Manage Scopes

Scopes are a foundational part of Boundary. They allow users to partition resources and assign ownership of resources to principals. There are three types of scopes within Boundary:

  1. Global (global)
  2. Org
  3. Project

These are in a hierarchy:

  • There is only one single global scope. It is meant as the entry point for initial administration/setup and to manage org scopes.
  • Under the global scope there can be many org scopes. These are used to hold IAM-related resources and project scopes.
  • Under each org scope can be many project scopes. These are used to hold infrastructure-related resources.

Some resources can only be associated with a specific level of scope. As an example, Targets can only be contained within a project scope. Other resources can be contained by multiple scopes. For example, users can be created within the global scope or an org-level scope. See the domain model for detailed resource specific information.

In this example, we’re going to create two scopes, an org and a project.

All resource IDs in this example are illustration only - IDs are uniquely generated for every resource upon creation with the exception being generated resources in dev mode. Please make sure to use the resource IDs that are generated when running this example. For example, if you run boundary users create, use the resource ID of the user seen in stdout, not the ID in the example command.

Create an Org

In this example, we’re going to create an org, which lives in the global scope.

The CLI and UI will default to having certain administrative roles be created automatically when a scope is created, so that the user that created the scope can immediately manage it. The Terraform provider defaults skipping creation of those roles so that resources are not created outside of Terraform’s purview. To simplify this example, we are telling Terraform to allow these roles to be created in both this section and in the next section where we create a project scope.

CLIAdmin ConsoleTerraform

Manage Scopes - 图1

Manage Scopes - 图2

  1. $ boundary scopes create -scope-id global -name my_org -description 'My first org'
  3. Scope information:
  4.   Created Time:        Tue, 29 Sep 2020 05:48:22 PDT
  5.   Description:         My first org
  6.   ID:                  o_y0fEd8iY2J
  7.   Name:                my_org
  8.   Updated Time:        Tue, 29 Sep 2020 05:48:22 PDT
  9.   Version:             1
  11.   Scope (parent):
  12.     ID:                global
  13.     Name:              global
  14.     Type:              global

Create a Project

Next, we’re going to add a project scope to our org.

CLIAdmin ConsoleTerraform

Manage Scopes - 图3

Manage Scopes - 图4

  1. $ boundary scopes create -scope-id o_0MkQUfE9jA -name my_project -description 'My first project'
  3. Scope information:
  4.   Created Time:        Tue, 29 Sep 2020 05:57:45 PDT
  5.   Description:         My first project
  6.   ID:                  p_jqCwqjSTQ4
  7.   Name:                my_project
  8.   Updated Time:        Tue, 29 Sep 2020 05:57:45 PDT
  9.   Version:             1
  11.   Scope (parent):
  12.     ID:                o_0MkQUfE9jA
  13.     Name:              my_org
  14.     Parent Scope ID:   global
  15.     Type:              org