You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

cyberark.pas.cyberark_account module – Module for CyberArk Account object creation, deletion, and modification using PAS Web Services SDK.

Note

This module is part of the cyberark.pas collection (version 1.0.14).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install cyberark.pas.

To use it in a playbook, specify: cyberark.pas.cyberark_account.

New in version 2.4: of cyberark.pas

Synopsis
Parameters
Examples
Return Values

Synopsis 

Creates a URI for adding, deleting, modifying a privileged credential within the Cyberark Vault. The request uses the Privileged Account Security Web Services SDK.

Parameters 

Parameter	Comments
address string	The address of the endpoint where the privileged account is located.
api_base_url string / required	A string containing the base URL of the server hosting CyberArk’s Privileged Account Security Web Services SDK. Example https://<IIS_Server_Ip>/PasswordVault/api/
cyberark_session dictionary / required	Dictionary set by a CyberArk authentication containing the different values to perform actions on a logged-on CyberArk session, please see M(cyberark_authentication) module for an example of cyberark_session.
identified_by string	When an API call is made to Get Accounts, often times the default parameters passed will identify more than one account. This parameter is used to confidently identify a single account when the default query can return multiple results. Default: “username,address,platform_id”
logging_file string	Setting the log file name and location for troubleshooting logs. Default: “/tmp/ansible_cyberark.log”
logging_level string / required	Parameter used to define the level of troubleshooting output to the `logging_file` value. Choices: NOTSET DEBUG INFO
name string	The ObjectID of the account
new_secret string	The new secret/password to be stored in CyberArk Vault.
platform_account_properties dictionary	Object containing key-value pairs to associate with the account, as defined by the account platform. These properties are validated against the mandatory and optional properties of the specified platform’s definition. Optional properties that do not exist on the account will not be returned here. Internal properties are not returned.
KEY aliases: Port, ExtrPass1Name, database string	Freeform key value associated to the mandatory or optional property assigned to the specified Platform’s definition.
platform_id string	The PolicyID of the Platform that is to be managing the account
remote_machines_access dictionary	Set of parameters for defining PSM endpoint access targets.
access_restricted_to_remote_machines boolean	Whether or not to restrict access only to specified remote machines. Choices: no yes
remote_machines string	List of targets allowed for this account.
safe string / required	The safe in the Vault where the privileged account is to be located.
secret string	The initial password for the creation of the account
secret_management dictionary	Set of parameters associated with the management of the credential.
automatic_management_enabled boolean	Parameter that indicates whether the CPM will manage the password or not. Choices: no ← (default) yes
management_action string	CPM action flag to be placed on the account object for credential rotation. Choices: change change_immediately reconcile
manual_management_reason string	String value indicating why the CPM will NOT manage the password.
new_secret string	The actual password value that will be assigned for the CPM action to be taken.
perform_management_action string	`always` will perform the management action in every action. `on_create` will only perform the management action right after the account is created. Choices: always ← (default) on_create
secret_type string	The value that identifies what type of account it will be. Choices: password ← (default) key
state string / required	Assert the desired state of the account `present` to creat or update and account object. Set to `absent` for deletion of an account object. Choices: present ← (default) absent
username string	The username associated with the account.
validate_certs boolean	If `false`, SSL certificate chain will not be validated. This should only set to `true` if you have a root CA certificate installed on each node. Choices: no yes ← (default)

Examples 

collections:
  - cyberark.pas

tasks:

  - name: Logon to CyberArk Vault using PAS Web Services SDK
    cyberark_authentication:
      api_base_url: "http://components.cyberark.local"
      validate_certs: no
      username: "bizdev"
      password: "Cyberark1"

  - name: Creating an Account using the PAS WebServices SDK
    cyberark_account:
      logging_level: DEBUG
      identified_by: "address,username"
      safe: "Test"
      address: "cyberark.local"
      username: "administrator-x"
      platform_id: WinServerLocal
      secret: "@N&Ibl3!"
      platform_account_properties:
          LogonDomain: "cyberark"
          OwnerName: "ansible_user"
      secret_management:
          automatic_management_enabled: true
      state: present
      cyberark_session: "{{ cyberark_session }}"
    register: cyberarkaction

  - name:
      - Rotate credential via reconcile and providing the password to
        bechanged to.
    cyberark_account:
      identified_by: "address,username"
      safe: "Domain_Admins"
      address: "prod.cyberark.local"
      username: "admin"
      platform_id: WinDomain
      platform_account_properties:
          LogonDomain: "PROD"
      secret_management:
          new_secret: "Ama123ah12@#!Xaamdjbdkl@#112"
          management_action: "reconcile"
          automatic_management_enabled: true
      state: present
      cyberark_session: "{{ cyberark_session }}"
    register: reconcileaccount

  - name: Logoff from CyberArk Vault
    cyberark_authentication:
      state: absent
      cyberark_session: "{{ cyberark_session }}"

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
changed boolean	Identify if the playbook run resulted in a change to the account in any way. Returned: always
failed boolean	Whether playbook run resulted in a failure of any kind. Returned: always
result complex	A json dump of the resulting action. Returned: success
address string	The adress of the endpoint where the privileged account is located. Returned: successful addition and modification Sample: “dev.local”
createdTime integer	Timeframe calculation of the timestamp of account creation. Returned: successful addition and modification Sample: “1567824520”
id integer	Internal ObjectID for the account object identified Returned: successful addition and modification Sample: “25_21”
name string	The external ObjectID of the account Returned: successful addition and modification Sample: [“Operating System-WinServerLocal-cyberark.local-administrator”]
platformAccountProperties complex	Object containing key-value pairs to associate with the account, as defined by the account platform. Returned: successful addition and modification
KEY VALUE string	Object containing key-value pairs to associate with the account, as defined by the account platform. Returned: successful addition and modification Sample: [{“LogonDomain”: “cyberark”}, {“Port”: “22”}]
platformId string	The PolicyID of the Platform that is to be managing the account. Returned: successful addition and modification Sample: “WinServerLocal”
safeName string	The safe in the Vault where the privileged account is to be located. Returned: successful addition and modification Sample: “Domain_Admins”
secretManagement complex	Set of parameters associated with the management of the credential. Returned: successful addition and modification Sample: {“automaticManagementEnabled”: {“description”: [“Parameter that indicates whether the CPM will manage the password or not.”], “returned”: “successful addition and modification”, “type”: “bool”}, “lastModifiedTime”: {“description”: [“Timeframe calculation of the timestamp of account modification.”], “returned”: “successful addition and modification”, “sample”: “1567824520”, “type”: “int”}, “manualManagementReason”: {“description”: null, “returned”: “if C(automaticManagementEnabled) is set to false”, “sample”: “This is a static account”, “type”: “str”}}
secretType list / elements=string	The value that identifies what type of account it will be Returned: successful addition and modification Sample: [“key”, “password”]
userName string	The username associated with the account Returned: successful addition and modification Sample: “administrator”
status_code integer	Result HTTP Status code. Returned: success Sample: “200, 201, -1, 204”

Authors

CyberArk BizDev (@cyberark-bizdev)
Edward Nunez (@enunez-cyberark)
James Stutes (@jimmyjamcabd)

Collection links

Issue Tracker Repository (Sources)

cyberark.pas.cyberark_account module – Module for CyberArk Account object creation, deletion, and modification using PAS Web Services SDK.

Synopsis

Parameters

Examples

Return Values