Public/Test-PCOciAccess.ps1
|
function Test-PCOciAccess { <# .SYNOPSIS Tries the cheapest read of each family the tool uses and reports allowed, denied or failed. .DESCRIPTION For each read family of this release (compartments, instances, images, VNICs, volumes, backups, backup policies) in each compartment named, and for the Usage API at tenancy level, one list call with a limit of one. A denial comes with the policy statement in the form the IT team pastes. Nothing is written to the tenancy. .PARAMETER Context The context from Connect-PCOci. Default: the last one connected. .PARAMETER CompartmentId The compartments to probe. Default: the tenancy root. .PARAMETER Region The region to probe in. Default: the home region. .PARAMETER ReportPath Write the findings as JSON to this path as well. .EXAMPLE Test-PCOciAccess | Format-Table Family, CompartmentName, Outcome, Statement #> [CmdletBinding()] [OutputType([pscustomobject])] param( [PowerCraft.OCI.Core.Identity.OciContext]$Context, [string[]]$CompartmentId, [string]$Region, [string]$ReportPath ) $ctx = Get-PCOciContextOrThrow -Context $Context [string[]]$ids = if ($CompartmentId) { @($CompartmentId) } else { @($ctx.TenancyId) } $names = [System.Collections.Generic.Dictionary[string, string]]::new() $names[$ctx.TenancyId] = $ctx.TenancyName $findings = [PowerCraft.OCI.Core.Gateways.AccessProbe]::Run($ctx, [string[]]$ids, $names, [string]$Region) if ($ReportPath) { $json = [Newtonsoft.Json.JsonConvert]::SerializeObject($findings, [PowerCraft.OCI.Core.Snapshot.SnapshotWriter]::Settings()) [IO.File]::WriteAllText($ReportPath, ($json -replace "`r`n", "`n") + "`n", [Text.UTF8Encoding]::new($false)) } foreach ($f in $findings) { [pscustomobject]@{ Family = $f.Family CompartmentId = $f.CompartmentId CompartmentName = $f.CompartmentName Region = $f.Region Outcome = $f.Outcome Statement = $f.Statement Detail = $f.Detail } } } |