Dan HeathandRobin Beck
5ce6515156
* docs: IA reorganization * docs: Updates * docs: Updates * docs: Fix links * docs: Updates * docs: Fix a typo * docs: Fix client agent topic * docs: Update Client Agent nav * docs: Fix conflict * docs: Fix a typo in Client Agent docs (#5853) * docs: Fix client agent topic * docs: Updates * docs: Updates * docs: Updates * docs: Updates * docs: Fixes get started and operations links * docs: Update nav * docs: Partials * docs: Unix partials * docs: Worker partials * docs: Updates * docs: Update workers and targets * docs: Updates * docs: Updates * docs: Fixes link * docs: Updates after sync review * docs: Updates from review feedback * docs: Move worker filter examples * docs: Fix links * docs: Updates for filters based on working session * docs: Fixes broken links * docs: Add links to other filter topics * docs: Update list intro * docs: Adds link * docs: Fixes redirects * docs: Fixes redirects * docs: Deleted mysql page from TOC * docs: Add versioned redirect * docs: Adds versioned redirects * docs: Adds versioned redirects * docs: Update redirects * docs: Update redirects * docs: Redirect fixes * docs: Update redirect format * docs: Fix a typo * docs: Fixes redirects * docs: Fixes redirect * docs: Adds links out to client agent troubleshooting * uses /etc/boundary.d/ as recommended installation directory (#6003) * docs: Updates legacy io links * docs: Fixes redirects * docs: Fix redirect * docs: Restoring deleted file --------- Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
125 lines
4.1 KiB
Plaintext
125 lines
4.1 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Terraform patterns for targets
|
|
description: >-
|
|
Use Terraform patterns to create and manage Boundary targets. Learn how to configure SSH and TCP targets, inject passwords, and enable session recording.
|
|
---
|
|
|
|
# Terraform patterns for targets
|
|
|
|
Once you have defined a host, a host catalog, and a credential store, you
|
|
can create [targets](/boundary/docs/domain-model/targets).
|
|
|
|
## Requirements
|
|
|
|
This document assumes the reader has:
|
|
|
|
- An understanding of [Terraform](/terraform/docs) fundamentals.
|
|
- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary.
|
|
- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration).
|
|
- Defined a host, [host catalog](/boundary/docs/deploy/terraform-patterns/terraform-hosts-and-host-management), and [credential store](/boundary/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores).
|
|
- (Optional) Configured a storage policy and storage bucket for any targets you want to enable for [session recording](/boundary/docs/deploy/terraform-patterns/terraform-session-recording).
|
|
|
|
## Target configuration
|
|
|
|
This example creates a target with an injected username and password.
|
|
|
|
<Note>
|
|
|
|
[Credential injection](/boundary/docs/concepts/credential-management#credential-injection) and SSH target types are only supported for HCP Boundary and Boundary Enterprise. You can configure [credential brokering](/boundary/docs/concepts/credential-management#credential-brokering) instead using `brokered_credential_source_ids`.
|
|
|
|
</Note>
|
|
|
|
```hcl
|
|
resource "boundary_target" "ssh_foo" {
|
|
name = "ssh_foo"
|
|
description = "SSH target"
|
|
scope_id = boundary_scope.project.id
|
|
|
|
# Declare the target type and connection port
|
|
type = "ssh"
|
|
default_port = "22"
|
|
|
|
# Declare the host set
|
|
host_source_ids = [
|
|
boundary_host_set.foo.id
|
|
]
|
|
|
|
# Declare the injected credentials
|
|
injected_application_credential_source_ids = [
|
|
boundary_credential_library_vault.example.id
|
|
]
|
|
|
|
# Enable session recording
|
|
enable_session_recording = true
|
|
storage_bucket_id = boundary_storage_bucket.aws_bucket.id
|
|
}
|
|
|
|
```
|
|
## Session recording configuration
|
|
|
|
This example enables session recording, but uses brokered credentials instead.
|
|
|
|
```hcl
|
|
resource "boundary_target" "ssh_foo" {
|
|
name = "ssh_foo"
|
|
description = "SSH target"
|
|
scope_id = boundary_scope.project.id
|
|
|
|
# Declare the target type and connection port
|
|
type = "ssh"
|
|
default_port = "22"
|
|
|
|
# Declare the host set
|
|
host_source_ids = [
|
|
boundary_host_set.foo.id
|
|
]
|
|
|
|
# Declare the brokered credentials
|
|
# This uses a static credential library created earlier
|
|
brokered_application_credential_source_ids = [
|
|
boundary_credential_library.example.id
|
|
]
|
|
|
|
# Enable session recording.
|
|
enable_session_recording = true
|
|
storage_bucket_id = boundary_storage_bucket.aws_bucket.id
|
|
}
|
|
```
|
|
|
|
## TCP target configuration
|
|
|
|
This example creates a `tcp` target that connects to Windows servers using RDP.
|
|
|
|
```hcl
|
|
resource "boundary_target" "rdp_foo" {
|
|
name = "rdp_foo"
|
|
description = "RDP target"
|
|
scope_id = boundary_scope.project.id
|
|
|
|
# Declare the target type and connection port
|
|
type = "tcp"
|
|
default_port = "3389"
|
|
|
|
# Declare the host set. This assumes that this host set contains Windows hosts
|
|
host_source_ids = [
|
|
boundary_host_set.foo.id
|
|
]
|
|
|
|
# The credentials we will use to connect. RDP requires the use of brokered credentials
|
|
# This uses a static credential library created earlier
|
|
brokered_application_credential_source_ids = [
|
|
boundary_credential_library.example.id
|
|
]
|
|
}
|
|
```
|
|
|
|
## More information
|
|
|
|
For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation:
|
|
|
|
- [Targets](/boundary/docs/domain-model/targets)
|
|
|
|
For more information about managing the following resources using Terraform, refer to the Boundary provider documentation:
|
|
|
|
- [Targets](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/target/) |