Static Hosts, TCP Targets, and Global Aliases

This is the hands-on lab for Section 7 of the Boundary 101 course. Setup already brought up the Lab 3 split: a controller plus PostgreSQL-16 on one VM and a registered worker on the other. You do not write HCL, init the database, or register the worker. Hosts, targets, a global alias, and a bad grant are the work.

You will:

• Create a static host catalog in the generated project, two static hosts

(worker and controller addresses, no ports), and a host set that contains both

• Create two TCP targets that demonstrate address XOR host sources: one

with a direct worker address, one that uses the host set, and set session_max_seconds on the host-set target

• Create a global alias (CE 0.21 aliases are global-only) and connect with

boundary connect ssh <alias>

• Break authorize-session with a grant that is missing authorize-session,

capture the 403, then add the correct grant so the operator user can authorize

Targets stay TCP (ttcp_*). boundary connect ssh is a helper, not an SSH target type. Project-scope aliases and suffixes are Boundary 1.0 HCP and Enterprise; do not create them here. The scored failure is a bad grant, not a worker filter.