Skip to content

Commit b3a0e95

Browse files
schavisschavis
authored
Merge branch 'main' into brian/secure-vault-with-tls
2 parents aa74f02 + 512dac3 commit b3a0e95

File tree

833 files changed

+46788
-66
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

833 files changed

+46788
-66
lines changed

‎.github/PULL_REQUEST_TEMPLATE/hcp_pull_request_template.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
## Description
2+
3+
<!-- ID for Jira ticket e.g [SPE-1234] -->
4+
5+
:ticket: [Jira ticket]
6+
7+
<!-- Add a brief description of changes here. Include any other necessary relevant links -->
8+
9+
<!-- Help your reviewer understand the type of review you need by selecting the scope and urgency. -->
10+
11+
### Requested review scope:
12+
13+
- [ ] Content touched by the PR _only_ (typos, clarifications, tips)
14+
- [ ] Code test (command and code block changes)
15+
- [ ] Flow and language near changes (new/rearranged steps)
16+
- [ ] Review everything (rewrites, major changes)
17+
18+
### Review urgency:
19+
20+
- [ ] ASAP (bug fixes, broken content, imminent releases)
21+
- [ ] 3 days (small changes, easy reviews)
22+
- [ ] 1 week (default)
23+
- [ ] Best effort (very non-urgent)
24+
25+
<!-- Fill out only the appropriate checklist for your type of feature (or both if necessary) and delete the other one! -->
26+
27+
## All updates:
28+
29+
<!-- This section is mandatory for all PRs: -->
30+
31+
I have:
32+
33+
- [ ] Verified that all status checks have passed
34+
- [ ] Verified that preview environment has successfully deployed
35+
- [ ] Verified appropriate `label` applied (`hcp` + `product name`)
36+
- [ ] Added all required reviewers (code owners and external)
37+
38+
## Content checklist (optional)
39+
40+
Please do these things before requesting a review. I have:
41+
42+
- [ ] Made any associated code repositories public
43+
- [ ] Added the `hashicorp-education/teamName` to any additional code or example repos as repo admin
44+
- [ ] Added redirects for any moved or removed pages
45+
- [ ] Spell checked the tutorial(s)
46+
- [ ] Followed the [unified style guide](https://github.com/hashicorp/web-unified-docs/tree/main/docs/style-guide)
47+
- [ ] Linted code snippets (Details per language [here](https://github.com/hashicorp/engineering-docs/blob/master/writing/markdown.md#code-blocks))
48+
- [ ] Checked the steps for completeness (no steps are implied or hidden)
49+
- [ ] Looked at the local or vercel build and checked each new or changed page for:
50+
- display on the product curriculum page
51+
- callout box formatting
52+
- code block highlighting
53+
- right-hand navigation
54+
- next and back buttons
55+
- URL path

‎.github/labeler.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,3 +216,16 @@ Waypoint:
216216
- any-glob-to-any-file: [
217217
'content/hcp-docs/content/docs/waypoint/**'
218218
]
219+
220+
# Add 'HCP Docs' label to changes under 'content/hcp-docs'
221+
#
222+
# Label | Rule
223+
# --------------- | ------------------------------------------------------------
224+
# HCP Docs | Default; applies to all doc updates
225+
226+
HCP Docs:
227+
- any:
228+
- changed-files:
229+
- any-glob-to-any-file: [
230+
'content/hcp-docs/**'
231+
]

‎.github/pull_request_template.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Please go to the `Preview` tab and select the appropriate template:
2+
3+
* [HCP services](?expand=1&template=hcp_pull_request_template.md)
4+
* [Terraform Enterprise](?expand=1&template=ptfe_release_pull_request_template.md)

‎.github/workflows/create-ga-pr.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: 📁 Create GA PR
2+
run-name: Create GA PR [${{ github.actor }}]
3+
4+
permissions:
5+
pull-requests: write
6+
contents: write
7+
8+
on:
9+
workflow_dispatch:
10+
inputs:
11+
targetVersion:
12+
required: true
13+
description: Preview version (e.g., "1.21.x")
14+
default: ''
15+
folderTag:
16+
required: true
17+
default: ''
18+
description: Preview dog tag (e.g., 'rc' or 'beta')
19+
product:
20+
required: true
21+
default: ''
22+
description: Product slug (e.g., 'vault')
23+
24+
env:
25+
prBranch: "${{ github.event.inputs.product }}/${{ github.event.inputs.targetVersion }}-to-ga"
26+
oldFolder: "v${{ github.event.inputs.targetVersion }} (${{ github.event.inputs.folderTag }})"
27+
newFolder: "v${{ github.event.inputs.targetVersion }}"
28+
29+
30+
jobs:
31+
32+
update-folder:
33+
runs-on: ubuntu-latest
34+
env:
35+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+
steps:
37+
- name: Check out main
38+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
39+
with:
40+
fetch-depth: 0
41+
- name: Configure Git User
42+
run: |
43+
git config user.name "GitHub Actions"
44+
git config user.email "team-rel-eng@hashicorp.com"
45+
- name: Update preview folder
46+
working-directory: ./content/${{ github.event.inputs.product }}
47+
run: |
48+
git pull origin main
49+
git checkout -B "${{ env.prBranch }}"
50+
mv "./${{ env.oldFolder }}" "./${{ env.newFolder }}"
51+
git add .
52+
git commit -m "Rename ${{ env.oldFolder }}"
53+
git push --force -u origin "${{ env.prBranch }}"
54+
55+
create-pr:
56+
runs-on: ubuntu-latest
57+
env:
58+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
59+
prTitle: "[PUBLISH GA] Convert ${{ github.event.inputs.targetVersion }} to GA"
60+
prBody: |
61+
🚧 \`${{ github.repository }}\` publication PR
62+
63+
**Triggered by**: @${{ github.actor }} with a Github action
64+
**Preview folder**: \`${{ github.event.inputs.product }}/v${{ github.event.inputs.targetVersion }} (${{ github.event.inputs.folderTag }})\`
65+
**New folder**: \`${{ github.event.inputs.product }}/v${{ github.event.inputs.targetVersion }}\`
66+
steps:
67+
- name: Check out repository code
68+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
69+
with:
70+
ref: ${{ env.prBranch }}
71+
fetch-depth: 0
72+
- name: Create pull request
73+
run: |
74+
gh pr create \
75+
--base main \
76+
--head ${{ env.prBranch }} \
77+
--title "${{ env.prTitle }}" \
78+
--body "${{ env.prBody }}"
79+
- name: Wrap-up
80+
run: |
81+
echo "🍏 Final job status: ${{ job.status }}"

‎content/hcp-docs/content/docs/boundary/audit-logging.mdx‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
---
2+
page_title: Audit log streaming
3+
description: |-
4+
Set up audit log streaming for HCP Boundary with AWS CloudWatch or Datadog.
5+
---
6+
7+
# Audit log streaming
8+
9+
HCP Boundary supports near real-time streaming of audit events to existing customer managed accounts of supported providers. Audit events capture all create, list, update, and delete operations performed by an authenticated Boundary client (Desktop, CLI, or the browser-based admin UI) on any of the following Boundary resources:
10+
11+
- Sessions
12+
- Scopes
13+
- Workers
14+
- Credential stores, credential libraries, credentials
15+
- Auth methods, roles, managed groups, groups, users, accounts, grants
16+
- Host catalogs, host sets, host, targets
17+
18+
The captured data includes the user ID of the user performing the operation, the timestamp, and the full request and response payloads.
19+
20+
Audit logs allow administrators to track user activity and enable security teams to ensure compliance in accordance with regulatory requirements.
21+
22+
The documentation outlines the steps required to enable and configure audit log streaming to the supported providers AWS CloudWatch and Datadog. You can stream logs to one account at a time.
23+
24+
## Configure streaming with AWS CloudWatch
25+
26+
To configure audit log streaming with AWS CloudWatch, you must create an [IAM role](https://docs.aws.amazon.com/iam/?id=docs_gateway) that HCP Boundary can use to send logs to AWS CloudWatch. Below are the steps to create the IAM role with necessary configuration.
27+
28+
### Create IAM policy
29+
30+
1. Launch [AWS Management Console](https://console.aws.amazon.com/) and navigate to **IAM > Policies**, and click **Create policy**.
31+
1. Choose **JSON** and enter the following policy in the policy editor.
32+
33+
```json
34+
{
35+
"Version": "2012-10-17",
36+
"Statement": [
37+
{
38+
"Sid": "HCPLogStreaming",
39+
"Effect": "Allow",
40+
"Action": [
41+
"logs:PutLogEvents",
42+
"logs:DescribeLogStreams",
43+
"logs:DescribeLogGroups",
44+
"logs:CreateLogStream",
45+
"logs:CreateLogGroup",
46+
"logs:TagLogGroup"
47+
],
48+
"Resource": "*"
49+
}
50+
]
51+
}
52+
```
53+
54+
1. Click **Next**.
55+
1. Enter a name for the new policy, for example, `hcp-log-streaming`.
56+
1. Click **Create policy** to create the IAM policy.
57+
58+
### Configure the IAM role
59+
60+
Before you create a new IAM role, get the HashiCorp generated external ID from the HCP Portal.
61+
62+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
63+
1. Navigate to Boundary, and select your cluster.
64+
1. Select **Audit logs**.
65+
![Enable audit log streaming](/img/docs/boundary/enable-logs.png)
66+
1. Click **Enable log streaming**.
67+
1. Select **AWS CloudWatch**.
68+
1. Copy the **External ID** value.
69+
![HCP Portal - audit log streaming page](/img/docs/boundary/ui-audit-log-streaming.png)
70+
You will need this value during the IAM role creation.
71+
72+
Next, create the IAM role using AWS Management Console or HashiCorp Terraform.
73+
74+
<Tabs>
75+
<Tab heading="AWS Management Console">
76+
77+
1. Launch **AWS Management Console** and navigate to **IAM > Roles**, and click **Create role**.
78+
1. For **Trusted entity type**, select **AWS account**.
79+
1. For **An AWS account**, select **Another AWS account**.
80+
1. Enter **711430482607** in the **Account ID** field.
81+
1. Under **Options**, select **Require external ID**.
82+
1. Enter the **External ID** value you copied from the [HCP portal](https://portal.cloud.hashicorp.com/).
83+
1. Click **Next**.
84+
1. Select the policy you created earlier, and click **Next** to attach the policy to the role.
85+
1. Click **Create role** to complete.
86+
87+
88+
</Tab>
89+
<Tab heading="Terraform">
90+
91+
Use the following Terraform configuration to create the IAM role necessary to enable audit log streaming.
92+
93+
```hcl
94+
data "aws_iam_policy_document" "allow_hcp_to_stream_logs" {
95+
statement {
96+
effect = "Allow"
97+
actions = [
98+
"logs:PutLogEvents", # To write logs to cloudwatch
99+
"logs:DescribeLogStreams", # To get the latest sequence token of a log stream
100+
"logs:DescribeLogGroups", # To check if a log group already exists
101+
"logs:CreateLogGroup", # To create a new log group
102+
"logs:CreateLogStream" # To create a new log stream
103+
]
104+
resources = [
105+
"*"
106+
]
107+
}
108+
}
109+
110+
data "aws_iam_policy_document" "trust_policy" {
111+
statement {
112+
sid = "HCPLogStreaming"
113+
effect = "Allow"
114+
actions = ["sts:AssumeRole"]
115+
principals {
116+
identifiers = ["711430482607"]
117+
type = "AWS"
118+
}
119+
condition {
120+
test = "StringEquals"
121+
variable = "sts:ExternalId"
122+
values = [
123+
"<ExternalID-generated-by-Hashicorp>"
124+
]
125+
}
126+
}
127+
}
128+
129+
resource "aws_iam_role" "role" {
130+
name = "hcp-log-streaming"
131+
description = "iam role that allows hcp to send logs to cloudwatch logs"
132+
assume_role_policy = data.aws_iam_policy_document.trust_policy.json
133+
inline_policy {
134+
name = "inline-policy"
135+
policy = data.aws_iam_policy_document.allow_hcp_to_stream_logs.json
136+
}
137+
}
138+
```
139+
140+
</Tab>
141+
</Tabs>
142+
143+
Once you have created the IAM role, you can configure the audit log streaming in HCP Boundary.
144+
145+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
146+
1. From the HCP Boundary **Overview** page, select the **Audit logs** view.
147+
1. Click **Enable log streaming**.
148+
1. Select **AWS CloudWatch**.
149+
![AWS audit log configuration](/img/docs/boundary/aws-enable-logs.png)
150+
1. Under the **CloudWatch configuration** section, enter your **Destination name**, and **Role ARN**.
151+
1. Select the **Region** that matches where you want your data stored.
152+
1. Click **Save**.
153+
154+
Logs should arrive within your AWS CloudWatch environment in a few minutes after Boundary usage.
155+
156+
HashiCorp dynamically creates the log group and log streams for you. You can find the log group in your AWS CloudWatch with the prefix `/hashicorp` after setting up your configuration. The log group lets you filter the HashiCorp generated logs separately from other logs you may have in CloudWatch.
157+
158+
Refer to the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html) for details on log exploration.
159+
160+
## Configure streaming with Datadog
161+
162+
To configure audit log streaming with Datadog, you will need the following:
163+
164+
- The region your Datadog account is in
165+
- Your Datadog [API key](https://docs.datadoghq.com/account_management/api-app-keys/)
166+
167+
Complete the following steps:
168+
169+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
170+
1. Navigate to Boundary, and select your cluster.
171+
1. Select **Audit logs**.
172+
![Enable audit log streaming](/img/docs/boundary/enable-logs.png)
173+
1. Click **Enable log streaming**.
174+
1. Select **Datadog**.
175+
![Datadog audit log configuration](/img/docs/boundary/datadog-enable-logs.png)
176+
1. Under the **Datadog configuration**, enter your **Destination name** and **API Key**.
177+
1. Select the **Datadog site region** that matches your existing Datadog environment.
178+
1. Click **Save**
179+
180+
Logs should arrive within your Datadog environment in a few minutes after using Boundary.
181+
Refer to the [Datadog documentation](https://docs.datadoghq.com/getting_started/logs/#explore-your-logs) for details on log exploration.
182+
183+
## Test your streaming configuration
184+
185+
During the streaming configuration setup, you can test that the streaming configuration is working within HCP. Testing the configuration can be helpful when you want to verify you entered the correct credentials and other parameters on the configuration page. To test the configuration, enter the parameters for the logging provider you want to test, then click **Test connection**.
186+
187+
![Test Connection button](/img/docs/boundary/test-connection.png)
188+
189+
HCP sends a test message to the logging provider and shares the status of success or failure on the **Enable log streaming** page.
190+
191+
You can also test the configuration when you update a streaming configuration that you have already configured.
192+
193+
## Update your streaming configuration
194+
195+
You can update the configuration of the existing audit log streaming. For example, you may need to rotate a secret used for your logging provider, or you may need to switch from one logging provider to another.
196+
197+
1. Launch the [HCP Portal](https://portal.cloud.hashicorp.com/).
198+
1. Navigate to Boundary, and select your cluster.
199+
1. Select **Audit logs**.
200+
1. Select **Edit streaming configuration** under the **Manage** menu.
201+
![Update Connection menu](/img/docs/boundary/update-connection.png)
202+
203+
You can:
204+
- Select a new provider
205+
- Enter new parameters for the provider
206+
- Test the connection by selecting **Test connection**
207+
208+
1. Click **Save**.
209+
210+
## Retention
211+
212+
HCP Boundary stores the audit logs for a minimum of one year within the platform. HCP began archiving audit logs in October of 2022. The logs are available after the deletion of the cluster that created them. Please submit a request to the [HashiCorp Help Center](https://support.hashicorp.com/hc/en-us/requests/new) if you need access to logs from deleted clusters or have further questions.

‎content/hcp-docs/content/docs/boundary/configure-ttl.mdx‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
page_title: Configure auth token time to live (TTL)
3+
description: >-
4+
Learn how to configure the time to live (TTL) for the auth token that Boundary controllers issue.
5+
---
6+
7+
# Configure authentication time to live
8+
9+
You can configure the time-to-live (TTL) and time-to-stale (TTS) settings that control how often Boundary requires a user to authenticate.
10+
The TTL setting controls the lifespan of an auth token, while the TTS setting controls how long Boundary permits an auth token to be inactive.
11+
12+
Complete the following steps to configure the time-to-live and time-to-stale settings for any auth tokens your HCP controllers issue.
13+
14+
1. Log in to [the HCP Portal](https://portal.cloud.hashicorp.com/), and navigate to the **Overview** page for the Boundary cluster you want to configure.
15+
1. In the **Controller configuration** section, click **Edit**.
16+
1. Complete the following fields on the **Auth Token TTL** tab:
17+
- **Time to Live**: Enter the number of hours you want to let auth tokens be valid before requiring a user to authenticate again.
18+
Click **Set to default** to set the time-to-live setting to the default value.
19+
- **Time to Stale**: Enter the number of hours you want to let auth tokens be inactive before requiring a user to authenticate again.
20+
Click **Set to default** to set the time-to-stale setting to the default value.
21+
1. Click **Save**.
22+
23+
The updated settings apply to any new sessions you create.
24+
You can view the updated settings on the cluster **Overview** page in the **Controller configuration** section.

0 commit comments

Comments
 (0)