@ -65,7 +65,9 @@ Learn more about [credential brokering](/boundary/tutorials/hcp-getting-started/
Learn more about the [Vault dynamic secrets engine](/vault/docs/secrets).
## Credential injection <sup>HCP/ENT</sup>
## Credential injection
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
Credential injection is the process by which a credential is fetched from a credential store and then passed on to a worker for authentication to a remote machine.
With credential injection, the user never sees the credential required to authenticate to the target.
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
As of Boundary 0.12.0, you can configure SSH credential injection using [Vault's SSH secrets engine](/vault/docs/secrets/ssh) to create the SSH certificate credentials.
SSH certificate-based authentication extends key-based authentication using digital signatures.
@ -92,7 +92,9 @@ TCP targets have the following additional attribute:
- `default_port` - (required)
The default port to set on this target.
### SSH target attributes <sup>HCP/ENT</sup>
### SSH target attributes
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
SSH targets use injected application credentials to authenticate an SSH session between the client and end host.
Injected credentials allow users to securely connect to remost hosts using SSH, while never being in the possession of a valid credential for that target host.
@ -52,7 +52,10 @@ with tag “A,” to connect to targets in “Network A.”

## Multi-hop sessions <sup>HCP/ENT</sup>
## Multi-hop sessions
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
Most organizations want to provide access to infrastructure without exposing private networks. Many organizations also have complex network topologies requiring
inbound traffic to route through multiple network enclaves in order to reach the target system.
[Multi-hop](/boundary/docs/configuration/worker#multi-hop-worker-capabilities-hcp-ent) sessions allow you to chain together two or more workers
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
You can view a list of all recorded sessions, or if you know the ID of a specific recorded session, you can find any channels associated with that recording.
# How Boundary validates data integrity in the external object store
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
When a Boundary worker uploads a BSR file to AWS S3 through the Boundary AWS plugin, the plugin calculates the SHA256 checksum of the contents of the BSR file and attaches this information to the object that is uploaded to S3.
The SHA256 checksum value attached to the S3 object is returned to the Boundary worker.
The Boundary worker calculates the SHA256 checksum value of the BSR file's content from