Public/Set-DuneRole.ps1
|
<# .SYNOPSIS Update a role. .DESCRIPTION Updates a role's name, applies-to type or privileges by sending a PUT request. The API requires the full role definition, so unspecified properties keep their current value. Accepts a role object via pipeline or by id. Note: the applies-to type of a role that is already granted through permissions cannot be changed (rejected by the API). .PARAMETER Role A `DuneRole` object to update (pipeline input supported). .PARAMETER Id The GUID of the role to update. .PARAMETER Name The new name for the role. .PARAMETER AppliesTo The new config item type the role applies to (`Tenant`, `Collection`, `Deployment`, `ResourceGroup`, `Resource`). .PARAMETER Privileges The new set of privileges. Replaces the current set. .EXAMPLE PS> Get-DuneRole -Name "Auditor" -AppliesTo Deployment | Set-DuneRole -Privileges Read,ReadInventory Replaces the privilege set of the Auditor role. .EXAMPLE PS> Set-DuneRole -Id $RoleId -Name "Auditor v2" Renames the role with the specified id. #> function Set-DuneRole { [CmdletBinding( SupportsShouldProcess, DefaultParameterSetName = 'Id' )] param( [Parameter(ValueFromPipeline, ParameterSetName = 'Object')] [DuneRole]$Role, [Parameter(ParameterSetName = 'Id')] [guid]$Id, [Parameter()] [string]$Name, [Parameter()] [ValidateSet('Tenant','Collection','Deployment','ResourceGroup','Resource')] [string]$AppliesTo, [Parameter()] [ValidateSet('Read','CreateChild','Operate','Edit','EditPermissions','EditTags','EditTemplate','CreateTemplate','Deploy','Move','Delete','DeleteTemplate','ReadInventory','CreateVulnerability','DeleteVulnerability','CreateDataPoint')] [string[]]$Privileges ) begin { Write-Debug "$($MyInvocation.MyCommand)|begin" $UpdateProperties = @('Name','AppliesTo','Privileges') | Where-Object { $PSBoundParameters.ContainsKey($_) } if (-not $UpdateProperties) { throw 'No properties specified to update.' } } process { Write-Debug "$($MyInvocation.MyCommand)|process|$($PSCmdlet.ParameterSetName)" if ($PSCmdlet.ParameterSetName -eq 'Id') { $Role = Get-DuneRole -Id $Id -ErrorAction Stop } # The PUT endpoint requires the full role definition; keep current values for unspecified properties $Body = @{ Name = if ($PSBoundParameters.ContainsKey('Name')) { $Name } else { $Role.Name } AppliesTo = if ($PSBoundParameters.ContainsKey('AppliesTo')) { $AppliesTo } else { $Role.AppliesTo } Privileges = if ($PSBoundParameters.ContainsKey('Privileges')) { $Privileges } else { $Role.Privileges } } if ($PSCmdlet.ShouldProcess($Role.Name, "Set $($UpdateProperties -join '/')")) { $null = Invoke-DuneApiRequest -Uri "authorization/roles/$($Role.Id)" -Method PUT -Body $Body -ErrorAction Stop } } end {} } |