Boundary

Boundary is infrastructure-access software for organizations that need to control privileged connections across cloud and self-managed environments. It is best suited to teams that can make use of identity-based permissions, credential brokering, and infrastructure automation. Its breadth is compelling, but HCP usage-based pricing and the split between editions make cost and feature planning essential.

Overview

Rather than placing users directly on an underlying network, Boundary authenticates them and grants access to infrastructure targets. Just-in-time and least-privilege access, role-based authorization, and single sign-on through OIDC or LDAP give administrators several ways to constrain connections. TLS or mutual TLS protects communications, while envelope encryption protects sensitive stored data.

Boundary covers TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets. Users can connect with existing tools such as SSH clients, PuTTY, Remote Desktop, database clients, and web browsers, which helps preserve established workflows. The trade-off is that Boundary is an access layer to configure and operate, not a replacement for those client tools.

Key features

Identity and credential controls

Boundary integrates with Okta, Microsoft Entra ID, Auth0, other OIDC-compatible identity providers, and LDAP. It can broker credentials and work with HashiCorp Vault to provide short-lived dynamic credentials and credential injection. This is useful for teams trying to reduce standing credentials, but the more sophisticated credential flow depends on Vault integration and edition choice.

Discovery, audit, and automation

HCP Boundary can discover targets automatically and use dynamic host catalogs for AWS, Azure, and GCP. Audit logs and streaming support oversight, while session recording and playback are a Plus-edition capability. Terraform support, a REST API, CLI, and SDK give teams options to automate deployment and configuration; that flexibility is most valuable where infrastructure is already managed programmatically.

Boundary offers both managed and self-managed deployment: HashiCorp operates HCP Boundary, with optional customer-run workers, while Boundary Enterprise is self-managed. The choice is meaningful for teams balancing operational control against running the service themselves.

Pricing

Boundary uses a freemium model. Boundary Community Edition costs free and provides Community Edition features, making it the starting point for teams that want to evaluate or use the community offering. HCP Boundary is also offered free to get started.

HCP Boundary Standard and Plus use usage-based billing, with a monthly rate per user that depends on edition; both have custom pricing. Standard includes dynamic credential injection through Vault and audit log streaming. Plus adds session recording. Teams that need playback should account for Plus rather than assume it comes with Standard.

Boundary Enterprise is self-managed, offers full feature parity with HCP Boundary, and has custom pricing. That may suit organizations that need to operate Boundary themselves, while Community Edition is the no-cost option with community features. No seat quota or trial duration is established for Boundary, so teams should confirm the applicable terms before budgeting a larger deployment.

Platforms

Boundary supports API, Linux, macOS, self-hosted, web, and Windows. Downloads include macOS, Windows, and Linux installers, as well as desktop clients. Its hybrid deployment model and support for both access methods give teams flexibility, while familiar client compatibility helps accommodate SSH, remote desktop, database, and browser workflows.

Who it's for

Boundary is a strong fit for infrastructure and security teams that need identity-scoped access to a mix of cloud and self-hosted targets, especially when they value credential brokering, target discovery, session oversight, and infrastructure-as-code workflows. Organizations that do not need this level of infrastructure access control, or that prioritize a simple per-seat budget, may prefer a more directly priced access product.

Pros and cons

Pros

• Broad target support: Covers common remote access protocols as well as Kubernetes and database targets, reducing the need to treat each target type as a separate access workflow.
• Flexible identity and credential controls: OIDC, LDAP, role-based authorization, Vault integration, and just-in-time access support more tightly scoped infrastructure access.
• Choice of operating model: Teams can use HashiCorp-managed HCP Boundary or run Enterprise themselves.
• Automation and auditing: Terraform, API, CLI, SDK, audit streaming, and Plus session playback support managed operational workflows.

Cons

• HCP costs require forecasting: Usage-based monthly pricing per user varies by edition, so teams cannot infer a fixed bill from a headline seat price.
• Important capabilities are edition-dependent: Session recording and playback require Plus, while Enterprise is a separate self-managed option with custom pricing.
• Operational flexibility brings choices to manage: Selecting between Community, HCP tiers, and Enterprise requires matching deployment and access requirements to each edition.

Alternatives

For a wider comparison, browse Zero Trust Network Access Software.

• Cloudflare Access is a reasonable alternative for teams seeking a freemium access product with a free plan capped at under 50 users.
• Twingate is worth considering when a team wants a free Starter plan capped at five users and 50 resources.
• Bowtie Private Access may suit a smaller team looking for a free Basic plan for up to three users.
• NetBird is an option for teams seeking a free plan capped at five users and 100 machines, including self-hosted platform support.
• AWS Verified Access is an alternative for teams considering a paid access product that offers its desktop connectivity client free of charge.
• Cloudflare Gateway offers a free plan for 50 users with up to 24 hours of standard log retention, a clearer fit when those caps suit the use case.
• Pomerium is another freemium option, with a Personal Free plan covering 10 users, 10 routes, five policies, and two service accounts.
• OpenVPN CloudConnexa is an alternative access product with a Starter plan that includes five seats.

Verdict

Choose Boundary if your team needs identity-based infrastructure access, credential brokering, and a choice between managed HCP and self-managed deployment. Its key advantage is the combination of scoped access with broad target support and automation; its main drawback is that usage-based HCP pricing and edition-specific controls demand careful planning. Look elsewhere if a fixed, immediately comparable per-seat price is the deciding factor.