Skip to content

Commit 3db331e

Browse files
harshitchaudhary94harshitchaudhary94
authored
Merge branch 'main' into harshitchaudhary94/TF-30688-1-0-2-patch-release-notes
2 parents 53cb9cd + 50635b2 commit 3db331e

File tree

827 files changed

+46543
-31
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

827 files changed

+46543
-31
lines changed

‎.github/PULL_REQUEST_TEMPLATE/hcp_pull_request_template.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
## Description
2+
3+
<!-- ID for Jira ticket e.g [SPE-1234] -->
4+
5+
:ticket: [Jira ticket]
6+
7+
<!-- Add a brief description of changes here. Include any other necessary relevant links -->
8+
9+
<!-- Help your reviewer understand the type of review you need by selecting the scope and urgency. -->
10+
11+
### Requested review scope:
12+
13+
- [ ] Content touched by the PR _only_ (typos, clarifications, tips)
14+
- [ ] Code test (command and code block changes)
15+
- [ ] Flow and language near changes (new/rearranged steps)
16+
- [ ] Review everything (rewrites, major changes)
17+
18+
### Review urgency:
19+
20+
- [ ] ASAP (bug fixes, broken content, imminent releases)
21+
- [ ] 3 days (small changes, easy reviews)
22+
- [ ] 1 week (default)
23+
- [ ] Best effort (very non-urgent)
24+
25+
<!-- Fill out only the appropriate checklist for your type of feature (or both if necessary) and delete the other one! -->
26+
27+
## All updates:
28+
29+
<!-- This section is mandatory for all PRs: -->
30+
31+
I have:
32+
33+
- [ ] Verified that all status checks have passed
34+
- [ ] Verified that preview environment has successfully deployed
35+
- [ ] Verified appropriate `label` applied (`hcp` + `product name`)
36+
- [ ] Added all required reviewers (code owners and external)
37+
38+
## Content checklist (optional)
39+
40+
Please do these things before requesting a review. I have:
41+
42+
- [ ] Made any associated code repositories public
43+
- [ ] Added the `hashicorp-education/teamName` to any additional code or example repos as repo admin
44+
- [ ] Added redirects for any moved or removed pages
45+
- [ ] Spell checked the tutorial(s)
46+
- [ ] Followed the [unified style guide](https://github.com/hashicorp/web-unified-docs/tree/main/docs/style-guide)
47+
- [ ] Linted code snippets (Details per language [here](https://github.com/hashicorp/engineering-docs/blob/master/writing/markdown.md#code-blocks))
48+
- [ ] Checked the steps for completeness (no steps are implied or hidden)
49+
- [ ] Looked at the local or vercel build and checked each new or changed page for:
50+
- display on the product curriculum page
51+
- callout box formatting
52+
- code block highlighting
53+
- right-hand navigation
54+
- next and back buttons
55+
- URL path

‎.github/labeler.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,3 +216,16 @@ Waypoint:
216216
- any-glob-to-any-file: [
217217
'content/hcp-docs/content/docs/waypoint/**'
218218
]
219+
220+
# Add 'HCP Docs' label to changes under 'content/hcp-docs'
221+
#
222+
# Label | Rule
223+
# --------------- | ------------------------------------------------------------
224+
# HCP Docs | Default; applies to all doc updates
225+
226+
HCP Docs:
227+
- any:
228+
- changed-files:
229+
- any-glob-to-any-file: [
230+
'content/hcp-docs/**'
231+
]

‎.github/pull_request_template.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Please go to the `Preview` tab and select the appropriate template:
2+
3+
* [HCP services](?expand=1&template=hcp_pull_request_template.md)
4+
* [Terraform Enterprise](?expand=1&template=ptfe_release_pull_request_template.md)

‎content/hcp-docs/content/docs/boundary/audit-logging.mdx‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
---
2+
page_title: Audit log streaming
3+
description: |-
4+
Set up audit log streaming for HCP Boundary with AWS CloudWatch or Datadog.
5+
---
6+
7+
# Audit log streaming
8+
9+
HCP Boundary supports near real-time streaming of audit events to existing customer managed accounts of supported providers. Audit events capture all create, list, update, and delete operations performed by an authenticated Boundary client (Desktop, CLI, or the browser-based admin UI) on any of the following Boundary resources:
10+
11+
- Sessions
12+
- Scopes
13+
- Workers
14+
- Credential stores, credential libraries, credentials
15+
- Auth methods, roles, managed groups, groups, users, accounts, grants
16+
- Host catalogs, host sets, host, targets
17+
18+
The captured data includes the user ID of the user performing the operation, the timestamp, and the full request and response payloads.
19+
20+
Audit logs allow administrators to track user activity and enable security teams to ensure compliance in accordance with regulatory requirements.
21+
22+
The documentation outlines the steps required to enable and configure audit log streaming to the supported providers AWS CloudWatch and Datadog. You can stream logs to one account at a time.
23+
24+
## Configure streaming with AWS CloudWatch
25+
26+
To configure audit log streaming with AWS CloudWatch, you must create an [IAM role](https://docs.aws.amazon.com/iam/?id=docs_gateway) that HCP Boundary can use to send logs to AWS CloudWatch. Below are the steps to create the IAM role with necessary configuration.
27+
28+
### Create IAM policy
29+
30+
1. Launch [AWS Management Console](https://console.aws.amazon.com/) and navigate to **IAM > Policies**, and click **Create policy**.
31+
1. Choose **JSON** and enter the following policy in the policy editor.
32+
33+
```json
34+
{
35+
"Version": "2012-10-17",
36+
"Statement": [
37+
{
38+
"Sid": "HCPLogStreaming",
39+
"Effect": "Allow",
40+
"Action": [
41+
"logs:PutLogEvents",
42+
"logs:DescribeLogStreams",
43+
"logs:DescribeLogGroups",
44+
"logs:CreateLogStream",
45+
"logs:CreateLogGroup",
46+
"logs:TagLogGroup"
47+
],
48+
"Resource": "*"
49+
}
50+
]
51+
}
52+
```
53+
54+
1. Click **Next**.
55+
1. Enter a name for the new policy, for example, `hcp-log-streaming`.
56+
1. Click **Create policy** to create the IAM policy.
57+
58+
### Configure the IAM role
59+
60+
Before you create a new IAM role, get the HashiCorp generated external ID from the HCP Portal.
61+
62+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
63+
1. Navigate to Boundary, and select your cluster.
64+
1. Select **Audit logs**.
65+
![Enable audit log streaming](/img/docs/boundary/enable-logs.png)
66+
1. Click **Enable log streaming**.
67+
1. Select **AWS CloudWatch**.
68+
1. Copy the **External ID** value.
69+
![HCP Portal - audit log streaming page](/img/docs/boundary/ui-audit-log-streaming.png)
70+
You will need this value during the IAM role creation.
71+
72+
Next, create the IAM role using AWS Management Console or HashiCorp Terraform.
73+
74+
<Tabs>
75+
<Tab heading="AWS Management Console">
76+
77+
1. Launch **AWS Management Console** and navigate to **IAM > Roles**, and click **Create role**.
78+
1. For **Trusted entity type**, select **AWS account**.
79+
1. For **An AWS account**, select **Another AWS account**.
80+
1. Enter **711430482607** in the **Account ID** field.
81+
1. Under **Options**, select **Require external ID**.
82+
1. Enter the **External ID** value you copied from the [HCP portal](https://portal.cloud.hashicorp.com/).
83+
1. Click **Next**.
84+
1. Select the policy you created earlier, and click **Next** to attach the policy to the role.
85+
1. Click **Create role** to complete.
86+
87+
88+
</Tab>
89+
<Tab heading="Terraform">
90+
91+
Use the following Terraform configuration to create the IAM role necessary to enable audit log streaming.
92+
93+
```hcl
94+
data "aws_iam_policy_document" "allow_hcp_to_stream_logs" {
95+
statement {
96+
effect = "Allow"
97+
actions = [
98+
"logs:PutLogEvents", # To write logs to cloudwatch
99+
"logs:DescribeLogStreams", # To get the latest sequence token of a log stream
100+
"logs:DescribeLogGroups", # To check if a log group already exists
101+
"logs:CreateLogGroup", # To create a new log group
102+
"logs:CreateLogStream" # To create a new log stream
103+
]
104+
resources = [
105+
"*"
106+
]
107+
}
108+
}
109+
110+
data "aws_iam_policy_document" "trust_policy" {
111+
statement {
112+
sid = "HCPLogStreaming"
113+
effect = "Allow"
114+
actions = ["sts:AssumeRole"]
115+
principals {
116+
identifiers = ["711430482607"]
117+
type = "AWS"
118+
}
119+
condition {
120+
test = "StringEquals"
121+
variable = "sts:ExternalId"
122+
values = [
123+
"<ExternalID-generated-by-Hashicorp>"
124+
]
125+
}
126+
}
127+
}
128+
129+
resource "aws_iam_role" "role" {
130+
name = "hcp-log-streaming"
131+
description = "iam role that allows hcp to send logs to cloudwatch logs"
132+
assume_role_policy = data.aws_iam_policy_document.trust_policy.json
133+
inline_policy {
134+
name = "inline-policy"
135+
policy = data.aws_iam_policy_document.allow_hcp_to_stream_logs.json
136+
}
137+
}
138+
```
139+
140+
</Tab>
141+
</Tabs>
142+
143+
Once you have created the IAM role, you can configure the audit log streaming in HCP Boundary.
144+
145+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
146+
1. From the HCP Boundary **Overview** page, select the **Audit logs** view.
147+
1. Click **Enable log streaming**.
148+
1. Select **AWS CloudWatch**.
149+
![AWS audit log configuration](/img/docs/boundary/aws-enable-logs.png)
150+
1. Under the **CloudWatch configuration** section, enter your **Destination name**, and **Role ARN**.
151+
1. Select the **Region** that matches where you want your data stored.
152+
1. Click **Save**.
153+
154+
Logs should arrive within your AWS CloudWatch environment in a few minutes after Boundary usage.
155+
156+
HashiCorp dynamically creates the log group and log streams for you. You can find the log group in your AWS CloudWatch with the prefix `/hashicorp` after setting up your configuration. The log group lets you filter the HashiCorp generated logs separately from other logs you may have in CloudWatch.
157+
158+
Refer to the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html) for details on log exploration.
159+
160+
## Configure streaming with Datadog
161+
162+
To configure audit log streaming with Datadog, you will need the following:
163+
164+
- The region your Datadog account is in
165+
- Your Datadog [API key](https://docs.datadoghq.com/account_management/api-app-keys/)
166+
167+
Complete the following steps:
168+
169+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
170+
1. Navigate to Boundary, and select your cluster.
171+
1. Select **Audit logs**.
172+
![Enable audit log streaming](/img/docs/boundary/enable-logs.png)
173+
1. Click **Enable log streaming**.
174+
1. Select **Datadog**.
175+
![Datadog audit log configuration](/img/docs/boundary/datadog-enable-logs.png)
176+
1. Under the **Datadog configuration**, enter your **Destination name** and **API Key**.
177+
1. Select the **Datadog site region** that matches your existing Datadog environment.
178+
1. Click **Save**
179+
180+
Logs should arrive within your Datadog environment in a few minutes after using Boundary.
181+
Refer to the [Datadog documentation](https://docs.datadoghq.com/getting_started/logs/#explore-your-logs) for details on log exploration.
182+
183+
## Test your streaming configuration
184+
185+
During the streaming configuration setup, you can test that the streaming configuration is working within HCP. Testing the configuration can be helpful when you want to verify you entered the correct credentials and other parameters on the configuration page. To test the configuration, enter the parameters for the logging provider you want to test, then click **Test connection**.
186+
187+
![Test Connection button](/img/docs/boundary/test-connection.png)
188+
189+
HCP sends a test message to the logging provider and shares the status of success or failure on the **Enable log streaming** page.
190+
191+
You can also test the configuration when you update a streaming configuration that you have already configured.
192+
193+
## Update your streaming configuration
194+
195+
You can update the configuration of the existing audit log streaming. For example, you may need to rotate a secret used for your logging provider, or you may need to switch from one logging provider to another.
196+
197+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
198+
1. Navigate to Boundary, and select your cluster.
199+
1. Select **Audit logs**.
200+
1. Select **Edit streaming configuration** under the **Manage** menu.
201+
![Update Connection menu](/img/docs/boundary/update-connection.png)
202+
203+
You can:
204+
- Select a new provider
205+
- Enter new parameters for the provider
206+
- Test the connection by selecting **Test connection**
207+
208+
1. Click **Save**.
209+
210+
## Retention
211+
212+
HCP Boundary stores the audit logs for a minimum of one year within the platform. HCP began archiving audit logs in October of 2022. The logs are available after the deletion of the cluster that created them. Please submit a request to the [HashiCorp Help Center](https://support.hashicorp.com/hc/en-us/requests/new) if you need access to logs from deleted clusters or have further questions.

‎content/hcp-docs/content/docs/boundary/configure-ttl.mdx‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
page_title: Configure auth token time to live (TTL)
3+
description: >-
4+
Learn how to configure the time to live (TTL) for the auth token that Boundary controllers issue.
5+
---
6+
7+
# Configure authentication time to live
8+
9+
You can configure the time-to-live (TTL) and time-to-stale (TTS) settings that control how often Boundary requires a user to authenticate.
10+
The TTL setting controls the lifespan of an auth token, while the TTS setting controls how long Boundary permits an auth token to be inactive.
11+
12+
Complete the following steps to configure the time-to-live and time-to-stale settings for any auth tokens your HCP controllers issue.
13+
14+
1. Log in to [the HCP Portal](https://portal.cloud.hashicorp.com/), and navigate to the **Overview** page for the Boundary cluster you want to configure.
15+
1. In the **Controller configuration** section, click **Edit**.
16+
1. Complete the following fields on the **Auth Token TTL** tab:
17+
- **Time to Live**: Enter the number of hours you want to let auth tokens be valid before requiring a user to authenticate again.
18+
Click **Set to default** to set the time-to-live setting to the default value.
19+
- **Time to Stale**: Enter the number of hours you want to let auth tokens be inactive before requiring a user to authenticate again.
20+
Click **Set to default** to set the time-to-stale setting to the default value.
21+
1. Click **Save**.
22+
23+
The updated settings apply to any new sessions you create.
24+
You can view the updated settings on the cluster **Overview** page in the **Controller configuration** section.

‎content/hcp-docs/content/docs/boundary/how-boundary-works.mdx‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
page_title: How HCP Boundary Works
3+
description: |-
4+
Describe the access model and deployment options of HCP Boundary.
5+
---
6+
7+
# How HCP Boundary works
8+
9+
HCP Boundary is an intelligent proxy that automates user and host onboarding, and provisions access permissions. Boundary creates a workflow for
10+
accessing infrastructure remotely with a number of key steps:
11+
12+
- **User authentication:** Integrates with trusted identity platforms (such as Azure Active Directory, Okta, Ping,
13+
[and many others that support OpenID Connect](/boundary/tutorials/access-management/oidc-auth)).
14+
- **Granular user authorization:** Allows operators to tightly control access to remote systems, and the actions against those systems.
15+
- **Automated connections to hosts:** As you deploy or update workloads, HCP Boundary updates connections to targets and hosts using automated service discovery. Dynamic host catalogs are available with [AWS](/boundary/docs/concepts/host-discovery/aws), [Azure](/boundary/docs/concepts/host-discovery/azure), and [GCP](/boundary/docs/concepts/host-discovery/gcp). This is critical in ephemeral, cloud-based environments so that operators don't need to reconfigure access lists.
16+
- **Integrated credential management:** HCP Boundary brokers access to target credentials natively or via integration with
17+
[HashiCorp Vault](/boundary/tutorials/access-management/oss-vault-cred-brokering-quickstart).
18+
- **Time-limited network access to targets:** Boundary provides time-limited proxies to private endpoints, avoiding the need to expose your network to users.
19+
- **Session monitoring and management:** Provides visibility into the sessions Boundary creates.
20+
21+
22+
## Access model
23+
24+
HCP Boundary provides a solution to protect and safeguard access to applications and critical systems by leveraging trusted identities, without exposing the underlying network. HCP Boundary is an identity-aware proxy that sits between users and the infrastructure they wish to connect.
25+
26+
The proxy has two components:
27+
28+
- **Controllers:** manage state for users, hosts, and access policies, and the external providers HCP Boundary can query for service discovery.
29+
- **Workers:** are a stateless proxy with end-network access to hosts under management. The control plane assigns each worker node to a target system once an authenticated user selects the target to connect.
30+
31+
The session starts for the user as a TCP tunnel wrapped in mutual TLS. This mitigates the risk of a man-in-the-middle attack. If a user is connecting to a
32+
host over SSH through an HCP Boundary tunnel, there are two layers of encryption: the SSH session that user creates, and the underlying TLS that HCP Boundary creates.
33+
34+
![Diagram of user requests flow through the worker node before HCP Boundary connects the user to the target system.](/img/docs/boundary/access-model.png)
35+
36+
37+
## Deployment options
38+
39+
HCP Boundary is fully managed by HashiCorp, but organizations can choose to self-manage Boundary workers (Boundary's gateway nodes). Self-managed workers enable
40+
organizations to proxy all session data through their own networks, while still providing the convenience of a managed service. In the standard fully-managed
41+
deployment model, HashiCorp manages the control plane and worker nodes, making it easy to get started with Boundary while facilitating scaling over time.
42+
43+
### Self-managed workers
44+
45+
Self-managed workers allow Boundary users to securely connect to private endpoints without exposing an organization's networks to the public, or to HashiCorp-managed
46+
resources. The organization's worker nodes proxy all session activities. To learn more about self-managed workers see the
47+
self-managed workers [tutorial](/boundary/tutorials/hcp-administration/hcp-manage-workers) and
48+
[operations document](/hcp/docs/boundary/self-managed-workers).
49+
50+
![Diagram of user requests flow through the self-managed worker before connecting to the target system.](/img/docs/boundary/self-managed-workers.png)

0 commit comments

Comments
 (0)