Boundary

Boundary is built for organizations that need to grant infrastructure access by verified identity instead of placing people on the underlying network. It fits security and platform teams running mixed cloud and self-managed estates, especially where temporary privileges and credential brokering matter. The product is powerful, but choosing between managed HCP editions and self-managed Enterprise has direct operational and budgeting consequences.

Overview

Boundary authenticates a person, authorizes a narrowly scoped connection, and brokers the session to a target without exposing the surrounding network. Just-in-time and least-privilege policies, role-based authorization, and OIDC or LDAP single sign-on provide a practical way to reduce broad standing access. TLS or mutual TLS protects communications, while envelope encryption protects sensitive data stored by the service.

Connections cover TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets. Existing SSH clients, PuTTY, Remote Desktop, database applications, and browsers can be used, so teams do not have to replace established operator workflows with a proprietary client.

Key features

Identity and authorization

Integrations include Okta, Microsoft Entra ID, Auth0, other OIDC-compatible identity providers, and LDAP. Granular scopes and role-based controls let administrators separate environments and responsibilities. This is a strong fit for privileged-access programs; smaller teams seeking only a simple remote-access tunnel may find the policy model more than they need.

Credentials and target discovery

Boundary brokers credentials and can work with HashiCorp Vault to inject short-lived dynamic credentials. That reduces the exposure created by reusable secrets, although teams must be prepared to operate the Vault integration when they want that benefit. HCP Boundary can discover targets automatically and maintain dynamic host catalogs for AWS, Azure, and Google Cloud, which is valuable when infrastructure changes frequently.

Auditing and automation

Audit logs can be streamed for SIEM workflows, and the Plus edition adds session recording and playback. Those controls improve investigations and compliance evidence, but recording is an edition-dependent capability rather than a universal feature. Terraform support, a REST API, CLI, and SDK make Boundary suitable for repeatable platform provisioning instead of manual access administration.

Deployment and clients

HashiCorp operates HCP Boundary, with optional customer-run workers; Boundary Enterprise is self-managed. The installer provides macOS, Windows, and Linux downloads plus desktop clients, while the service also supports API and web use. This hybrid range accommodates regulated deployments and cloud-managed operations, but self-management brings infrastructure and upgrade responsibility.

Pricing

The free Community Edition and free HCP access make evaluation possible without a license charge, and a free trial is offered. Standard is the sensible managed tier when streaming and dynamic credentials are priorities; Plus is aimed at organizations that need replayable sessions. Enterprise suits teams that must run the control plane themselves. Because HCP billing is usage-based and no rates are published, forecast user volume before committing. The free options do not provide the Plus edition's recording capability.

Platforms

Boundary supports API, web, Linux, macOS, and Windows, with self-hosted deployment available. TCP, SSH, and RDP are core access methods, alongside HTTPS, RDS, Kubernetes, and database targets. Its hybrid deployment model supports both HashiCorp-managed service operation and customer-managed infrastructure.

Who it's for

Choose Boundary for infrastructure, security, and platform teams that need identity-centered privileged access across AWS, Azure, Google Cloud, and private systems, with SIEM export, Vault integration, or session evidence. It is less compelling for a small group that only needs a basic VPN replacement and has no appetite for policy, identity, or credential administration.

Pros and cons

Pros

• Identity-based, least-privilege access avoids exposing entire networks.
• Broad protocol and client support preserves SSH, RDP, database, and browser workflows.
• Vault integration enables short-lived credentials and credential injection.
• HCP discovery catalogs dynamic AWS, Azure, and Google Cloud hosts.
• Terraform, API, CLI, and SDK support repeatable automation, while audit streaming supports SIEM pipelines.

Cons

• HCP prices are usage-based and unpublished, making cost estimation difficult.
• Session recording is restricted to Plus.
• Enterprise customers must operate the self-managed deployment.
• Advanced credential brokering depends on HashiCorp Vault integration.

Alternatives

Cloudflare Access is a better fit for teams wanting a freemium service with a free tier capped at 50 users and broad mobile support. Pick Twingate when its free Starter plan's five-user and 50-resource limits match a smaller deployment. NetBird suits teams preferring self-hosting with a free allowance of five users and 100 machines. Bowtie Private Access is worth considering for a free, small-team setup capped at three users and two devices per user. Pomerium offers a personal free tier for 10 users, 10 routes, and five policies. AWS Verified Access is the alternative when an AWS-centered paid service is preferable. Cloudflare Gateway provides a free 50-user tier with up to 24 hours of standard log retention. OpenVPN CloudConnexa is a straightforward option when five included seats and a familiar VPN vendor matter.

Browse the Zero Trust Network Access Software category for more choices.

Verdict

Boundary is a strong recommendation for organizations that need granular, identity-based infrastructure access, Vault-backed credentials, and auditable sessions across hybrid environments. Its main reason to choose is the combination of protocol flexibility and privileged-access controls. Look elsewhere if predictable published pricing, a simpler setup, or a small-team free quota matters more than deep policy and deployment options.