Hi everyone, I've been tasked with researching a modern SSH access management solution for our engineering org. We're about 200 engineers, mostly in cloud infra and platform teams, and our current method of distributing SSH keys to our fleet of VMs and databases is… let's say, not great. It's a mix of shared accounts and static keys that gives our security team nightmares.
We've narrowed it down to Boundary and Teleport, and I'm trying to understand the practical, day-to-day differences. I'm cautious about picking a tool that might be overkill or too complex for our actual needs.
From my research so far:
* Teleport seems very focused on the Kubernetes and SSH use case, with features like session recording baked right in. The "just run the agent" model looks straightforward.
* Boundary's model of "identity-based access" to any target (including SSH, but also databases and web apps) via a proxy seems more abstract. I've read it can be more flexible long-term.
My main concerns are around operational overhead and the actual user experience for engineers. For those who have implemented either:
1. How steep is the learning curve for the team managing the platform? We have a small ops team.
2. What does the engineer workflow look like? Do engineers find it more of a hassle than just using their old SSH configs?
3. For a scale of ~200 people and thousands of targets, how does the pricing compare realistically? I'm trying to build a solid ROI case.
Any gotchas or things you wish you'd known before rolling out one of these tools would be super helpful. I really want to avoid a bad purchase that the team ends up resenting.