Cloud integration using CyberArk Password Vault - You connect and integrate the external CyberArk Password Vault to the Automation 360 Control Room .

Automation 360

You connect and integrate the external CyberArk Password Vault to the Automation 360 Control Room.

Note: If CyberArk is hosted On-Premises and protected by a proxy, then ensure that the Cloud Control Room can connect to the proxy URL. Also, the proxy should pass through all the query parameters sent by the Control Room to CyberArk.

The following image shows CyberArk Cloud integration with the Control Room:

Note: The CyberArk mark and logo are trademarks or registered trademarks of CyberArk Software Ltd and are used for identification purposes only.

CyberArk Cloud integration with Control Room

The Agent auto-login and Agent automation use cases are only supported on Automation 360 Cloud Control Room instances. Neither of these use cases affect the Control Room boot sequence or Control Room functionality.

Note:
  • Bootstrap and service account credential retrieval use cases are not supported on Cloud Control Room instances because the database and services are managed internally by Automation Anywhere. There is no compliance use case (requirement) for these credentials to be stored in the customer external key vault.
  • If you are using CyberArk in an Automation 360 Cloud deployment, then the CyberArk external key vault must be reachable from the Cloud Control Room through the network perimeter firewall rules. For external firewall rules configuration details, see Control Room IP address list for external integrations.
Prerequisites

  • You must configure the customer network perimeter firewall to allow access to the CyberArk_CCP_hostname:port from the Automation 360 Cloud AWS NAT Gateway IP addresses.

    The following table provides an example of how to configure the customer perimeter firewall:

    From To Protocol used
    Control Room in Automation 360 Cloud: Three AWS NAT Gateway IP addresses CyberArk_CCP API_hostname:port

    For example: cyberarkpwv.dev.abcd.com:4043

    		TLS Encrypted CCP API

    (TLS mutually authenticated)

    For more details, see Control Room IP address list for external integrations.

  • For Cloud integrations, you can configure the Control Room and external key vault integration using the Automation 360 Control Room user interface.

  • Ensure that you understand the key vault naming convention requirements before you integrate the CyberArk password vault. See External key vault naming conventions.

  • The certificate configured in the Control Room for CyberArk integration must include the Client Authentication Extended Key Usage (EKU). Supported configurations are:

    • Certificate with Client Authentication EKU only

    • Certificate with both Client Authentication and Server Authentication EKU
      Note:
      • Certificate with Server Authentication EKU only are not supported.
      • If your certificate provider is discontinuing combined EKU certificates, ensure you obtain a dedicated Client Authentication certificate for use with the CyberArk integration. No changes are required on the Automation 360 side as long as the configured certificate includes the Client Authentication EKU.
  • Gather the specific CyberArk information required to configure the external key vault connector using the Automation 360 Control Room.
    Item Description
    Vault URL The CyberArk AIM server CCP API URL (for example: https://<hostname:port_num>/
    Note: To access the CCP APIs, the Control Room will automatically append /AIMWebService/api/Accounts? to the vault URL you enter. As a result, you must configure the Web Service on the CyberArk AIM server as AIMWebService
    Application ID The CCP API AppID (for example: AAEControlRoom).

    For details, see Define CyberArk application ID.
    Virtual directory The default value of this field is /AIMWebService/api/Accounts. An authorized user can configure the value of this field as required. You can view the audit log from the Control Room by navigating to Administration > Audit log.
    Certificate file Enter the path to the client certificate issued to the Control Room server.

    The client certificate file that is issued for the Control Room is a .p12 file that contains the private key. CyberArk admins configure this file on the CyberArk server. After configuring the certificate file, it is used to authenticate every client request that is sent from the Automation 360 Cloud Control Room to the CyberArk server.

    The certificate will be issued to the Cloud Control Room (Subject: field of the certificate will contain fully qualified domain name (FQDN) of the Control Room) by the customer internal certificate authority.
    Certificate file password A password used to open the certificate file.
    Server certificate - PEM format (Required only for Cloud integration): The server certificate without the private key of the CyberArk AIM server (Subject: field of the certificate will contain the FQDN of the CyberArk AIM server).

    This server certificate is a public certificate for the URL where CyberArk is hosted. This certificate is in the PEM text format and contains the Subject Alternative Names (SAN) on which the CyberArk is listening to requests. For more information, see CyberArk CACert.
Procedure
Note: In Automation 360 v.41 and later, external vault configuration is available through only one of the following paths, depending on the features enabled for your environment:
  • If the Manage > External Vault option is visible, configure external vault using this flow. This flow supports configuring external vault connection in environments that use one or more external vaults.
  • If not, configure external vault using Administration > Settings > External key vault.
  1. Log in to the Automation 360 Control Room with the required permissions.
  2. Do one of the following based on the navigation path visible to you:
    • Navigate to Administration > Settings > External key vault and click the Edit icon.

      Administration path

    • Navigate to Manage > External Vault > Vaults and click the Add Vault, Add or + icon.

      Manage path

  3. Click CyberArk and then enter the specific CyberArk information described in the table given in the Prerequisite section.
  4. Click Save changes or Add Vault to connect the external key vault.
Next steps