Broker Vault Dynamic Database Credentials
Enable Vault's database secrets engine against a Postgres target on port 5433, create a Boundary Vault credential store and vault-generic library, then broker a dynamic username and password into a TCP session with boundary connect postgres.
Lab Overview
This is the hands-on lab for Section 10 of the Boundary 101 course. Setup already deployed a self-managed Boundary Community Edition 0.21.3 controller and worker on this VM, with host PostgreSQL-16 on port 5432 as Boundary's own database. Docker Compose runs pinned Vault CE 2.1.0 and a Postgres target published on host port 5433. You do not deploy the cluster, you do not run boundary dev, and Boundary is not in Compose.
You will:
- Enable Vault's database secrets engine, point postgresql-database-plugin
at the Compose Postgres target (not Boundary's database on 5432), and create an analyst role that issues leased usernames
- Write the Boundary controller policy plus a tight database policy, mint a
periodic, renewable, orphan Vault token, and create a Vault credential store (csvlt_) in the project
- Create a vault-generic credential library at database/creds/analyst with
credential type username_password
- Attach the library as a brokered source on a TCP target to 127.0.0.1:5433
and connect with the boundary connect postgres helper
Community Edition brokers the secret back to you. That is not credential injection. KV is not scored. Worker filters are not scored.
What You'll Learn
Enable Vault's database secrets engine and configure postgresql-database-plugin against the Postgres target on host port 5433
Create a Vault role that issues leased Postgres usernames from database/creds/analyst
Mint a periodic, renewable, orphan Vault token with the Boundary controller policy and create a Vault credential store
Create a vault-generic credential library and attach it as a brokered source on a TCP target
Connect with boundary connect postgres so the helper passes the brokered username and password to psql
Prerequisites
Completion of the Boundary 101 Section 10 (Vault Dynamic Credentials) lessons
Familiarity with the Boundary CLI from earlier labs (authenticate with -keyring-type=none, TCP targets)
Basic Linux command line
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now