cyberark.pas.cyberark_account – Module for CyberArk Account object creation, deletion, and modification using PAS Web Services SDK.
cyberark.pas.cyberark_account – Module for CyberArk Account object creation, deletion, and modification using PAS Web Services SDK.
Note
This plugin is part of the cyberark.pas collection (version 1.0.5).
To install it use: ansible-galaxy collection install cyberark.pas
.
To use it in a playbook, specify: cyberark.pas.cyberark_account
.
New in version 2.4: of cyberark.pas
Synopsis
- Creates a URI for adding, deleting, modifying a privileged credential within the Cyberark Vault. The request uses the Privileged Account Security Web Services SDK.
Parameters
Parameter | Choices/Defaults | Comments | |
---|---|---|---|
address string |
The address of the endpoint where the privileged account is located. | ||
api_base_url string / required |
A string containing the base URL of the server hosting CyberArk's Privileged Account Security Web Services SDK. Example https:///PasswordVault/api/ | ||
cyberark_session dictionary / required |
Dictionary set by a CyberArk authentication containing the different values to perform actions on a logged-on CyberArk session, please see cyberark_authentication module for an example of cyberark_session. | ||
identified_by string |
Default: "username,address,platform_id" |
When an API call is made to Get Accounts, often times the default parameters passed will identify more than one account. This parameter is used to confidently identify a single account when the default query can return multiple results. | |
logging_file string |
Default: "/tmp/ansible_cyberark.log" |
Setting the log file name and location for troubleshooting logs. | |
logging_level string / required |
|
Parameter used to define the level of troubleshooting output to the | |
name string |
The ObjectID of the account | ||
new_secret string |
The new secret/password to be stored in CyberArk Vault. | ||
platform_account_properties dictionary |
Object containing key-value pairs to associate with the account, as defined by the account platform. These properties are validated against the mandatory and optional properties of the specified platform's definition. Optional properties that do not exist on the account will not be returned here. Internal properties are not returned. | ||
KEY string |
Freeform key value associated to the mandatory or optional property assigned to the specified Platform's definition.
| ||
platform_id string |
The PolicyID of the Platform that is to be managing the account | ||
remote_machines_access dictionary |
Set of parameters for defining PSM endpoint access targets. | ||
access_restricted_to_remote_machines boolean |
|
Whether or not to restrict access only to specified remote machines. | |
remote_machines string |
List of targets allowed for this account. | ||
safe string / required |
The safe in the Vault where the privileged account is to be located. | ||
secret string |
The initial password for the creation of the account | ||
secret_management dictionary |
Set of parameters associated with the management of the credential. | ||
automatic_management_enabled boolean |
|
Parameter that indicates whether the CPM will manage the password or not. | |
management_action string |
|
CPM action flag to be placed on the account object for credential rotation. | |
manual_management_reason string |
String value indicating why the CPM will NOT manage the password. | ||
new_secret string |
The actual password value that will be assigned for the CPM action to be taken. | ||
perform_management_action string |
|
| |
secret_type string |
|
The value that identifies what type of account it will be. | |
state string / required |
|
Assert the desired state of the account | |
username string |
The username associated with the account. | ||
validate_certs boolean |
|
If |
Examples
collections:
- cyberark.pas
tasks:
- name: Logon to CyberArk Vault using PAS Web Services SDK
cyberark_authentication:
api_base_url: "http://components.cyberark.local"
validate_certs: no
username: "bizdev"
password: "Cyberark1"
- name: Creating an Account using the PAS WebServices SDK
cyberark_account:
logging_level: DEBUG
identified_by: "address,username"
safe: "Test"
address: "cyberark.local"
username: "administrator-x"
platform_id: WinServerLocal
secret: "@N&Ibl3!"
platform_account_properties:
LogonDomain: "cyberark"
OwnerName: "ansible_user"
secret_management:
automatic_management_enabled: true
state: present
cyberark_session: "{{ cyberark_session }}"
register: cyberarkaction
- name:
- Rotate credential via reconcile and providing the password to
bechanged to.
cyberark_account:
identified_by: "address,username"
safe: "Domain_Admins"
address: "prod.cyberark.local"
username: "admin"
platform_id: WinDomain
platform_account_properties:
LogonDomain: "PROD"
secret_management:
new_secret: "Ama123ah12@#!Xaamdjbdkl@#112"
management_action: "reconcile"
automatic_management_enabled: true
state: present
cyberark_session: "{{ cyberark_session }}"
register: reconcileaccount
- name: Logoff from CyberArk Vault
cyberark_authentication:
state: absent
cyberark_session: "{{ cyberark_session }}"
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key | Returned | Description | ||
---|---|---|---|---|
changed boolean |
always |
Identify if the playbook run resulted in a change to the account in any way.
| ||
failed boolean |
always |
Whether playbook run resulted in a failure of any kind.
| ||
result complex |
success |
A json dump of the resulting action.
| ||
address string |
successful addition and modification |
The adress of the endpoint where the privileged account is located.
Sample: dev.local | ||
createdTime integer |
successful addition and modification |
Timeframe calculation of the timestamp of account creation.
Sample: 1567824520 | ||
id integer |
successful addition and modification |
Internal ObjectID for the account object identified
Sample: 25_21 | ||
name string |
successful addition and modification |
The external ObjectID of the account
Sample: ['Operating System-WinServerLocal-cyberark.local-administrator'] | ||
platformAccountProperties complex |
successful addition and modification |
Object containing key-value pairs to associate with the account, as defined by the account platform.
| ||
KEY VALUE string |
successful addition and modification |
Object containing key-value pairs to associate with the account, as defined by the account platform.
Sample: [{'LogonDomain': 'cyberark'}, {'Port': '22'}] | ||
platformId string |
successful addition and modification |
The PolicyID of the Platform that is to be managing the account.
Sample: WinServerLocal | ||
safeName string |
successful addition and modification |
The safe in the Vault where the privileged account is to be located.
Sample: Domain_Admins | ||
secretManagement complex |
successful addition and modification |
Set of parameters associated with the management of the credential.
Sample: {'automaticManagementEnabled': {'description': ['Parameter that indicates whether the CPM will manage the password or not.'], 'returned': 'successful addition and modification', 'type': 'bool'}, 'lastModifiedTime': {'description': ['Timeframe calculation of the timestamp of account modification.'], 'returned': 'successful addition and modification', 'sample': '1567824520', 'type': 'int'}, 'manualManagementReason': {'description': None, 'returned': 'if | ||
secretType list / elements=string |
successful addition and modification |
The value that identifies what type of account it will be
Sample: ['key', 'password'] | ||
userName string |
successful addition and modification |
The username associated with the account
Sample: administrator | ||
status_code integer |
success |
Result HTTP Status code.
Sample: 200, 201, -1, 204 |
Authors
- CyberArk BizDev (@cyberark-bizdev)
- Edward Nunez (@enunez-cyberark)
- James Stutes (@jimmyjamcabd)
© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.10/collections/cyberark/pas/cyberark_account_module.html