Public/Policies/New-SIAAccessPolicy.ps1
|
function New-SIAAccessPolicy { <# .SYNOPSIS Adds a legacy SIA VM access policy. .DESCRIPTION Adds a policy to SIA's original "Recurring access policies" engine. Only applies to tenants still on that engine; see docs/API-COMPATIBILITY.md. -ProvidersData and -UserAccessRules stay generic because CyberArk's schema defines them as open, deeply nested objects (cloud provider details and access-rule conditions, respectively) rather than a fixed shape. .PARAMETER PolicyName A display name for the policy, 1-300 characters. .PARAMETER Description A description of the policy. .PARAMETER Status The policy status. An active policy is 'Enabled'; set 'Disabled' to suspend it. Defaults to 'Draft'. .PARAMETER StartDate When the policy becomes active. .PARAMETER EndDate When the policy expires. .PARAMETER ProvidersData Cloud provider-specific policy data. .PARAMETER UserAccessRules The access rules specifying the access profile, which members can assume it, and when users are allowed to access the assets. .EXAMPLE New-SIAAccessPolicy -PolicyName 'DBA-weekday-access' -Status Enabled Adds a new, active legacy access policy. .INPUTS None. .OUTPUTS psSIA.AccessPolicy .LINK https://docs.cyberark.com/setup/latest/en/content/privileged-access/apis/dpa_policies.htm #> [CmdletBinding(SupportsShouldProcess)] [OutputType('psSIA.AccessPolicy')] param( [Parameter(Mandatory)] [ValidateLength(1, 300)] [string]$PolicyName, [string]$Description, [ValidateSet('Irrelevant', 'Enabled', 'Disabled', 'Draft', 'Expired')] [string]$Status = 'Draft', [datetime]$StartDate, [datetime]$EndDate, [hashtable]$ProvidersData, [array]$UserAccessRules ) if ($PSCmdlet.ShouldProcess($PolicyName, 'Add legacy access policy')) { $body = @{ policyName = $PolicyName policyType = 'VM' status = $Status } if ($PSBoundParameters.ContainsKey('Description')) { $body.description = $Description } if ($PSBoundParameters.ContainsKey('StartDate')) { $body.startDate = $StartDate.ToString('o') } if ($PSBoundParameters.ContainsKey('EndDate')) { $body.endDate = $EndDate.ToString('o') } if ($PSBoundParameters.ContainsKey('ProvidersData')) { $body.providersData = $ProvidersData } if ($PSBoundParameters.ContainsKey('UserAccessRules')) { $body.userAccessRules = $UserAccessRules } Invoke-SIARequest -Method POST -Path '/api/access-policies' -Body $body | ConvertFrom-SIAResponse -TypeName 'psSIA.AccessPolicy' } } |