CyberArk get-secrets Tool: Windows Setup and PowerShell Usage Guide

README.get-secrets.md

CyberArk get-secrets Tool: Windows Setup and PowerShell Usage Guide

Prerequisites

• Windows Server 2016+ or Windows 10+
• PowerShell 5.1+ (included with Windows)
• Administrator privileges
• CyberArk Identity and Secrets Hub credentials

Step 1: Install Go

1. Download Go

   • Open web browser and go to: https://golang.org/dl/
   • Download the Windows MSI installer (e.g., go1.21.x.windows-amd64.msi)

2. Install Go

   • Run the downloaded MSI file as Administrator
   • Accept all default settings
   • Installation completes to C:\Program Files\Go

3. Verify Installation

   • Open PowerShell as Administrator
   • Run: go version
   • You should see output like: go version go1.21.x windows/amd64

Step 2: Install get-secrets Tool

1. Install from Source

   go install github.com/davidh-cyberark/secretshub-sdk-go/examples/get-secrets@latest

2. Verify Installation

   get-secrets --help

Step 3: Basic Usage

Command Structure

get-secrets -shurl "SECRETS_HUB_URL" -idtenanturl "IDENTITY_URL" -iduser "USERNAME" -idpass "PASSWORD" [OPTIONS]

Required Parameters

• -shurl: Your Secrets Hub URL (e.g., https://tenant.secretshub.cyberark.cloud/)
• -idtenanturl: Your Identity tenant URL (e.g., https://tenant.id.cyberark.cloud)
• -iduser: Your service account username
• -idpass: Your service account password

Common Options

• -a: Get all secrets (recommended for most use cases)
• -filter: Apply OData filter to results
• -limit: Maximum number of secrets (default: 100, max: 1000)
• -d: Enable debug output

Step 4: Example Commands

Get All Secrets

get-secrets -a -shurl "https://tenant.secretshub.cyberark.cloud/" -idtenanturl "https://tenant.id.cyberark.cloud" -iduser "[email protected]" -idpass "password123" > secrets.json

Get Secrets with Specific Tag Value

get-secrets -a -filter "vendorData.tags.value CONTAINS thevalue" -shurl "https://tenant.secretshub.cyberark.cloud/" -idtenanturl "https://tenant.id.cyberark.cloud" -iduser "[email protected]" -idpass "password123" > result.json

Get Secrets with Filter (Boolean Tag)

get-secrets -a -filter "vendorData.tags.value CONTAINS true" -shurl "https://tenant.secretshub.cyberark.cloud/" -idtenanturl "https://tenant.id.cyberark.cloud" -iduser "[email protected]" -idpass "password123" > filtered-secrets.json

Get Azure Secrets Only

get-secrets -a -filter "vendorType eq 'AZURE'" -shurl "https://tenant.secretshub.cyberark.cloud/" -idtenanturl "https://tenant.id.cyberark.cloud" -iduser "[email protected]" -idpass "password123" > azure-secrets.json

Step 5: PowerShell Script for Automation

Create a file named Get-CyberArkSecrets.ps1:

param(
    [Parameter(Mandatory=$true)]
    [string]$SecretsHubUrl,
    
    [Parameter(Mandatory=$true)]
    [string]$IdentityUrl,
    
    [Parameter(Mandatory=$true)]
    [string]$Username,
    
    [Parameter(Mandatory=$true)]
    [string]$Password,
    
    [string]$Filter = "",
    [string]$OutputFile = "secrets-$(Get-Date -Format 'yyyyMMdd-HHmmss').json"
)

# Verify get-secrets is available
try {
    & get-secrets -version | Out-Null
    if ($LASTEXITCODE -ne 0) {
        throw "get-secrets tool not found"
    }
}
catch {
    Write-Error "get-secrets tool is not installed or not in PATH"
    exit 1
}

# Build arguments
$arguments = @(
    "-shurl", $SecretsHubUrl,
    "-idtenanturl", $IdentityUrl,
    "-iduser", $Username,
    "-idpass", $Password,
    "-a"
)

if ($Filter) {
    $arguments += "-filter", $Filter
}

# Execute command
try {
    Write-Host "Retrieving secrets from CyberArk Secrets Hub..."
    & get-secrets @arguments | Out-File -FilePath $OutputFile -Encoding UTF8
    
    if ($LASTEXITCODE -eq 0) {
        $secrets = Get-Content $OutputFile | ConvertFrom-Json
        Write-Host "Success: Retrieved $($secrets.Count) secrets to $OutputFile"
        
        # Display summary
        $summary = $secrets | Group-Object vendorType | Select-Object Name, Count
        Write-Host "`nVendor Summary:"
        $summary | ForEach-Object { Write-Host "  $($_.Name): $($_.Count)" }
    }
    else {
        Write-Error "Command failed with exit code $LASTEXITCODE"
    }
}
catch {
    Write-Error "Failed to retrieve secrets: $($_.Exception.Message)"
    exit 1
}

Step 6: Running the Script

Method 1: With Parameters

.\Get-CyberArkSecrets.ps1 -SecretsHubUrl "https://tenant.secretshub.cyberark.cloud/" -IdentityUrl "https://tenant.id.cyberark.cloud" -Username "[email protected]" -Password "password123"

Method 2: With Filter

.\Get-CyberArkSecrets.ps1 -SecretsHubUrl "https://tenant.secretshub.cyberark.cloud/" -IdentityUrl "https://tenant.id.cyberark.cloud" -Username "[email protected]" -Password "password123" -Filter "vendorType eq 'AZURE'"

Method 3: With Specific Tag Value

.\Get-CyberArkSecrets.ps1 -SecretsHubUrl "https://tenant.secretshub.cyberark.cloud/" -IdentityUrl "https://tenant.id.cyberark.cloud" -Username "[email protected]" -Password "password123" -Filter "vendorData.tags.value CONTAINS thevalue"

Step 7: Schedule with Task Scheduler

1. Open Task Scheduler

   • Press Win + R, type taskschd.msc, press Enter

2. Create Basic Task

   • Click "Create Basic Task" in the right panel
   • Name: CyberArk Secret Retrieval
   • Description: Daily retrieval of CyberArk secrets

3. Set Trigger

   • Choose "Daily"
   • Set desired time (e.g., 2:00 AM)

4. Set Action

   • Choose "Start a program"
   • Program/script: PowerShell.exe
   • Arguments: -File "C:\Scripts\Get-CyberArkSecrets.ps1" -SecretsHubUrl "https://tenant.secretshub.cyberark.cloud/" -IdentityUrl "https://tenant.id.cyberark.cloud" -Username "[email protected]" -Password "password123"
   • Start in: C:\Scripts

5. Finish

   • Review settings and click "Finish"

Common Filters

Purpose	Filter Expression
Specific tag value	vendorData.tags.value CONTAINS thevalue
Boolean tagged secrets	vendorData.tags.value CONTAINS true
Azure secrets	vendorType eq 'AZURE'
AWS secrets	vendorType eq 'AWS'
GCP secrets	vendorType eq 'GCP'
Unsynced secrets	syncedByCyberArk eq false
Specific store	storeName eq 'my-store-name'

Troubleshooting

Issue: "go: command not found"

Solution: Restart PowerShell or log out and back in to refresh PATH environment variable

Issue: "get-secrets: command not found"

Solution:

1. Check if %USERPROFILE%\go\bin exists
2. Add to PATH: $env:PATH += ";$env:USERPROFILE\go\bin"

Issue: Authentication errors

Solution:

1. Verify URLs are correct (include trailing slash for Secrets Hub URL)
2. Test credentials in CyberArk Identity portal
3. Ensure service account has proper permissions

Issue: Network/proxy errors

Solution: Set proxy environment variables if behind corporate firewall:

$env:HTTP_PROXY = "http://proxy.company.com:8080"
$env:HTTPS_PROXY = "http://proxy.company.com:8080"

Security Notes

• Store credentials securely using environment variables or Windows Credential Manager
• Restrict access to output files using NTFS permissions
• Run scripts with service accounts that have minimal required permissions
• Consider using CyberArk Credential Provider for production deployments