Transparent sessions is a new workflow within Boundary that improves end-user experience with Boundary and also facilitates securing access to HTTPS targets
This README file explains what will be deployed as part of this repo. For further information, please refer to my associated blog post: https://medium.com/hashicorp-engineering/
To demonstrate how Boundary and transparent sessions can be used to faciliate connectivitiy to HTTPS targets, I have built a multi-hop Boundary deployment. The HTTPS target resides in a private RFC1918 address space and once deployed, you can facilitate access to the target via Boundary, but without the need of an VPN solution.
The repo deploys and configures the following:
- Configures HCP Boundary. The HCPb cluster will already be deployed and the code in the repo does all the logical configuration
- Deploys a Boundary Ingress Worker in a public network.
- Deploys a Boundary Egress Worker in a private network. The Egress worker is associated with the HTTPS target and by having communication with the Ingress worker, allows for a multi-hop deployment.
- Establishes a connection between the Boundary Controller and the Boundary Workers.
- Creates an A record in Route53 for
test.transparentsessions.com - Deploys HCP Vault Dedicated and mounts two PKI secrets engines. One as the root CA and one as the intermediary CA.
- Deploys a server instance in a private subnet. This server will be installed with Apache, and grab all the requisite keys and crt, generated by Vault
You will need to create a domain or have a domain to test against. For this exaple deployment I registered the domain transparentsessions.com in Route53.
Your HCP Boundary Cluster needs to be created prior to executing the Terraform code. For people new to HCP, a trial can be utilised, which will give $50 credit to try, which is ample to test this solution.
With this setup, users can securely access the HTTPS resource in the private network without needing to connect directly to the network, or expose resources publicly to the Internet
The following tfvars variables have been defined in a terraform.tfvars file.
boundary_addr: The HCP Boundary address, e.g. "https://xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.boundary.hashicorp. cloud"password_auth_method_login_name: = ""password_auth_method_password: = ""private_vpc_cidr: = ""private_subnet_cidr: = ""aws_vpc_cidr: = ""aws_subnet_cidr: = ""aws_access: = ""aws_secret: = ""