Broker Static Credentials on a TCP Target
Create a static credential store, add a username/password and an SSH private key, attach both as brokered sources on a TCP target, and retrieve the secrets at session start on a replayed Community Edition 0.21.3 cluster.
Lab Overview
This is the hands-on lab for Section 9 of the Boundary 101 course. Setup already deployed the Lab 3 two-VM Community Edition 0.21.3 cluster: a controller with PostgreSQL-16 on boundary-controller, and a registered worker on boundary-worker. You do not write HCL, you do not run boundary database init, and you do not run boundary dev.
You will:
- Authenticate with -keyring-type=none and create a static credential
store (csst_) in the generated project
- Add a username/password credential and an SSH private key credential
with env:// or file:// so secrets are not logged
- Attach both as -brokered-credential-source on the existing TCP target
to the worker IP on port 22
- Start a session and read the brokered secrets from
boundary targets authorize-session and the connect ssh helper
Community Edition brokers the secret back to you. Credential injection (the worker authenticates, you never see the secret) is Enterprise and HCP. Do not create an SSH target type and do not pass
- injected-application-credential-source.
What You'll Learn
Create a project-scoped static credential store with boundary credential-stores create static
Add a username/password credential and an SSH private key credential using env:// or file:// for secrets
Attach both credentials as brokered sources on a TCP target with -brokered-credential-source
Retrieve brokered secrets at session start with authorize-session and the connect ssh helper
Distinguish Community Edition brokering from Enterprise credential injection
Prerequisites
Completion of the Boundary 101 Section 9 (Credential Stores and Brokering) lessons
Familiarity with the Boundary CLI from earlier labs (authenticate with -keyring-type=none, TCP targets)
Basic Linux command line
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now