Public/Test-PCOciAccess.ps1
|
function Test-PCOciAccess { <# .SYNOPSIS Tries the cheapest read of each family the tool uses and reports allowed, denied or failed. .DESCRIPTION For each read family of this release (compartments, instances, images, VNICs, volumes, backups, backup policies, networks, agent plugins, clusters, load balancers of both services) in each compartment named, and for the Usage API, Cloud Guard and Monitoring at tenancy level, one list call with a limit of one. The plugin probe needs a running instance and is skipped in a compartment without one. A denial comes with the policy statement in the form the IT team pastes. Nothing is written to the tenancy. .PARAMETER Context The context from Connect-PCOci. Default: the last one connected. .PARAMETER CompartmentId The compartments to probe. Default: the tenancy root. .PARAMETER Region The region to probe in. Default: the home region. .PARAMETER ReportPath Write the findings as JSON to this path as well. .EXAMPLE Test-PCOciAccess | Format-Table Family, CompartmentName, Outcome, Statement #> [CmdletBinding()] [OutputType([pscustomobject])] param( [PowerCraft.OCI.Core.Identity.OciContext]$Context, [string[]]$CompartmentId, [string]$Region, [string]$ReportPath ) $ctx = Get-PCOciContextOrThrow -Context $Context [string[]]$ids = if ($CompartmentId) { @($CompartmentId) } else { @($ctx.TenancyId) } $names = [System.Collections.Generic.Dictionary[string, string]]::new() $names[$ctx.TenancyId] = $ctx.TenancyName $findings = [PowerCraft.OCI.Core.Gateways.AccessProbe]::Run($ctx, [string[]]$ids, $names, [string]$Region) if ($ReportPath) { $json = [Newtonsoft.Json.JsonConvert]::SerializeObject($findings, [PowerCraft.OCI.Core.Snapshot.SnapshotWriter]::Settings()) [IO.File]::WriteAllText($ReportPath, ($json -replace "`r`n", "`n") + "`n", [Text.UTF8Encoding]::new($false)) } foreach ($f in $findings) { [pscustomobject]@{ Family = $f.Family CompartmentId = $f.CompartmentId CompartmentName = $f.CompartmentName Region = $f.Region Outcome = $f.Outcome Statement = $f.Statement Detail = $f.Detail } } } |