Skip to content

Commit

Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
docs: Update storage bucket worker requirement
Browse files Browse the repository at this point in the history
irenarindos committed Jun 14, 2023
1 parent 4f1552a commit 475dbc6
Showing 2 changed files with 21 additions and 4 deletions.
Original file line number Diff line number Diff line change
@@ -21,11 +21,10 @@ For more information about using session recording to audit user sessions, refer

**Requirements**:
- An AWS S3 storage bucket
- A Boundary PKI worker with access to the AWS S3 storage bucket

At this time, the only supported storage for storage buckets is AWS S3.
In AWS S3, a storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the access and secret key.

- A Boundary PKI worker with access to the AWS S3 storage bucket. This worker must be configured with a local recording storage path, defined as `recording_storage_path`. For more details, refer to [PKI Workers](/boundary/docs/configuration/worker/pki-worker)
- An AWS IAM role policy with the following statement:
```json
{
@@ -68,9 +67,11 @@ Complete the following steps to create a storage bucket for session recording:
Replace the values above with the following required AWS secrets and any optional [attributes](/boundary/docs/concepts/domain-model/storage-buckets) you want to associate with the storage bucket:

- `region`: (Required) The AWS region to use.
- `bucket-name`: (Required) Name of the bucket in AWS.
- `access_key_id`: (Required) The AWS access key to use.
- `secret_access_key_id`: (Required) The AWS secret access key to use.
This attribute contains the secret access key for static credentials.
- `worker-filter`: (Required) A filter that indicated which Boundary workers have access to the storage. Note: This must match an existing worker in order to create a storage bucket
- `shared_credentials_file`: (Optional) The shared credentials file to use.
- `shared_credentials_profile`: (Optional) The profile name to use in the shared credentials file.

@@ -91,7 +92,7 @@ Complete the following steps to create a storage bucket for session recording:
- **Region**: (Required) The AWS region to use.
- **Access key ID**: (Required) The access key ID that AWS generates for the IAM user to use with the storage bucket.
- **Secret access key**: (Required) The secret access key that AWS generates for the IAM user to use with this storage bucket.
- **Worker filter** (Required) A filter that indicated which Boundary workers have access to the storage.
- **Worker filter** (Required) A filter that indicated which Boundary workers have access to the storage. Note: This must match an existing worker in order to create a storage bucket
- **Disable credential rotation** (Optional) Although credentials are stored encrypted within Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. After rotation, only Boundary knows the client secret the plugin uses.

Select this option to disable this behavior and prevent the automatic rotation of credentials.
@@ -102,4 +103,4 @@ Complete the following steps to create a storage bucket for session recording:
</Tabs>

Boundary creates the storage bucket and provides you with the bucket's ID.
Once the storage bucket is created, you can use the bucket's ID to [enable session recording on targets](/boundary/docs/configuration/session-recording/enable-session-recording).
Once the storage bucket is created, you can use the bucket's ID to [enable session recording on targets](/boundary/docs/configuration/session-recording/enable-session-recording).
16 changes: 16 additions & 0 deletions website/content/docs/configuration/worker/pki-worker.mdx
Original file line number Diff line number Diff line change
@@ -73,6 +73,22 @@ kms "aead" {
}
```

## Session Recording <sup>(ENT/HCP Only)</sup>
[Session Recording](/boundary/docs/configuration/session-recording) requires at least one PKI worker with access to local and remote storage.
PKI Workers used for session recording require an accessible directory defined by `recording_storage_path` for
storing in-progress session recordings. On session closure, a local session recording is moved to remote storage and
deleted locally.

Development Example:

```hcl
worker {
auth_storage_path="/boundary/demo-worker-1"
initial_upstreams = ["10.0.0.1"]
recording_storage_path="/local/storage/directory"
}
```

~> **Note:** `name` and `description` fields are not valid config fields for PKI
workers. These fields are only valid for [KMS Workers](/boundary/docs/configuration/worker/kms-worker). `name` and
`description` can only be set for PKI workers through the API.

0 comments on commit 475dbc6

Please sign in to comment.