Create a static credential store

출처: HashiCorp Boundary docs

This page shows you how to create a static credential store in Boundary. You can also add a static credential to the store for credential brokering or injection into target sessions.

To connect the static credential to a target, refer to the credential brokering and injection pages linked below.

Requirements

Ensure that you have an Org scope and a project scope created in your Boundary instance.

If you need Vault-backed dynamic credentials instead, refer to Create a Vault credential store.

Create the credential store

Complete the following steps to create a static credential store: UI CLI Terraform

Name (optional) - The name is optional, but if you enter a name, it must be unique.Description (optional) - An optional description of the credential for identification purposes.Type - The type of static credential you want to add. Select between username password, username keypair, username password domain, or a JSON blob.Credential data - Depending on the credential type selected, enter the credential data.

$ boundary authenticate Please enter the login name (it will be hidden): Please enter the password (it will be hidden):

- ```
$ boundary credential-stores create static \
   -scope-id p_VHAKTCEKcU \
   -name "my-static-credential-store"

$ boundary credentials create username-password
-name "test-credentials"
-credential-store-id csst_O8utI0b3XC
-username
-password env://<MY_PASSWORD_ENV_VAR>

$ boundary credentials create ssh-private-key \
    -credential-store-id csst_O8utI0b3XC \
    -username <username> \
    -private-key file://<my_ssh_key_file>

$ boundary credentials create json
-credential-store-id csst_O8utI0b3XC
-object file://<my_json_file_path>

$ boundary credentials create username-password-domain \
  -name "ad-admin-credentials" \
  -credential-store-id csst_O8utI0b3XC \
  -username <username> \
  -password env://<MY_PASSWORD_ENV_VAR> \
  -domain <domain_name>

```

Apply the following Terraform configuration to create a credential store and add three types of credentials to it.

```
resource "boundary_credential_store_static" "example" {
  name        = "example_static_credential_store"
  description = "My first static credential store!"
  scope_id    = boundary_scope.project.id
}

# Username/password credential
resource "boundary_credential_username_password" "example" {
  name                = "example_username_password"
  description         = "My first username password credential!"
  credential_store_id = boundary_credential_store_static.example.id
  username            = "my-username"
  password            = "my-password"
}

# SSH private key credential
resource "boundary_credential_ssh_private_key" "example" {
  name                   = "example_ssh_private_key"
  description            = "My first ssh private key credential!"
  credential_store_id    = boundary_credential_store_static.example.id
  username               = "my-username"
  private_key            = file("~/.ssh/id_rsa")
  private_key_passphrase = "passphrase" # (optional) passphrase of the Private Key
}

# JSON credential
resource "boundary_credential_json" "example" {
  name                = "example_json"
  description         = "My first json credential!"
  credential_store_id = boundary_credential_store_static.example.id
  object              = file("~/object.json") # change to valid json file
}

```

## Next steps

Once you have created a credential store, you can configure targets for credential brokering or credential injection.
When you use credential brokering, Boundary centrally manages credentials and returns them to the user when they attempt to connect to a target.
Credential injection provides end users with a passwordless experience when they connect to targets.

- Configure a target for credential brokering
- Configure a target for credential injection

Edit this page on GitHub