Create a storage bucket

As of Boundary 0.13.0, you can record and audit user sessions. A Boundary resource known as a storage bucket is used to store the recorded sessions. The storage bucket represents a bucket in an external store. Before you can enable session recording, you must create one or more storage buckets in Boundary and associate them with the external store.

A storage bucket can only belong to the Global scope or an Org scope. A storage bucket that is associated with the Global scope can be associated with any target. However, a storage bucket in an Org scope can only be associated with targets in a project from the same Org scope. Any storage buckets associated with an Org scope are deleted when the Org itself is deleted.

For more information about using session recording to audit user sessions, refer to Auditing.

Requirements

Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements. Session recording requires specific configuration for both the external store and the Boundary worker. At this time, the only supported storage is AWS S3.

AWS requirements

An AWS S3 storage bucket
You must associate the Boundary storage bucket with an AWS S3 storage bucket. An AWS S3 storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the access and secret key.

An AWS IAM role policy with the following statement:

 {
   "Version": "2012-10-17",
   "Statement": [
      {
         "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:GetObjectAttributes"
         ],
         "Effect": "Allow",
         "Resource": "arn:aws:s3:::session_recording_storage/foo/bar/zoo/*"
      },
      {
         "Action": [
            "iam:DeleteAccessKey",
            "iam:GetUser",
            "iam:CreateAccessKey"
         ],
         "Effect": "Allow",
         "Resource": "arn:aws:iam::123456789012:user/JohnDoe"
      }
   ]
}

If you apply KMS encryption to the storage bucket, you must add these additional permissions to the role policy for the storage bucket's IAM user:

{
   "Action": [
   "kms:Decrypt",
   "kms:GenerateDataKey",
   "kms:DescribeKey"
   ],
   "Effect": "Allow",
   "Resource": "arn:aws:kms:us-east-1:1234567890:key/uuid"
}

The following is an example working policy with KMS encryption configured on the S3 bucket:

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Sid": "S3Permissions",
        "Effect": "Allow",
        "Action": [
           "s3:PutObject",
           "s3:GetObject",
           "s3:GetObjectAttributes"
        ],
        "Resource": [
           "arn:aws:s3:::test-session-recording-bucket/*"
        ]
     },
     {
        "Sid": "UserPermissions",
        "Effect": "Allow",
        "Action": [
           "iam:DeleteAccessKey",
           "iam:GetUser",
           "iam:CreateAccessKey"
        ],
        "Resource": [
           "arn:aws:iam::1234567890:user/test-boundary"
        ]
     },
     {
        "Sid": "KMSPermissions",
        "Effect": "Allow",
        "Action": [
           "kms:Decrypt",
           "kms:GenerateDataKey",
           "kms:DescribeKey"
        ],
        "Resource": [
           "arn:aws:kms:us-east-2:1234567890:key/4b887395-c376-4936-8f37-80c592ea582c"
        ]
     }
  ]
}

Boundary workers requirements

Session recording requires at least one PKI worker that:

Has access to the AWS S3 storage bucket
Has an accessible directory defined by recording_storage_path for storing session recordings while they are in progress. On session closure, Boundary moves the local session recording to remote storage and deletes the local copy. For more details, refer to PKI workers.
Has at least 1 MB of available disk space.
Runs Darwin, Windows, or Linux. The following binaries are not supported for session recording: NetBSD, OpenBSD, Solaris.

Development example:

worker {
auth_storage_path="/boundary/demo-worker-1"
initial_upstreams = ["10.0.0.1"]
recording_storage_path="/local/storage/directory"
}

Complete the following steps to create a storage bucket in Boundary for session recording:

Log in to Boundary.
Use the following command to create a storage bucket in Boundary:
```
boundary storage-buckets create -bucket-name mybucket1 -plugin-name aws -secrets ‘{“access_key_id”: “123456789” , “secret_access_key” : “123/456789/12345678”}’ -worker-filter ‘“dev” in “/tags/type”’ -attributes ‘{“region”:”us-east-1”,”disable_credential_rotation”:true}’ -scope-id o_1234567890
```
Replace the values above with the following required AWS secrets and any optional attributes you want to associate with the Boundary storage bucket:
- region: (Required) The AWS region to use.
- bucket-name: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket.
- access_key_id: (Required) The AWS access key to use.
- secret_access_key_id: (Required) The AWS secret access key to use. This attribute contains the secret access key for static credentials.
- worker-filter: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- shared_credentials_file: (Optional) The shared credentials file to use.
- shared_credentials_profile: (Optional) The profile name to use in the shared credentials file.

Log in to Boundary.
Select Storage Buckets in the navigation bar.
Select New Storage Bucket.
Complete the following fields to create the Boundary storage bucket:
- Name: (Optional) The name field is optional, but if you enter a name it must be unique.
- Description: (Optional) An optional description of the Boundary storage bucket for identification purposes.
- Scope: (Required) A storage bucket can belong to the Global scope or an Org scope. It can only associated with targets from the scope it belongs to.
- Bucket name: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket.
- Bucket prefix: (Optional) A base path where session recordings are stored.
- Region: (Required) The AWS region to use.
- Access key ID: (Required) The access key ID that AWS generates for the IAM user to use with the storage bucket.
- Secret access key: (Required) The secret access key that AWS generates for the IAM user to use with this storage bucket.
- Worker filter (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- Disable credential rotation (Optional) Although credentials are stored encrypted within Boundary, by default the AWS plugin attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. After rotation, only Boundary knows the client secret the plugin uses.
  Select this option to disable this behavior and prevent the automatic rotation of credentials.
Select Save.

Boundary creates the storage bucket resource and provides you with the bucket's ID. Once the storage bucket is created in Boundary, you can use the bucket's ID to enable session recording on targets.