Boundary
By HashiCorp
Boundary is a HashiCorp tool that provides identity-based secure remote access to infrastructure, such as servers and databases, without requiring users to manage VPN connections or distribute long-lived SSH keys and credentials. It…
Definition
Boundary is a HashiCorp tool that provides identity-based secure remote access to infrastructure, such as servers and databases, without requiring users to manage VPN connections or distribute long-lived SSH keys and credentials. It brokers sessions based on centrally defined access policies tied to a user's verified identity. Rather than granting a user broad network access the way a VPN does, Boundary evaluates each access request against a policy tied to that user's verified identity and then opens a narrowly scoped, time-limited session directly to the specific target system the policy allows.
Overview
Boundary addresses a structural weakness in how organizations traditionally grant humans access to infrastructure: a VPN authenticates a user once and then exposes an entire network segment to them, and distributing SSH keys or database passwords creates long-lived credentials that are difficult to rotate, track, or revoke individually once handed out. Boundary's approach removes both patterns by brokering access per session, tied to a user's verified identity, rather than granting standing network-level or credential-based access. Mechanically, a Boundary deployment splits responsibilities between controllers, which authenticate a user against an identity provider and evaluate whether policy permits access to a requested target, and workers, which sit near the protected infrastructure and proxy the actual session traffic once access is authorized. This split matters because it means workers can be placed inside private networks close to sensitive systems while controllers are managed centrally, and a user's client never receives direct network reachability to the target — only a brokered, time-limited session channel. Boundary is often used alongside HashiCorp Vault, which can generate a short-lived, dynamic credential for a specific session rather than relying on a static password the user would otherwise need to know, meaning Boundary can grant a database session without the human ever seeing a durable credential. This differs from a service mesh, which secures service-to-service traffic broadly, since Boundary's scope is specifically human-to-infrastructure access. In practice, organizations use Boundary to give engineers temporary access to production servers, replace VPN-based access to internal systems, provide database access without distributing static credentials, and record sessions for compliance auditing, typically as part of a broader HashiCorp-centered infrastructure stack that may also include Vault and Consul. The tradeoff is scope and ecosystem fit: Boundary solves a narrower problem than a full zero-trust network access product might claim to, and organizations already standardized on an alternative like Teleport or a cloud provider's own session-management service may see limited incremental benefit unless they are already invested in HashiCorp tooling elsewhere, where Boundary's integration with Vault and shared operational patterns provide a more natural fit. Because Boundary is one part of a larger HashiCorp product family rather than a single standalone tool, organizations typically adopt it as a deliberate architectural decision alongside Vault for secrets and Consul for service networking, rather than installing it in isolation the way a point solution for remote access might be deployed on its own. Teams evaluating Boundary purely as a standalone VPN replacement, without adopting the rest of the HashiCorp stack, will find it functional but may not see the full benefit that comes from its tighter integration with Vault-issued credentials.
Key Features
- Identity-based session brokering without exposing network-level access
- Time-limited, policy-based access grants to specific infrastructure targets
- Separation of controllers and workers for flexible deployment topology
- Dynamic short-lived credential integration with HashiCorp Vault
- Integration with common identity providers for authentication
- Session recording and auditing for compliance requirements
- Support for both self-managed and HashiCorp-hosted control planes
Use Cases
Alternatives
Frequently Asked Questions
From the Blog
Support Vector Machines Explained Simply
A support vector machine classifies data by finding the boundary that best separates categories with the widest possible margin. This guide explains how SVMs actually work and exactly when to use them.
Read More AI & TechnologyThe Hugging Face Stack: Hub, Transformers, Datasets and PEFT
The Hugging Face stack is five or six libraries that each own one stage of a model's life: the Hub stores artefacts, Transformers loads and runs them, Datasets feeds them, PEFT adapts them cheaply, Accelerate distributes the training loop, and Spaces exposes the result. This guide maps each boundary so you know which tool to reach for.
Read More AI & TechnologyHow to Split Train, Validation and Held-Out Sets Properly
Split fine-tuning data by grouping related examples before you split, deduplicating near-identical text across the boundary, and reserving a held-out set that is never used for any decision. This covers leakage sources specific to text data, how to detect them, and what an untouched final set is actually for.
Read More Cloud & CybersecurityThe MLOps Lifecycle: From Data to Deployed Model
The MLOps lifecycle runs from raw data through features, training, evaluation, registry, serving and monitoring, then loops back through retraining. Most production failures happen at the handoffs between those stages rather than inside them, so this article maps each boundary and who owns it.
Read More