Configure Amazon S3 as a storage provider
This feature requires HCP Boundary or Boundary Enterprise
This page describes how to configure Amazon S3 as a storage provider for session recording with Boundary.
Requirements
Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements.
Session recording requires specific configuration for both the external storage provider and the Boundary worker.
Refer to Configure workers for session recording to learn about configuring self-managed workers for session recording.
When you determine storage requirements for the external bucket, you should consider:
AWS requirements
An Amazon S3 storage bucket
You must associate the Boundary storage bucket with an Amazon S3 storage bucket. A Boundary Amazon S3 storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket.
The Amazon S3 storage bucket can use static or dynamic credentials. You can configure static credentials using an access key and secret key or dynamic credentials using the AWS
AssumeRole
API.An AWS IAM role policy with the following statement:
If you apply KMS encryption to the storage bucket, you must add these additional permissions to the role policy for the storage bucket's IAM user:
The following is an example working policy with KMS encryption configured on the S3 bucket:
Next steps
After you configure the external storage provider, you can create the storage bucket in Boundary.