Secure, Ephemeral Oracle Database Access with HashiCorp Boundary and SQL*Plus

The connection died at midnight. Not because the network failed, but because the bastion host was gone. That’s how HashiCorp Boundary changes the rules.

Boundary removes the need for static credentials and manual SSH tunnels. You define roles, resources, and access policies. Authentication runs through OIDC, LDAP, or Vault. Authorization is enforced at the session layer. You get a short-lived session to a target system. Nothing to store. Nothing left behind.

Now bring SQL*Plus into the picture. Oracle DBAs and developers often connect through sqlplus user/password@host:port/service_name. In traditional setups, this means storing credentials or opening wide network access. By using HashiCorp Boundary with SQL*Plus, you avoid static secrets and risky firewall changes.

The flow is simple. Boundary connects you to an Oracle database target through its worker nodes. You log in to Boundary using your identity provider. Boundary brokers the connection, issuing an ephemeral TCP address and port bound to your session. You point SQL*Plus at that address. Once the session ends, the address is gone. No lingering open ports. No static passwords in scripts.

To set it up:

1. Install and configure Boundary (controller and workers).
2. Define a target with the Oracle DB host and port.
3. Configure a credential store or use Vault with dynamic secrets for Oracle.
4. Authenticate to Boundary from your local CLI.
5. Run sqlplus using the ephemeral session address provided by boundary connect tcp.

For example:

$ boundary connect tcp \
 -target-id ttcp_1234567890 \
 -listen-port 1522

$ sqlplus myuser/mypassword@//localhost:1522/ORCL

When combined with Vault dynamic credentials, mypassword doesn’t exist until the moment you connect, and it expires automatically. This workflow enforces security without slowing down your work. It centralizes access control, logs each session, and makes network exposure temporary.

HashiCorp Boundary with SQL*Plus solves the long-standing problem of secure, temporary database access for Oracle environments. It removes bastions, avoids static passwords, and keeps audit trails clean.

See this in action now—launch a live Boundary + SQL*Plus workflow in minutes at hoop.dev.