributes_json                            = jsonencode(
            {
              + disable_credential_rotation = true
              + endpoint_url                = "http://minio:9000"
            }
        )
      + bucket_name                                = "boundary-recordings"
      + description                                = "Session recording test bucket"
      + id                                         = (known after apply)
      + internal_force_update                      = (known after apply)
      + internal_hmac_used_for_secrets_config_hmac = (known after apply)
      + internal_secrets_config_hmac               = (known after apply)
      + name                                       = "boundary-recording-bucket"
      + plugin_id                                  = (known after apply)
      + plugin_name                                = "minio"
      + scope_id                                   = (known after apply)
      + secrets_hmac                               = (known after apply)
      + secrets_json                               = (sensitive value)
      + worker_filter                              = "\"minio\" in \"/tags/type\""
    }

  # boundary_target.ssh_target will be created
  + resource "boundary_target" "ssh_target" {
      + address                                    = "openssh-server"
      + default_port                               = 2222
      + description                                = "SSH target"
      + egress_worker_filter                       = "\"openssh\" in \"/tags/type\""
      + enable_session_recording                   = true
      + id                                         = (known after apply)
      + injected_application_credential_source_ids = (known after apply)
      + name                                       = "ssh-target"
      + scope_id                                   = (known after apply)
      + session_connection_limit                   = (known after apply)
      + session_max_seconds                        = (known after apply)
      + storage_bucket_id                          = (known after apply)
      + type                                       = "ssh"
    }

  # boundary_target.rdp_target will be created
  + resource "boundary_target" "rdp_target" {
      + address                                    = "host.docker.internal"
      + default_port                               = 53389
      + description                                = "RDP target"
      + egress_worker_filter                       = "\"rdp\" in \"/tags/type\""
      + enable_session_recording                   = true
      + id                                         = (known after apply)
      + injected_application_credential_source_ids = (known after apply)
      + name                                       = "rdp-target"
      + scope_id                                   = (known after apply)
      + session_connection_limit                   = (known after apply)
      + session_max_seconds                        = (known after apply)
      + storage_bucket_id                          = (known after apply)
      + type                                       = "rdp"
    }

Plan: 14 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + org_id            = (known after apply)
  + project_id        = (known after apply)
  + rdp_alias_id      = (known after apply)
  + rdp_target_id     = (known after apply)
  + ssh_alias_id      = (known after apply)
  + ssh_target_id     = (known after apply)
  + storage_bucket_id = (known after apply)
  + storage_policy_id = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

boundary_scope.global: Creating...
boundary_scope.global: Creation complete after 1s [id=global]
boundary_scope.recording_test_org: Creating...
boundary_scope.recording_test_org: Creation complete after 1s [id=o_65DURnHray]
boundary_scope.recording_test_project: Creating...
boundary_auth_method_password.password: Creating...
boundary_policy_storage.recordings: Creating...
boundary_storage_bucket.minio_bucket: Creating...
boundary_auth_method_password.password: Creation complete after 0s [id=ampw_7Kb3jCJ9wr]
boundary_scope.recording_test_project: Creation complete after 0s [id=p_DAs445MvJO]
boundary_credential_store_static.openssh_cred_store: Creating...
boundary_credential_store_static.openssh_cred_store: Creation complete after 0s [id=csst_nNuiDQTJ8e]
boundary_credential_username_password.openssh_creds: Creating...
boundary_credential_username_password_domain.rdp_creds: Creating...
boundary_credential_username_password.openssh_creds: Creation complete after 0s [id=credup_SXX8AVlfCl]
boundary_credential_username_password_domain.rdp_creds: Creation complete after 0s [id=credupd_hhq9OuQgkN]
boundary_policy_storage.recordings: Creation complete after 1s [id=pst_D5gdw062L2]
boundary_scope_policy_attachment.attach_delete_policy: Creating...
boundary_scope_policy_attachment.attach_delete_policy: Creation complete after 0s [id=pst_D5gdw062L2:o_65DURnHray]
boundary_storage_bucket.minio_bucket: Creation complete after 0s [id=sb_6OGh5h6RKD]
boundary_target.ssh_target: Creating...
boundary_target.rdp_target: Creating...
boundary_target.rdp_target: Creation complete after 0s [id=trdp_UC5ZWypXG7]
boundary_target.ssh_target: Creation complete after 0s [id=tssh_6FgFuzx6RM]
boundary_alias_target.rdp_alias: Creating...
boundary_alias_target.ssh_alias: Creating...
boundary_alias_target.rdp_alias: Creation complete after 0s [id=alt_aPvh1k8olF]
boundary_alias_target.ssh_alias: Creation complete after 0s [id=alt_54EXCyWT9u]

Apply complete! Resources: 14 added, 0 changed, 0 destroyed.

Outputs:

org_id = "o_65DURnHray"
project_id = "p_DAs445MvJO"
rdp_alias_id = "alt_aPvh1k8olF"
rdp_target_id = "trdp_UC5ZWypXG7"
ssh_alias_id = "alt_54EXCyWT9u"
ssh_target_id = "tssh_6FgFuzx6RM"
storage_bucket_id = "sb_6OGh5h6RKD"
storage_policy_id = "pst_D5gdw062L2"

Terraform prints the output values from boundary.tf at the end of the apply. You can also retrieve them at any time with terraform output. The boundary session-recordings commands used later need the $ORG_ID environment variable, so export it now from the Terraform output:

$ export ORG_ID=$(terraform output -raw org_id)

Record a session

Now you are ready to test session recording for the ssh-target and rdp-target.

To log in to Boundary using the Desktop app, you must gather the BOUNDARY_ADDR values from the HCP Boundary Admin Console.

Check the value of BOUNDARY_ADDR in the terminal session where Terraform was applied.

$ echo $BOUNDARY_ADDR
https://d2a6e010-ba05-431a-b7f2-5cbc4e1e9f06.boundary.hashicorp.cloud

Open the Boundary Desktop app.

Enter the Boundary cluster URL (for example, https://d2a6e010-ba05-431a-b7f2-5cbc4e1e9f06.boundary.hashicorp.cloud) and click Submit.

Authenticate using your HCP Boundary admin credentials.

Boundary Desktop cluster URL

On the Targets page, notice the target details for ssh-target.

Boundary Desktop Client Targets Page Boundary Desktop Clients Target Page

Click Connect to initiate a session.

The Successfully Connected page displays the target ID (Target Connection details) and Proxy URL.

To start a session, click the Shell tab, or open your terminal or SSH client of choice. You can start a session using SSH and the Proxy URL from the Boundary Desktop app.

If you use your own client, connect on 127.0.0.1 and provide the proxy port using the -p option. Enter yes when prompted to establish a connection.

$ ssh 127.0.0.1 -p 53361 -o NoHostAuthenticationForLocalhost=yes
~ % ssh 127.0.0.1 -p 53361 -o NoHostAuthenticationForLocalhost=yes
Welcome to OpenSSH Server
a7f717a4cee9:~

Type some simple commands you will recognize when playing back the recording, like pwd or whoami. When finished, you can close the connection to the server by entering exit, or you can cancel the session directly from the Boundary Desktop app under the Sessions view.

To test RDP session recording, find the rdp-target on the Targets page and click Connect. The Desktop app displays a proxy port, and may launch your RDP client and connect automatically. You may be prompted to accept a certificate.

If your RDP client doesn't automatically launch, open your RDP client manually (such as Windows App) and connect to 127.0.0.1 using the displayed proxy port. Leave the credentials blank, since Boundary injects them directly into the session.

Perform some actions in the RDP session, then close the RDP client. Then open the Boundary Desktop Client and click the Cancel Session.

Run boundary connect, which has a helper called ssh.

Enter yes when prompted to establish the connection.

$ boundary connect ssh -target-id $TARGET_ID
Welcome to OpenSSH Server
3fe7e57f5505:~$

Enter some commands, such as whoami.

When finished, close the connection to the server using exit.

To test RDP session recording, use boundary connect rdp to connect to the rdp-target.

$ boundary connect rdp -target-id $RDP_TARGET_ID

This opens your default RDP client connected through the Boundary proxy. If your RDP client doesn't automatically launch, open your RDP client manually (such as Windows App) and connect to 127.0.0.1 using the displayed proxy port. Leave the credentials blank, since Boundary injects them directly into the session.

Perform some actions in the RDP session, then close the RDP client. Then open the Boundary Desktop Client and click the Cancel Session.

View the recordings

You can view a list of all recorded sessions, or if you know the ID of a specific recorded session, you can find any channels associated with that recording.

To play back a session, open the Admin Console Web UI, and re-authenticate as the admin user if necessary.

From the global scope, navigate to the Session Recordings page.

Note that the following details are listed for each recording:

Time
Status
User
Target
Duration

Click View next to the recording.

Within the Session Playback page, click Play for Channel 1.

After the recording loads, hover your mouse on the video player and click the play button to start playback.

Note the Channel details on the right, which display the duration and bytes up / bytes down.

Validate the recording (optional)

A session recording represents a directory structure of files in an external object store that together are the recording of a single session between a user and a target.

To validate a session recording and download it, you can use the CLI.

First, set the BOUNDARY_ADDR and BOUNDARY_AUTH_METHOD_ID environment variables in your shell session. Replace the example address and auth method ID with the values for your cluster.

$ export BOUNDARY_ADDR="https://c3a7a20a-f663-40f3-a8e3-1b2f69b36254.boundary.hashicorp.cloud"

$ export BOUNDARY_AUTH_METHOD_ID="ampw_KfLAjMS2CG"

$ boundary authenticate
Please enter the login name (it will be hidden):
Please enter the password (it will be hidden):
Authentication information:
  Account ID:      acctpw_kYOiyf8bmM
  Auth Method ID:  ampw_Vm9CQotObN
  Expiration Time: Tue, 11 Aug 2026 16:05:57 MDT
  User ID:         u_aa6IHWzDZW

The token name "default" was successfully stored in the chosen keyring and is not displayed here.

Verify that the recording exists.

$ boundary session-recordings list -scope-id $ORG_ID

Session Recording information:
  ID:                    sr_mWiWIMI31a
    Session ID:          s_xZxmb35J2O
    Storage Bucket ID:   sb_kpUzRj9J4p
    Created Time:        Wed, 05 Aug 2026 11:39:03 MDT
    Updated Time:        Wed, 05 Aug 2026 11:39:07 MDT
    Start Time:          Wed, 05 Aug 2026 11:39:03 MDT
    End Time:            Wed, 05 Aug 2026 11:39:07 MDT
    Type:                ssh
    State:               available
    Availability:        available
    Storage State:       synced
    Retain Until:        Forever
    Authorized Actions:
      no-op
      read
      download
      delete
      reapply-storage-policy
      export
      export:cancel

Read the recording's details.

$ boundary session-recordings read -id sr_mWiWIMI31a

Session Recording information:
  Availability:         available
  Bytes Down:           92
  Bytes Up:             12
  Created Time:         Wed, 05 Aug 2026 11:39:03 MDT
  Duration (Seconds):   3.625892
  Endpoint:             ssh://openssh-server:2222
  ID:                   sr_mWiWIMI31a
  Retain Until:         Forever
  Scope ID:             o_IcIMOX3itH
  Session ID:           s_xZxmb35J2O
  Start Time:           Wed, 05 Aug 2026 11:39:03 MDT
  State:                available
  Storage Bucket ID:    sb_kpUzRj9J4p
  Type:                 ssh
  Updated Time:         Wed, 05 Aug 2026 11:39:07 MDT
  Recording State:
    Storage State:      synced

  Scope:
    ID:                 o_IcIMOX3itH
    Name:               recording-test-org
    Parent Scope ID:    global
    Type:               org

  Authorized Actions:
    reapply-storage-policy
    no-op
    read
    download
    delete
    export
    export:cancel

  User Info:
    Description:         Global admin user
    ID:                  u_aa6IHWzDZW
    Name:                admin
    Scope:
      ID:                global
      Name:              global
      Type:              global

  Target Info:
    Default Port:               2222
    Egress Worker Filter:       "openssh" in "/tags/type"
    ID:                         tssh_DAg4AkKKmD
    Name:                       ssh-target
    Session Connection Limit:   -1
    Session Max Seconds:        28800
    Target Type:                ssh
    Scope:
      ID:                       p_ZLeNx8ftbC
      Name:                     recording-test-project
      Parent Scope ID:          o_IcIMOX3itH
      Type:                     project

  Credentials:
    ID:                credup_kSvc0NY2rF
    Name:              openssh credentials
    Purpose:           injected_application
    Type:              username_password
    Username:          ssh-admin

    Credential Store:
      ID:                csst_jlmy9TT7v9
      Name:              SSH and RDP Credentials
      Scope ID:          p_ZLeNx8ftbC
      Type:              static


  Connection Recordings:
    Bytes Down:         92
    Bytes Up:           12
    Created Time:       Wed, 05 Aug 2026 11:39:03 MDT
    Duration (Seconds): 1.787606
    End Time:           Wed, 05 Aug 2026 11:39:05 MDT
    ID:                 cr_owFOPmttPM
    Start Time:         Wed, 05 Aug 2026 11:39:03 MDT
    Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
    Recording State:
      Storage State:      synced

    Channel Recordings:
      Bytes Down:         92
      Bytes Up:           12
      Created Time:       Wed, 05 Aug 2026 11:39:05 MDT
      Duration (Seconds): 1.327164
      End Time:           Wed, 05 Aug 2026 11:39:05 MDT
      ID:                 chr_yhDsU1xJa8
      Mime Types:         application/x-asciicast
      Start Time:         Wed, 05 Aug 2026 11:39:04 MDT
      Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
      Recording State:
        Storage State:      synced

Note the Channel Recordings, labeled Mime Types: application/x-asciicast (ID chr_yhDsU1xJa8 in this example). Downloading this recording produces a .cast file, which can be played back locally using asciinema.

If you want to download this file, execute the following command:

$ boundary session-recordings download -id chr_yhDsU1xJa8

This command does not print any output. Instead, it writes the recording to a file in the current directory named after the recording ID with a .cast or .webm extension, such as chr_yhDsU1xJa8.cast. Use the -output flag (aliased as -o) to specify a different file, or -output - to write to standard output instead.

BSR files

The Boundary Session Recording (BSR) file defines a hierarchical directory structure of files and a binary file format. It contains all the data transmitted between a user and a target during a single session.

Boundary stores the recordings within the external storage bucket as BSR files.

A BSR connections directory contains a summary of connections, as well as inbound and outbound requests. If you use a multiplexed protocol, there are subdirectories for the channels.

The asciicast format is well suited for the playback of interactive shell activity, but some aspects of the recording cannot be translated into asciicast. For example, if an SSH session uses the RemoteCommand option, or is used to exec a command, the command is not displayed in the asciicast. The output of the command may be displayed, though.

If you use SSH for something other than an interactive shell, such as for file transfer, X11 forwarding, or port forwarding, Boundary does not attempt to create an asciicast.

In all cases, the SSH session is still recorded in the BSR file and you can view the BSR file in the external storage bucket.

Cleanup and teardown

Stop the openssh-server, minio, and boundary-enterprise worker containers.
Open the Docker Desktop app and locate the containers used in this tutorial. These include:
- openssh-server
- minio
- boundary-enterprise-ffmpeg
Click the trash icon next to each, and confirm to stop and remove them.
Alternatively, open a shell session and destroy each container individually:
```
$ docker rm -f openssh-server minio boundary-worker
```
If you completed the RDP steps in this tutorial, tear down the Windows RDP target.
Destroy the Vagrant-managed Windows VM. From the directory containing your Vagrantfile:
$ vagrant destroy
Terminate the EC2 instance, either from the AWS Console or the CLI:
$ aws ec2 terminate-instances --instance-ids $INSTANCE_ID
You may also want to remove the security group and key pair created for the instance:
$ aws ec2 delete-security-group --group-id $SECURITY_GROUP_ID $ aws ec2 delete-key-pair --key-name boundary-rdp-target

Destroy the Boundary resources.

From the Admin Console Web UI, destroy the following resources:

Session recordings
SSH and RDP targets
Storage bucket
Org (also deletes credential store)
Boundary worker

Orgs cannot be deleted until the session recordings they contain are deleted.

To delete a recording, it must have a storage policy applied that allows deletion. By default, a recording has its retention policy set to Forever.

Create a new session recording retention policy that allows for deletion.

Select the recording-test-org org from the top navigation bar.
Select Storage Policies from the left navigation panel. Click Create a new storage policy.
Fill in the form details:
- Name: do-not-retain
- Description: delete after 1 day
- Retention Policy: Do not protect, allow deletion at any time
- Deletion Policy: Custom
- Delete after: 1 days
Click Save.
Add the storage policy to the org.
From the left navigation panel, select Org Settings.
Click Add Storage Policy.
From the Add Storage Policy page, select the do-not-retain policy. Click Save.
Re-apply the storage policy to the session recording.
Navigate back to the Global scope and select Session Recordings from the left navigation panel.
Open a recording by clicking on View next to the recording. Under the Manage dropdown, select Re-apply storage policy.
Delete the session recording.
Click the Manage dropdown again, then select Delete recording and confirm the operation by clicking OK.
Follow this process for any remaining recordings.
Delete the SSH and RDP target resources, or disable session recording for them. A storage bucket cannot be deleted if a target is configured to save sessions to it.
Delete the storage bucket.
Navigate to Storage Buckets in the Global scope. Select the test bucket and click the Manage dropdown again, then select Delete and confirm the operation by clicking OK.
Continue deleting the other resources.

Clean up the following Boundary resources:

Session recordings
SSH and RDP targets
Storage bucket
Org (also deletes credential store)
Boundary worker

Orgs cannot be deleted until the session recordings they contain are deleted.

To delete a recording, it must have a storage policy applied that allows deletion. By default, a recording has its retention policy set to Forever.

Create a new session recording retention policy that allows for deletion, then delete the session recordings.

Create a new storage policy in the recording-test-org that sets retention to 0 days, and deletes recordings after 1 day.

$ boundary policies create storage \
  -name do-not-retain \
  -description 'delete after 1 day' \
  -scope-id $ORG_ID \
  -retain-for-days 0 \
  -delete-after-days 1

Copy the storage policy ID (such as pst_Hth6mTzMPC). Then attach the storage policy to the org.

$ boundary scopes attach-storage-policy \
  -id $ORG_ID \
  -storage-policy-id pst_Hth6mTzMPC

Re-apply the storage policy to a session recording.

Read the details of an existing session recording.

List the session recordings in the recording-test-org.

$ boundary session-recordings list -scope-id $ORG_ID

Session Recording information:
  ID:                    sr_mWiWIMI31a
    Session ID:          s_xZxmb35J2O
    Storage Bucket ID:   sb_kpUzRj9J4p
    Created Time:        Wed, 05 Aug 2026 11:39:03 MDT
    Updated Time:        Wed, 05 Aug 2026 11:39:07 MDT
    Start Time:          Wed, 05 Aug 2026 11:39:03 MDT
    End Time:            Wed, 05 Aug 2026 11:39:07 MDT
    Type:                ssh
    State:               available
    Availability:        available
    Storage State:       synced
    Retain Until:        Forever
    Authorized Actions:
      reapply-storage-policy
      export
      export:cancel
      no-op
      read
      download
      delete

Copy the ID of the recording and read its details.

$ boundary session-recordings read -id sr_mWiWIMI31a

Session Recording information:
  Availability:         available
  Bytes Down:           92
  Bytes Up:             12
  Created Time:         Wed, 05 Aug 2026 11:39:03 MDT
  Duration (Seconds):   3.625892
  Endpoint:             ssh://openssh-server:2222
  ID:                   sr_mWiWIMI31a
  Retain Until:         Forever
  Scope ID:             o_IcIMOX3itH
  Session ID:           s_xZxmb35J2O
  Start Time:           Wed, 05 Aug 2026 11:39:03 MDT
  State:                available
  Storage Bucket ID:    sb_kpUzRj9J4p
  Type:                 ssh
  Updated Time:         Wed, 05 Aug 2026 11:39:07 MDT
  Recording State:
    Storage State:       synced

  Scope:
    ID:                 o_IcIMOX3itH
    Name:               recording-test-org
    Parent Scope ID:    global
    Type:               org

  Authorized Actions:
    read
    download
    delete
    reapply-storage-policy
    export
    export:cancel
    no-op

  User Info:
    Description:         Global admin user
    ID:                  u_aa6IHWzDZW
    Name:                admin
    Scope:
      ID:                global
      Name:              global
      Type:              global

  Target Info:
    Default Port:               2222
    Egress Worker Filter:       "openssh" in "/tags/type"
    ID:                         tssh_DAg4AkKKmD
    Name:                       ssh-target
    Session Connection Limit:   -1
    Session Max Seconds:        28800
    Scope:
      ID:                       p_ZLeNx8ftbC
      Name:                     recording-test-project
      Parent Scope ID:          o_IcIMOX3itH
      Type:                     project

  Credentials:
    ID:                credup_kSvc0NY2rF
    Name:              openssh credentials
    Purpose:           injected_application
    Type:              username_password
    Username:          ssh-admin

    Credential Store:
      ID:                csst_jlmy9TT7v9
      Name:              SSH and RDP Credentials
      Scope ID:          p_ZLeNx8ftbC
      Type:              static


  Connection Recordings:
    Bytes Down:         92
    Bytes Up:           12
    Created Time:       Wed, 05 Aug 2026 11:39:03 MDT
    Duration (Seconds): 1.787606
    End Time:           Wed, 05 Aug 2026 11:39:05 MDT
    ID:                 cr_owFOPmttPM
    Start Time:         Wed, 05 Aug 2026 11:39:03 MDT
    Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
    Recording State:
      Storage State:      synced

    Channel Recordings:
      Bytes Down:         92
      Bytes Up:           12
      Created Time:       Wed, 05 Aug 2026 11:39:05 MDT
      Duration (Seconds): 1.327164
      End Time:           Wed, 05 Aug 2026 11:39:05 MDT
      ID:                 chr_yhDsU1xJa8
      Mime Types:         application/x-asciicast
      Start Time:         Wed, 05 Aug 2026 11:39:04 MDT
      Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
      Recording State:
        Storage State:      synced

Notice the Retain until: Forever attribute in the output.

Now re-apply the new do-not-retain policy.

$ boundary session-recordings reapply-storage-policy -id sr_mWiWIMI31a

Session Recording information:
  Availability:         available
  Bytes Down:           92
  Bytes Up:             12
  Created Time:         Wed, 05 Aug 2026 11:39:03 MDT
  Delete After:         Thu, 06 Aug 2026 11:39:07 MDT
  Duration (Seconds):   3.625892
  Endpoint:             ssh://openssh-server:2222
  ID:                   sr_mWiWIMI31a
  Scope ID:             o_IcIMOX3itH
  Session ID:           s_xZxmb35J2O
  Start Time:           Wed, 05 Aug 2026 11:39:03 MDT
  State:                available
  Storage Bucket ID:    sb_kpUzRj9J4p
  Type:                 ssh
  Updated Time:         Wed, 05 Aug 2026 11:39:07 MDT
  Recording State:
    Storage State:       synced

  Scope:
    ID:                 o_IcIMOX3itH
    Name:               recording-test-org
    Parent Scope ID:    global
    Type:               org

  Authorized Actions:
    no-op
    read
    download
    delete
    reapply-storage-policy
    export
    export:cancel

  User Info:
    Description:         Global admin user
    ID:                  u_aa6IHWzDZW
    Name:                admin
    Scope:
      ID:                global
      Name:              global
      Type:              global

  Target Info:
    Egress Worker Filter:       "openssh" in "/tags/type"
    ID:                         tssh_DAg4AkKKmD
    Name:                       ssh-target
    Session Connection Limit:   -1
    Session Max Seconds:        28800
    Scope:
      ID:                       p_ZLeNx8ftbC
      Name:                     recording-test-project
      Parent Scope ID:          o_IcIMOX3itH
      Type:                     project

  Credentials:
    ID:                credup_kSvc0NY2rF
    Name:              openssh credentials
    Purpose:           injected_application
    Type:              username_password

    Credential Store:
      ID:                csst_jlmy9TT7v9
      Name:              SSH and RDP Credentials
      Scope ID:          p_ZLeNx8ftbC
      Type:              static


  Connection Recordings:
    Bytes Down:         92
    Bytes Up:           12
    Created Time:       Wed, 05 Aug 2026 11:39:03 MDT
    Duration (Seconds): 1.787606
    End Time:           Wed, 05 Aug 2026 11:39:05 MDT
    ID:                 cr_owFOPmttPM
    Start Time:         Wed, 05 Aug 2026 11:39:03 MDT
    Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
    Recording State:
      Storage State:      synced

    Channel Recordings:
      Bytes Down:         92
      Bytes Up:           12
      Created Time:       Wed, 05 Aug 2026 11:39:05 MDT
      Duration (Seconds): 1.327164
      End Time:           Wed, 05 Aug 2026 11:39:05 MDT
      ID:                 chr_yhDsU1xJa8
      Mime Types:         application/x-asciicast
      Start Time:         Wed, 05 Aug 2026 11:39:04 MDT
      Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
      Recording State:
        Storage State:      synced

The Delete After line should now be set for 1 day after the date listed for the Created Time.

Read the recording details again.

$ boundary session-recordings read -id sr_mWiWIMI31a

Session Recording information:
  Availability:         available
  Bytes Down:           92
  Bytes Up:             12
  Created Time:         Wed, 05 Aug 2026 11:39:03 MDT
  Delete After:         Thu, 06 Aug 2026 11:39:07 MDT
  Duration (Seconds):   3.625892
  Endpoint:             ssh://openssh-server:2222
  ID:                   sr_mWiWIMI31a
  Scope ID:             o_IcIMOX3itH
  Session ID:           s_xZxmb35J2O
  Start Time:           Wed, 05 Aug 2026 11:39:03 MDT
  State:                available
  Storage Bucket ID:    sb_kpUzRj9J4p
  Type:                 ssh
  Updated Time:         Wed, 05 Aug 2026 11:39:07 MDT
  Recording State:
    Storage State:       synced

  Scope:
    ID:                 o_IcIMOX3itH
    Name:               recording-test-org
    Parent Scope ID:    global
    Type:               org

  Authorized Actions:
    read
    download
    delete
    reapply-storage-policy
    export
    export:cancel
    no-op

  User Info:
    Description:         Global admin user
    ID:                  u_aa6IHWzDZW
    Name:                admin
    Scope:
      ID:                global
      Name:              global
      Type:              global

  Target Info:
    Default Port:               2222
    Egress Worker Filter:       "openssh" in "/tags/type"
    ID:                         tssh_DAg4AkKKmD
    Name:                       ssh-target
    Session Connection Limit:   -1
    Session Max Seconds:        28800
    Scope:
      ID:                       p_ZLeNx8ftbC
      Name:                     recording-test-project
      Parent Scope ID:          o_IcIMOX3itH
      Type:                     project

  Credentials:
    ID:                credup_kSvc0NY2rF
    Name:              openssh credentials
    Purpose:           injected_application
    Type:              username_password
    Username:          ssh-admin

    Credential Store:
      ID:                csst_jlmy9TT7v9
      Name:              SSH and RDP Credentials
      Scope ID:          p_ZLeNx8ftbC
      Type:              static


  Connection Recordings:
    Bytes Down:         92
    Bytes Up:           12
    Created Time:       Wed, 05 Aug 2026 11:39:03 MDT
    Duration (Seconds): 1.787606
    End Time:           Wed, 05 Aug 2026 11:39:05 MDT
    ID:                 cr_owFOPmttPM
    Start Time:         Wed, 05 Aug 2026 11:39:03 MDT
    Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
    Recording State:
      Storage State:      synced

    Channel Recordings:
      Bytes Down:         92
      Bytes Up:           12
      Created Time:       Wed, 05 Aug 2026 11:39:05 MDT
      Duration (Seconds): 1.327164
      End Time:           Wed, 05 Aug 2026 11:39:05 MDT
      ID:                 chr_yhDsU1xJa8
      Mime Types:         application/x-asciicast
      Start Time:         Wed, 05 Aug 2026 11:39:04 MDT
      Updated Time:       Wed, 05 Aug 2026 11:39:07 MDT
      Recording State:
        Storage State:      synced

The Delete after line should now show the same date from the storage policy re-application. You can now delete the session recording.

Delete the session recordings.

$ boundary session-recordings delete -id sr_mWiWIMI31a
The delete operation completed successfully.

Complete this process for all the session recordings in the org.

Delete the SSH and RDP targets, or disable session recording for them. A storage bucket cannot be deleted if a target is configured to save sessions to it.
```
$ boundary targets delete -id $TARGET_ID
$ boundary targets delete -id $RDP_TARGET_ID
```
Note
Deleting a target does not delete its alias. Aliases are global-scoped resources that outlive the target (and even the org) that created them. If you created the ssh-target with -with-alias-value "ssh.target" and the rdp-target with -with-alias-value "rdp.target", delete both aliases too, or a future boundary targets create using the same alias value fails with an "already exists" error.
$ boundary aliases list -scope-id global -format json | jq -r '.items[] | select(.value=="ssh.target") | .id' $ boundary aliases delete -id <alias-id-from-above> $ boundary aliases list -scope-id global -format json | jq -r '.items[] | select(.value=="rdp.target") | .id' $ boundary aliases delete -id <alias-id-from-above>

Now you can continue cleaning up the other resources.

Next, delete the storage bucket.

$ boundary storage-buckets delete -id $STORAGE_BUCKET_ID

Now you can safely delete the org, which also deletes the credential store.
```
$ boundary scopes delete -id $ORG_ID
```

Delete the Boundary workers.

First, list the workers.

$ boundary workers list

Worker information:
  ID:                        w_NdnBI7xXKC
    Version:                 1
    Name:                    hcp-managed-worker-0
    Address:
    2b6a39c4-ba35-f65a-beeb-b284747fe5bc.proxy.boundary.hashicorp.cloud:9202
    ReleaseVersion:          Boundary v1.0.1+ent
    Last Status Time:        Wed, 05 Aug 2026 17:42:33 UTC
    Directly Connected Downstream Workers:
      w_CB3r4wOTOF
    Authorized Actions:
      add-worker-tags
      set-worker-tags
      remove-worker-tags
      no-op
      read

  ID:                        w_CB3r4wOTOF
    Version:                 1
    Address:                 minio-worker:9202
    ReleaseVersion:          Boundary v1.0.1+ent
    Last Status Time:        Wed, 05 Aug 2026 17:42:35 UTC
    Authorized Actions:
      add-worker-tags
      set-worker-tags
      remove-worker-tags
      no-op
      read
      update
      delete
...
... more output ...
...

Copy the ID of the worker created for this tutorial and delete it.

Example:

$ boundary workers delete -id w_CB3r4wOTOF
The delete operation completed successfully.

In the Create a storage policy section you already created and attached the boundary_policy_storage resource, so every session recording is eligible for deletion from the moment it's created. Cleanup requires deleting the recordings, then running terraform destroy.

Delete all session recordings. You may also perform this step using the Admin UI or CLI.

List the recordings in the org.

$ boundary session-recordings list -scope-id $ORG_ID

Delete each recording by ID.

$ boundary session-recordings delete -id sr_xdlnWTzUuU
The delete operation completed successfully.

Run terraform destroy to clean up the Boundary resources. Enter yes when prompted to confirm the deletion.

$ terraform destroy -var-file="boundary.tfvars"

Example output:

$ terraform destroy -var-file="boundary.tfvars"

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

# ...

Plan: 0 to add, 0 to change, 12 to destroy.

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

boundary_scope_policy_attachment.attach_delete_policy: Destroying... [id=pst_1s6fDDNlyG:o_YxRY6Xw6qN]
boundary_target.ssh_target: Destroying... [id=tssh_94v1vSe9t3]
boundary_target.rdp_target: Destroying... [id=trdp_DqGopNchki]
boundary_auth_method_password.password: Destroying... [id=ampw_dGK8mTX2kk]
boundary_target.ssh_target: Destruction complete after 0s
boundary_target.rdp_target: Destruction complete after 0s
boundary_credential_username_password_domain.rdp_creds: Destroying... [id=credupd_EZlYE26qoE]
boundary_credential_username_password.openssh_creds: Destroying... [id=credup_bLYE4mr45b]
boundary_storage_bucket.minio_bucket: Destroying... [id=sb_6zwYloDTKI]
boundary_auth_method_password.password: Destruction complete after 0s
boundary_scope_policy_attachment.attach_delete_policy: Destruction complete after 0s
boundary_policy_storage.recordings: Destroying... [id=pst_1s6fDDNlyG]
boundary_credential_username_password_domain.rdp_creds: Destruction complete after 0s
boundary_credential_username_password.openssh_creds: Destruction complete after 0s
boundary_credential_store_static.openssh_cred_store: Destroying... [id=csst_HYFzEY2Hxw]
boundary_storage_bucket.minio_bucket: Destruction complete after 1s
boundary_policy_storage.recordings: Destruction complete after 1s
boundary_credential_store_static.openssh_cred_store: Destruction complete after 1s
boundary_scope.recording_test_project: Destroying... [id=p_VICyK3GHOo]
boundary_scope.recording_test_project: Destruction complete after 0s
boundary_scope.recording_test_org: Destroying... [id=o_YxRY6Xw6qN]
boundary_scope.recording_test_org: Destruction complete after 0s
boundary_scope.global: Destroying... [id=global]
boundary_scope.global: Destruction complete after 0s

Destroy complete! Resources: 12 destroyed.

Unlike a deployment that adds the storage policy after applying the rest of the configuration, this succeeds without errors because every recording created after the initial apply was already eligible for deletion.

Delete the Boundary worker.

List the workers, then delete the one created for this tutorial.

$ boundary workers list

$ boundary workers delete -id w_CB3r4wOTOF
The delete operation completed successfully.

Unset the environment variables used in any active terminal windows for this tutorial.

$ unset BOUNDARY_ADDR; \
  unset BOUNDARY_AUTH_METHOD_ID; \
  unset BOUNDARY_USERNAME; \
  unset BOUNDARY_PASSWORD; \
  unset MINIO_ADDR; \
  unset MINIO_BUCKET_NAME; \
  unset MINIO_ACCESS_KEY_ID; \
  unset MINIO_SECRET_ACCESS_KEY; \
  unset OPENSSH_PASSWORD; \
  unset RDP_PASSWORD

Help and reference

Collection Overview

Host management

Session recording with AWS and Vault

This tutorial also appears in:

5 tutorials

Boundary Enterprise
Learn operational tasks specific to creating and operating a Boundary Enterprise environment.
- Boundary