CIS HashiCorp Boundary Benchmark

This recommendation verifies that Boundary is running the latest stable version on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Boundary version
boundary version
# Check if running as non-root
ps -eo user,pid,comm | grep boundary

# Install latest Boundary from HashiCorp
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
apt-get update && apt-get install boundary
# Run as dedicated user:
useradd -r -s /usr/sbin/nologin boundary

This recommendation verifies that controller listeners use TLS 1.3 on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check controller configuration
cat /etc/boundary/controller.hcl | grep -E 'tls|listener'

# Configure controller with TLS
listener "tcp" {
  address = "0.0.0.0:9200"
  purpose = "api"
  tls_cert_file = "/etc/boundary/tls/cert.pem"
  tls_key_file  = "/etc/boundary/tls/key.pem"
  tls_min_version = "tls13"
}

This recommendation verifies that OIDC or LDAP auth methods are configured on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check auth method configuration
boundary auth-methods list -recursive
boundary auth-methods read -id ameth_XXXX

# Configure OIDC auth method
boundary auth-methods create oidc \
  -issuer 'https://idp.example.com' \
  -client-id '<CLIENT_ID>' \
  -client-secret 'env://BOUNDARY_OIDC_SECRET' \
  -signing-algorithms RS256 \
  -api-url-prefix 'https://boundary.example.com' \
  -scope-id global

This recommendation verifies that roles follow least-privilege principle on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List roles and their grants
boundary roles list -scope-id global -recursive
boundary roles read -id r_XXXX

# Configure least-privilege roles
boundary roles create \
  -scope-id 'global' \
  -name 'read-only' \
  -grant-scope-id 'this' \
  -grant 'ids=*;type=*;actions=list,read'
# Remove overly permissive grants:
boundary roles set-grants -id r_XXXX \
  -grant 'ids=*;type=target;actions=list,read,authorize-session'

This recommendation verifies that worker authentication is properly configured on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check worker authentication
cat /etc/boundary/worker.hcl | grep -E 'auth|token'

# Configure worker-led authentication
worker {
  auth_storage_path = "/var/lib/boundary/worker"
  initial_upstreams = ["10.0.0.5:9201"]
  tags {
    type = ["prod", "dmz"]
  }
}
# Workers authenticate via PKI or controller-led tokens

This recommendation verifies that KMS seals are configured for key management on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify KMS configuration
cat /etc/boundary/controller.hcl | grep -A5 'kms'

# Configure KMS seals for encryption
kms "transit" {
  purpose = "root"
  address = "https://vault.example.com:8200"
  token = "env://VAULT_TOKEN"
  key_name = "boundary-root"
}
kms "transit" {
  purpose = "worker-auth"
  address = "https://vault.example.com:8200"
  token = "env://VAULT_TOKEN"
  key_name = "boundary-worker-auth"
}

This recommendation verifies that audit event sinks are configured on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit event sink configuration
cat /etc/boundary/controller.hcl | grep -A10 'events'

# Configure audit event logging
events {
  audit_enabled = true
  observations_enabled = true
  sink "file" {
    name = "audit-sink"
    event_types = ["audit"]
    format = "cloudevents-json"
    file {
      path = "/var/log/boundary"
      file_name = "audit.log"
    }
  }
}

This recommendation verifies that session recording is enabled for sensitive targets on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify session recording configuration
boundary storage-buckets list -scope-id global
boundary targets read -id ttcp_XXXX | grep -i record

# Enable session recording
boundary storage-buckets create \
  -scope-id global \
  -plugin-name aws \
  -bucket-name boundary-recordings \
  -region us-east-1
# Attach to target:
boundary targets update tcp \
  -id ttcp_XXXX \
  -enable-session-recording true \
  -storage-bucket-id sb_XXXX

This recommendation verifies that session limits are configured on targets on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check target session limits
boundary targets list -recursive
boundary targets read -id ttcp_XXXX | grep -i 'session\|limit'

# Configure session limits on targets
boundary targets update tcp \
  -id ttcp_XXXX \
  -session-max-seconds 3600 \
  -session-connection-limit 1
# Limit concurrent sessions per user

This recommendation verifies that credential brokering uses Vault integration on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify credential injection settings
boundary credential-stores list -recursive
boundary credential-libraries list -credential-store-id csst_XXXX

# Configure Vault credential brokering
boundary credential-stores create vault \
  -scope-id p_XXXX \
  -vault-address https://vault.example.com:8200 \
  -vault-token env://VAULT_TOKEN
boundary credential-libraries create vault-generic \
  -credential-store-id csvlt_XXXX \
  -vault-path 'database/creds/readonly' \
  -credential-type username_password

This recommendation verifies that database connections use TLS with certificate verification on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify database backend
cat /etc/boundary/controller.hcl | grep -A5 'database'

# Configure PostgreSQL with TLS
controller {
  database {
    url = "env://BOUNDARY_PG_URL"
    # URL should include sslmode=verify-full
    # e.g. postgresql://boundary:pass@db:5432/boundary?sslmode=verify-full&sslrootcert=/etc/ssl/ca.pem
  }
}

This recommendation verifies that secrets are not stored in plaintext configuration on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check for plaintext secrets in config
grep -rn 'password\|secret\|token' /etc/boundary/*.hcl | grep -v 'env://'

# Use environment variables for secrets
# Replace inline secrets with env references:
# token = "env://VAULT_TOKEN"
# In systemd unit:
# EnvironmentFile=/etc/boundary/boundary.env
# Protect env file:
chmod 600 /etc/boundary/boundary.env
chown boundary:boundary /etc/boundary/boundary.env

This recommendation verifies that database migrations are performed after upgrades on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Boundary database migration status
boundary database status -config /etc/boundary/controller.hcl

# Perform database migration after upgrade
boundary database migrate -config /etc/boundary/controller.hcl
# Always backup database before migration:
pg_dump boundary > boundary-backup-$(date +%F).sql

This recommendation verifies that scope hierarchy follows organizational structure on the HashiCorp Boundary secure remote access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Boundary secure remote access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify scope hierarchy
boundary scopes list -recursive

# Organize scopes for least-privilege
boundary scopes create -scope-id global -name 'Production' -description 'Prod environment'
boundary scopes create -scope-id o_XXXX -name 'Web Team' -description 'Web application targets'
# Each team gets its own project scope