Scopes, Roles, and Grants
Create an org and projects in boundary dev, add password users through a group, write grant strings, and prove authorize-session is allowed on one TCP target and denied on another.
Lab Overview
This is the hands-on lab for Section 5 of the Boundary 101 course. Setup already installed Boundary Community Edition 0.21.3, started PostgreSQL-16, and launched boundary dev with -database-url. You do not re-do Lab 1. You do not deploy a self-managed cluster. IAM is the work.
You will:
- Create your own org and two projects (dev and prod) next to the generated
scopes that boundary dev pre-creates
- Create an org password auth method, password accounts, users, and a group,
then attach the group to a role (not each user)
- Write grant strings with list, authorize-session, and read:self, and set
grant scopes so they apply only to the dev project
- Create TCP targets in both projects and prove that one user can
authorize-session on the dev target and is denied on prod
OIDC and LDAP auth methods exist in boundary dev because they are Community Edition features. The scored path is password. Targets stay TCP (ttcp_*). boundary connect ssh is a helper, not an SSH target type, and this lab scores authorize-session rather than a live SSH session.
What You'll Learn
Create an org under global and project scopes under that org as permission boundaries
Create password accounts and users, then assign a group to a role instead of each user
Write grant strings that include authorize-session, list, and read:self
Set grant scope IDs so a role applies to one project and not its sibling
Prove allow versus deny: authorize-session succeeds on one TCP target and returns 403 on another
Prerequisites
Completion of the Boundary 101 Section 5 (Scopes, Roles, and Grants) lessons
Familiarity with the Boundary CLI from Lab 1 (authenticate, -keyring-type=none)
Basic Linux command line
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now