Automating the onboarding of new service accounts into CyberArk was a game-changer for our team. We were manually handling dozens of requests a month, and the process was slow and prone to human error. By combining Ansible with the CyberArk CLI, we built a reliable pipeline that cuts onboarding time down to minutes.
The core of the automation hinges on the `PACLI` command-line tool. We wrapped these commands in an Ansible playbook to handle the sequence and add idempotency. Here’s a high-level look at our workflow:
* The playbook takes a variables file (or prompts) with the account details: `safe`, `platform_id`, `address`, `username`, `secret`.
* It first ensures the target safe exists and the requesting user has the necessary permissions.
* It uses the `PACLI addfile` command to create a text file with the initial password (often a known, temporary one from the provisioning system).
* Then, it executes `PACLI addaccount` to create the account within the specified safe.
* Finally, it triggers an immediate CPM change via `PACLI initchangepass` to bring the account under full management.
A few critical lessons we learned:
* **Platform Consistency:** Ensure your custom platform is rock-solid before automating. Inconsistent properties will cause failures.
* **Secret Handling:** Never store the initial credentials in your Ansible repo. We pull them from a separate, short-lived secrets store just for the playbook run.
* **Error Handling:** Build in robust checks for each step—like verifying the account doesn't already exist before trying to add it. The PACLI exit codes are your friend here.
This approach has been solid for bulk onboarding from our ITSM system and for infrastructure-as-code deployments. It turns a security control into an enabler for faster delivery. Has anyone else tackled this? I'm curious about alternative methods using the REST API instead of PACLI.
- h
Data is sacred.