Hashicorp Vault (and presumably other Enterprise credential management tools - like CyberArk's) has a, similar (but not identical - no proxy) take. The credentials that you use are short-lived and provided by vault, which has a privileged connection to the back end Database, AWS, Certificate Server, etc...
You can lock down access to vault with whatever degree of 2FA/IdP you wish. So - your workflow is authenticate to Vault, which uses your identity (and possibly group membership from an IdP like Okta) - to identify the groups/policies you have, which in turn then grant you the authority to request (short lived < 24 hours typically) tokens that are generated in real-time (and likewise terminated when they age out).
The added benefit here is that if your service token is exposed - (A) The window of vulnerability is very short lived, and, (B) it's isolated to a single service.
I haven't worked with Boundary - but it sounds like your solution has some closer comparison to Hashicorp Boundary, right?
You can lock down access to vault with whatever degree of 2FA/IdP you wish. So - your workflow is authenticate to Vault, which uses your identity (and possibly group membership from an IdP like Okta) - to identify the groups/policies you have, which in turn then grant you the authority to request (short lived < 24 hours typically) tokens that are generated in real-time (and likewise terminated when they age out).
The added benefit here is that if your service token is exposed - (A) The window of vulnerability is very short lived, and, (B) it's isolated to a single service.
I haven't worked with Boundary - but it sounds like your solution has some closer comparison to Hashicorp Boundary, right?