Package: ark-sdk-python
Ark SDK Python📜DocumentationCyberArk's Official SDK and CLI for different services operationsFeatures and ServicesExtensive and Interactive CLIDifferent AuthenticatorsIdentity Authentication MethodsMFA Support for IdentityIdentity Security PlatformServices APIDPA VM / Databases Policies and Policies Interactive Editor ServiceDPA Databases OnboardingDPA Databases SecretsDPA Certificates ServiceDPA SSO ServiceDPA K8S ServiceDPA DB ServiceSession Monitoring ServiceAll services contains CRUD and Statistics per respective serviceReady to use SDK in PythonCLI and SDK ExamplesFully Interactive CLI comprising of 3 main actionsConfigureLoginExecFilesystem Inputs and Outputs for the CLISilent and Verbose loggingProfile Management and Authentication CachingTL;DREnduserAdminInstallationOne can install the SDK via the community pypi with the following command:pip3installark-sdk-pythonCLI UsageBoth the SDK and the CLI works with profilesThe profiles can be configured upon need and be used for the consecutive actionsThe CLI has the following basic commands:configure- Configures profiles and their respective authentication methodslogin- Logs into the profile authentication methodsexec- Executes different commands based on the supported servicesprofiles- Manage multiple profiles on the machineconfigureThe configure command is used to create a profile to work onThe profile consists of infomration regarding which authentication methods to use and what are their method settings, along with other related information such as MFAHow to run:arkconfigureThe profiles are saved to ~/.ark_profilesNo arguments are required, and interactive questions will be askedIf you wish to only supply arguments in a silent fashion, --silent can be added along with the arugmentsUsage:usage:arkconfigure[-h][-r][-s][-ao][-v][-ls{default}][-ll{DEBUG,INFO,WARN,ERROR,CRITICAL}][-dcv][-tcTRUSTED_CERT][-pnPROFILE_NAME][-pdPROFILE_DESCRIPTION][-wwis][-isam{identity,identity_service_user}][-iuISP_USERNAME][-iimm{pf,sms,email,otp}][-iiuISP_IDENTITY_URL][-iiaaISP_IDENTITY_AUTHORIZATION_APPLICATION]optionalarguments:-h,--helpshowthishelpmessageandexit-r,--rawWhethertorawoutput-s,--silentSilentexecution,nointeractiveness-ao,--allow-outputAllowstdout/stderrevenwhensilentandnotinteractive-v,--verboseWhethertoverboselog-ls{default},--logger-style{default}Whichverboseloggerstyletouse-ll{DEBUG,INFO,WARN,ERROR,CRITICAL},--log-level{DEBUG,INFO,WARN,ERROR,CRITICAL}Logleveltousewhileverbose-dcv,--disable-cert-verificationDisablescertificateverificationonHTTPScalls,unsafe!-tcTRUSTED_CERT,--trusted-certTRUSTED_CERTCertificatetouseforHTTPScalls-pnPROFILE_NAME,--profile-namePROFILE_NAMEProfilenameforstorage-pdPROFILE_DESCRIPTION,--profile-descriptionPROFILE_DESCRIPTIONInfoabouttheprofile-wwis,--work-with-ispWhethertoworkwithIdentitySecurityPlatformservices-isam{identity,identity_service_user},--isp-auth-method{identity,identity_service_user}-iuISP_USERNAME,--isp-usernameISP_USERNAMEUsernametoauthenticatewith-iimm{pf,sms,email,otp},--isp-identity-mfa-method{pf,sms,email,otp}MFAmethodifmfaisneeded-iiuISP_IDENTITY_URL,--isp-identity-urlISP_IDENTITY_URLIdentityurltouseforauthenticationinsteadoffqdnresolving-iiaaISP_IDENTITY_AUTHORIZATION_APPLICATION,--isp-identity-authorization-applicationISP_IDENTITY_AUTHORIZATION_APPLICATIONIdentityapplicationtoauthorizeonceloggedinwiththeserviceuserloginThe logn command is used to login to the authentication methods configured for the profileYou will be asked to write a password for each respective authentication method that supports password, and alongside that, any needed MFA promptOnce the login is done, the access tokens are stored on the computer keystore for their lifetimeOnce they are expired, a consecutive login will be requiredHow to run:arkloginUsage:usage:arklogin[-h][-r][-s][-ao][-v][-ls{default}][-ll{DEBUG,INFO,WARN,ERROR,CRITICAL}][-dcv][-tcTRUSTED_CERT][-pnPROFILE_NAME][-f][-nss][-st][-ra][-isuISP_USERNAME][-issISP_SECRET]optionalarguments:-h,--helpshowthishelpmessageandexit-r,--rawWhethertorawoutput-s,--silentSilentexecution,nointeractiveness-ao,--allow-outputAllowstdout/stderrevenwhensilentandnotinteractive-v,--verboseWhethertoverboselog-ls{default},--logger-style{default}Whichverboseloggerstyletouse-ll{DEBUG,INFO,WARN,ERROR,CRITICAL},--log-level{DEBUG,INFO,WARN,ERROR,CRITICAL}Logleveltousewhileverbose-dcv,--disable-cert-verificationDisablescertificateverificationonHTTPScalls,unsafe!-tcTRUSTED_CERT,--trusted-certTRUSTED_CERTCertificatetouseforHTTPScalls-pnPROFILE_NAME,--profile-namePROFILE_NAMEProfilenametoload-f,--forceWhethertoforcelogineventhoutokenhasnotexpiredyet-nss,--no-shared-secretsDonotsharesecretsofidentitybetweendifferentauthenticatorswiththesameusername-st,--show-tokensPrintouttokensaswellifnotsilent-ra,--refresh-authIfacacheexists,willalsotrytorefreshit-isuISP_USERNAME,--isp-usernameISP_USERNAMEUsernametoauthenticatewithtoIdentitySecurityPlatform-issISP_SECRET,--isp-secretISP_SECRETSecrettoauthenticatewithtoIdentitySecurityPlatformNotes:You may disable certificate validation for login to different authenticators using the --disable-certificate-verification or supply a certificate to be used, not recommended to disableexecThe exec command is used to execute various commands based on supported services for the fitting logged in authenticatorsThe following services and commands are supported:dpa- Dynamic Privilege Access Servicespolicies- DPA Policies Managementvm- DPA VM Policies Serviceeditor- DPA Policies Interactive Editordb- DPA DB Policies Serviceeditor- DPA Policies Interactive Editorworkspaces- DPA Workspaces Managementdb- DPA DB Workspace Servicesecrets- DPA Secrets / Strong Accounts Managementdb- DPA DB Secrets Servicecertificates- DPA Certificates Managementdb- DPA DB Enduser Operationssso- DPA SSO Enduser Operationsk8s- DPA kubernetes serviceAny command has its own subcommands, with respective argumentsFor example configure a profile to login to that respective tenant and perform DPA actions such as:Add DPA Database Secretarkexecdpasecretsdbadd-secret--secret-namemysecret--secret-typeusername_password--usernameuser--passwordmypassDelete DPA Database Secretarkexecdpasecretsdbdelete-secret--secret-namemysecretAdd DPA Databasearkexecdpaworkspacesdbadd-database--namemydb--provider-enginepostgres-sh--read-write-endpointmyendpoint.domain.comList DPA Databasesarkexecdpaworkspacesdblist-databasesGet VM policies statsarkexecdpapoliciesvmpolicies-statsEdit policies interactivelyThis gives the ability to locally work with a policies workspace, and edit / reset / create policies, applied to both databases and vm policiesWhen they are ready, once can commit all the policies changes to the remoteInitially, the policies can be loaded and reloaded usingarkexecdpapoliciesvmeditorload-policiesOnce they are loaded locally, they can be edited using the following commandsarkexecdpapoliciesvmeditoredit-policies
arkexecdpapoliciesvmeditorview-policies
arkexecdpapoliciesvmeditorreset-policies
arkexecdpapoliciesvmeditorgenerate-policy
arkexecdpapoliciesvmeditorremove-policies
arkexecdpapoliciesvmeditorpoliciesdiffEvantually, they can be committed usingarkexecdpapoliciesvmeditorcommit-policiesGenerate a short lived SSO password for databases connectionarkexecdpassoshort-lived-passwordGenerate a short lived SSO oracle wallet for oracle database connectionarkexecdpassoshort-lived-oracle-wallet--folder~/walletGenerate kubectl config filearkexecdpak8sgenerate-kubeconfigGenerate kubectl config file and save on specific patharkexecdpak8sgenerate-kubeconfig--folder=/Users/My.User/.kubeYou can view all of the commands via the --help for each respective exec actionNotes:You may disable certificate validation for login to different authenticators using the --disable-certificate-verification or supply a certificate to be used, not recommended to disableUsafe Env Vars:ARK_PROFILE - Sets the profile to be used across the CLIARK_DISABLE_CERTIFICATE_VERIFICATION - Disables certificate verification on REST API'sprofilesAs one may have multiple environments to manage, this would also imply that multiple profiles are required, either for multiple users in the same environment or multiple tenantsTherefore, the profiles command manages those profiles as a convenice set of methodsUsing the profiles as simply running commands under:arkprofilesUsage:usage:arkprofiles[-h][-r][-s][-ao][-v][-ls{default}][-ll{DEBUG,INFO,WARN,ERROR,CRITICAL}][-dcv][-tcTRUSTED_CERT]{list,show,delete,clear,clone,add}...

positionalarguments:{list,show,delete,clear,clone,add}listListallprofilesshowShowaprofiledeleteDeleteaspecificprofileclearClearallprofilescloneClonesaprofileaddAddsaprofiletotheprofilesfolderfromagivenpath

optionalarguments:-h,--helpshowthishelpmessageandexit-r,--rawWhethertorawoutput-s,--silentSilentexecution,nointeractiveness-ao,--allow-outputAllowstdout/stderrevenwhensilentandnotinteractive-v,--verboseWhethertoverboselog-ls{default},--logger-style{default}Whichverboseloggerstyletouse-ll{DEBUG,INFO,WARN,ERROR,CRITICAL},--log-level{DEBUG,INFO,WARN,ERROR,CRITICAL}Logleveltousewhileverbose-dcv,--disable-cert-verificationDisablescertificateverificationonHTTPScalls,unsafe!-tcTRUSTED_CERT,--trusted-certTRUSTED_CERTCertificatetouseforHTTPScallsSDK UsageAs well as using the CLI, one can also develop under the ark sdk using its API / class driven designThe same idea as the CLI applies here as wellFor example, let's say we want to create a demo environment containing all needed DPA DB assetsTo do so, we can use the following script:ArkSystemConfig.disable_verbose_logging()# Authenticate to the tenant with an auth profile to configure DPAusername='user@cyberark.cloud.12345'print(f'Authenticating to the created tenant with user [{username}]')isp_auth=ArkISPAuth()isp_auth.authenticate(auth_profile=ArkAuthProfile(username=username,auth_method=ArkAuthMethod.Identity,auth_method_settings=IdentityArkAuthMethodSettings()),secret=ArkSecret(secret='CoolPassword'),)# Create DPA DB Secret, Database, Connector and DB Policydpa_service=ArkDPAAPI(isp_auth)print('Adding DPA DB User Secret')secret=dpa_service.secrets_db.add_secret(ArkDPADBAddSecret(secret_type=ArkDPADBSecretType.UsernamePassword,username='Administrator',password='CoolPassword'))print('Adding DPA Database')dpa_service.workspace_db.add_database(ArkDPADBAddDatabase(name='mydomain.com',provider_engine=ArkDPADBDatabaseEngineType.PostgresSH,secret_id=secret.secret_id,read_write_endpoint="myendpoint.mydomain.com",))print('Adding DPA DB Policy')dpa_service.policies_db.add_policy(ArkDPADBAddPolicy(policy_name='IT Policy',status=ArkDPARuleStatus.Active,description='IT Policy',providers_data=ArkDPADBProvidersData(postgres=ArkDPADBPostgres(resources=['postgres-onboarded-asset'],),),user_access_rules=[ArkDPADBAuthorizationRule(rule_name='IT Rule',user_data=ArkDPAUserData(roles=['DpaAdmin'],groups=[],users=[]),connection_information=ArkDPADBConnectionInformation(grant_access=2,idle_time=10,full_days=True,hours_from='07:00',hours_to='17:00',time_zone='Asia/Jerusalem',connect_as=ArkDPADBConnectAs(db_auth=[ArkDPADBLocalDBAuth(roles=['rds_superuser'],applied_to=[ArkDPADBAppliedTo(name='postgres-onboarded-asset',type=ArkDPADBResourceIdentifierType.RESOURCE,)],),],),),)],))More examples can be found in the examples folderLicenseThis project is licensed under Apache License 2.0 - seeLICENSEfor more detailsCopyright (c) 2023 CyberArk Software Ltd. All rights reserved.