Dan HeathandRobin Beck
5ce6515156
* docs: IA reorganization * docs: Updates * docs: Updates * docs: Fix links * docs: Updates * docs: Fix a typo * docs: Fix client agent topic * docs: Update Client Agent nav * docs: Fix conflict * docs: Fix a typo in Client Agent docs (#5853) * docs: Fix client agent topic * docs: Updates * docs: Updates * docs: Updates * docs: Updates * docs: Fixes get started and operations links * docs: Update nav * docs: Partials * docs: Unix partials * docs: Worker partials * docs: Updates * docs: Update workers and targets * docs: Updates * docs: Updates * docs: Fixes link * docs: Updates after sync review * docs: Updates from review feedback * docs: Move worker filter examples * docs: Fix links * docs: Updates for filters based on working session * docs: Fixes broken links * docs: Add links to other filter topics * docs: Update list intro * docs: Adds link * docs: Fixes redirects * docs: Fixes redirects * docs: Deleted mysql page from TOC * docs: Add versioned redirect * docs: Adds versioned redirects * docs: Adds versioned redirects * docs: Update redirects * docs: Update redirects * docs: Redirect fixes * docs: Update redirect format * docs: Fix a typo * docs: Fixes redirects * docs: Fixes redirect * docs: Adds links out to client agent troubleshooting * uses /etc/boundary.d/ as recommended installation directory (#6003) * docs: Updates legacy io links * docs: Fixes redirects * docs: Fix redirect * docs: Restoring deleted file --------- Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
31 lines
2.8 KiB
Plaintext
31 lines
2.8 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Boundary vs. privileged access management
|
|
description: >-
|
|
Learn how Boundary compares to privileged access management (PAM) solutions by providing automation for user and credential management and service discovery.
|
|
---
|
|
|
|
# Boundary vs. privileged access management
|
|
|
|
Privileged access management (PAM) tools secure access to critical systems by managing and monitoring access to privileged accounts.
|
|
PAM assists an organization in reducing their attack surface in an attempt to mitigate damage caused from internal or external incidents.
|
|
Traditionally, a focus is put on the management of privileged credentials, and the monitoring of sessions and commands that enable detection and response teams to respond to incidents.
|
|
|
|
Boundary enables many of the security controls traditionally filled by PAM tools.
|
|
Boundary can manage network access to privileged systems and audit access.
|
|
It can be used with credential management providers, like Vault, to manage access to privileged accounts and credentials.
|
|
|
|
Where Boundary differs from traditional PAM solutions is in its automation-friendly workflows.
|
|
Boundary is instrumented programmatically via REST, CLI, and [Terraform](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs).
|
|
It provides automation-friendly workflows for managing users and credentials, as well as the discovery and configuration of new services:
|
|
|
|
- **Automated credential management**: Boundary and Vault can create workflows with automated credential management in which user sessions are secured with [single-use dynamic credentials that are injected into sessions](/boundary/tutorials/credential-management/hcp-private-vault-cred-injection) such that secrets are never returned to users.
|
|
- **Context-based access**: When users' business context changes, you want to ensure their permissions reflect the new business context.
|
|
As an example, on-call engineers might require different permissions than when they end their on-call shifts.
|
|
[Boundary's managed groups](/boundary/tutorials/access-management/oidc-idp-groups) enable user permission workflows to be assigned dynamically based on identity provider MFA checks, group memberships, and other IDP-level context.
|
|
- **[Host discovery](/boundary/docs/hosts)**: Boundary's [dynamic host catalogs](/boundary/tutorials/host-management/aws-host-catalogs) are advanced workflows for automating the process of onboarding new or changed infrastructure resources and their connection information, and applying pre-configured security policies.
|
|
|
|
**Can Boundary replace a PAM solution?**
|
|
|
|
Yes, Boundary provides many of the security controls traditionally delivered by PAM tools.
|
|
Boundary can also be used with an existing PAM tool, particularly the ones that emphasize agent-based security where Boundary's proxy-based security can be a natural complement. |