From 64df5deeb68bac523830b358fdc12a98f197b709 Mon Sep 17 00:00:00 2001 From: Dan Heath <76443935+Dan-Heath@users.noreply.github.com> Date: Wed, 14 Jun 2023 10:26:57 -0400 Subject: [PATCH] docs: Minor copy edits --- .../session-recording/create-storage-bucket.mdx | 8 +++++--- website/content/docs/configuration/worker/pki-worker.mdx | 9 ++++----- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/website/content/docs/configuration/session-recording/create-storage-bucket.mdx b/website/content/docs/configuration/session-recording/create-storage-bucket.mdx index f083bf11bd..97355d4c85 100644 --- a/website/content/docs/configuration/session-recording/create-storage-bucket.mdx +++ b/website/content/docs/configuration/session-recording/create-storage-bucket.mdx @@ -24,7 +24,9 @@ For more information about using session recording to audit user sessions, refer At this time, the only supported storage for storage buckets is AWS S3. In AWS S3, a storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the access and secret key. -- A Boundary PKI worker with access to the AWS S3 storage bucket. This worker must be configured with a local recording storage path, defined as `recording_storage_path`. For more details, refer to [PKI Workers](/boundary/docs/configuration/worker/pki-worker) +- A Boundary PKI worker with access to the AWS S3 storage bucket + + This worker must be configured with a local recording storage path, defined as `recording_storage_path`. For more details, refer to [PKI workers](/boundary/docs/configuration/worker/pki-worker). - An AWS IAM role policy with the following statement: ```json { @@ -71,7 +73,7 @@ Complete the following steps to create a storage bucket for session recording: - `access_key_id`: (Required) The AWS access key to use. - `secret_access_key_id`: (Required) The AWS secret access key to use. This attribute contains the secret access key for static credentials. - - `worker-filter`: (Required) A filter that indicated which Boundary workers have access to the storage. Note: This must match an existing worker in order to create a storage bucket + - `worker-filter`: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a storage bucket. - `shared_credentials_file`: (Optional) The shared credentials file to use. - `shared_credentials_profile`: (Optional) The profile name to use in the shared credentials file. @@ -92,7 +94,7 @@ Complete the following steps to create a storage bucket for session recording: - **Region**: (Required) The AWS region to use. - **Access key ID**: (Required) The access key ID that AWS generates for the IAM user to use with the storage bucket. - **Secret access key**: (Required) The secret access key that AWS generates for the IAM user to use with this storage bucket. - - **Worker filter** (Required) A filter that indicated which Boundary workers have access to the storage. Note: This must match an existing worker in order to create a storage bucket + - **Worker filter** (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a storage bucket. - **Disable credential rotation** (Optional) Although credentials are stored encrypted within Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. After rotation, only Boundary knows the client secret the plugin uses. Select this option to disable this behavior and prevent the automatic rotation of credentials. diff --git a/website/content/docs/configuration/worker/pki-worker.mdx b/website/content/docs/configuration/worker/pki-worker.mdx index 68a1f5fd1b..9cb475650a 100644 --- a/website/content/docs/configuration/worker/pki-worker.mdx +++ b/website/content/docs/configuration/worker/pki-worker.mdx @@ -73,13 +73,13 @@ kms "aead" { } ``` -## Session Recording (ENT/HCP Only) -[Session Recording](/boundary/docs/configuration/session-recording) requires at least one PKI worker with access to local and remote storage. -PKI Workers used for session recording require an accessible directory defined by `recording_storage_path` for +## Session recording (HCP/ENT) +[Session recording](/boundary/docs/configuration/session-recording) requires at least one PKI worker with access to local and remote storage. +PKI workers used for session recording require an accessible directory defined by `recording_storage_path` for storing in-progress session recordings. On session closure, a local session recording is moved to remote storage and deleted locally. -Development Example: +Development example: ```hcl worker { @@ -92,4 +92,3 @@ worker { ~> **Note:** `name` and `description` fields are not valid config fields for PKI workers. These fields are only valid for [KMS Workers](/boundary/docs/configuration/worker/kms-worker). `name` and `description` can only be set for PKI workers through the API. -