Codify Boundary with Terraform
Point the official provider at a running Community Edition cluster, bootstrap with recovery KMS, codify an org, grants, a static catalog, and a TCP target, apply twice, then switch to password auth and remove recovery KMS.
Lab Overview
This is the hands-on lab for Section 12 of the Boundary 101 course. Setup already replayed Lab 3: a two-VM Community Edition 0.21.3 controller and worker, PostgreSQL-16, and a recovery KMS file. You do not deploy the cluster. Terraform manages Boundary resources against the API on port 9200.
You will:
- Pin hashicorp/boundary ~> 1.6 (1.6.1 is current) and authenticate the
provider with recovery_kms_hcl as u_recovery
- Codify an org, a project, and role grants (skip auto-created roles)
- Codify a static catalog and a TCP target, then terraform apply twice so
the second run is idle
- Switch the provider to password auth, remove the recovery KMS block from
controller HCL, and prove day-2 login no longer needs recovery
Do not declare RDP targets, session recording, or storage-bucket resources. Those 1.6.x examples need Enterprise or HCP. Community Edition stays on TCP. Recovery KMS is break-glass; AEAD keys in HCL are readable to anyone who can read the file.
What You'll Learn
Pin the official provider hashicorp/boundary ~> 1.6 and authenticate with recovery_kms_hcl
Declare an org, a project, and role grants in Terraform with auto_create_* roles left false
Declare a static host catalog and a TCP target, then apply twice with no changes on the second run
Switch the provider to password auth and remove the recovery KMS block from controller HCL
Prerequisites
Completion of the Boundary 101 Section 12 (Terraform as Source of Truth) lessons
Familiarity with the Lab 3 self-managed controller and worker (this lab does not re-deploy it)
Basic Terraform (init, plan, apply) and Linux command line
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now