Public/Access/Grant-SCAAccess.ps1
|
function Grant-SCAAccess { <# .SYNOPSIS Elevates access to a cloud target under Secure Cloud Access's zero-standing-privileges model. .DESCRIPTION Calls POST /access/elevate to request time-bound, just-in-time access to a target returned by Get-SCAEligibleTarget. The request body must match the target/role shape CyberArk documents for this operation (see the .LINK below for the current schema); the simplest reliable way to build it is to take an object from Get-SCAEligibleTarget and pass it straight through via -InputObject, since SCA's eligibility and elevation payloads describe the same target. .PARAMETER InputObject The elevation request body: typically a target object from Get-SCAEligibleTarget, or a hashtable built to match the target/role fields CyberArk documents for this operation. .PARAMETER Session A psSCA.Session object or session name. Defaults to the current default session. .EXAMPLE Get-SCAEligibleTarget -Provider AWS | Where-Object accountId -eq '111122223333' | Grant-SCAAccess Elevates access to a specific eligible AWS account. .INPUTS System.Object. Accepts a target object from Get-SCAEligibleTarget via the pipeline. .OUTPUTS psSCA.ElevateAccessResult .NOTES Confirm the exact request body fields against CyberArk's published schema before relying on this in an automated pipeline; SCA's SwaggerHub-hosted spec is the source of truth. .LINK https://api-docs.cyberark.com/sca-api/docs/secure-cloud-access-apis #> [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')] [OutputType('psSCA.ElevateAccessResult')] param( [Parameter(Mandatory, ValueFromPipeline)] [object]$InputObject, [Parameter()] [object]$Session ) process { $target = if ($InputObject -is [hashtable]) { $InputObject } else { $InputObject | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable } $description = if ($target.accountId) { $target.accountId } elseif ($target.subscriptionId) { $target.subscriptionId } elseif ($target.projectId) { $target.projectId } else { 'target' } if ($PSCmdlet.ShouldProcess($description, 'Elevate Secure Cloud Access')) { Invoke-SCARequest -Session $Session -Service 'SCA' -Method POST -Path '/access/elevate' ` -Body $target -Operation 'Grant-SCAAccess' -TypeName 'psSCA.ElevateAccessResult' } } } |