Skip to content

Commit b954a55

Browse files
maksimusk-keeper
maksimu
authored and
sk-keeper
committed
KC-875: Added license-consumption-report command to analyze feature license usage. Introduced support for PAM and other features with options for detailed views, node filtering, team inclusion, and multiple output formats.
1 parent 2a50d54 commit b954a55

File tree

2 files changed

+580
-1
lines changed

2 files changed

+580
-1
lines changed

‎keepercommander/commands/LICENSE_CONSUMPTION_REPORT.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
# License Consumption Report
2+
3+
## Overview
4+
5+
The `license-consumption-report` command helps enterprise administrators identify which users are consuming feature licenses based on role enforcement policies. This addresses the common need to understand license utilization for compliance, budgeting, and license management purposes.
6+
7+
## How It Works
8+
9+
### Enforcement Policy Detection
10+
11+
The report works by:
12+
13+
1. **Analyzing Role Enforcements**: Examines all enterprise roles and their enforcement policies
14+
2. **Categorizing by Feature**: Groups enforcement policies by feature type (PAM, Secrets Manager, etc.)
15+
3. **Finding Feature Users**: Identifies users assigned to roles that have feature-specific enforcements enabled
16+
4. **Team Resolution**: Optionally includes users assigned to roles through team membership
17+
18+
## Usage Examples
19+
20+
### Basic PAM License Report
21+
```bash
22+
keeper license-consumption-report --feature pam
23+
```
24+
Shows all users with PAM enforcement policies enabled. By default, shows feature counts only.
25+
26+
### Show Detailed Feature Names
27+
```bash
28+
keeper license-consumption-report --feature pam --details
29+
```
30+
Shows the specific feature names instead of just counts (useful for detailed analysis).
31+
32+
### All Features Consolidated Report
33+
```bash
34+
keeper license-consumption-report --feature all
35+
```
36+
Shows license consumption across all feature types in a single report with separate columns for each feature.
37+
38+
### Include Team Assignments
39+
```bash
40+
keeper license-consumption-report --feature pam --include-teams
41+
```
42+
Also includes users who get PAM access through team membership in roles with PAM policies.
43+
44+
### Filter by Organization Node
45+
```bash
46+
keeper license-consumption-report --feature pam --node "Engineering"
47+
```
48+
Limits results to users in the "Engineering" node and its descendants.
49+
50+
### Export Results
51+
```bash
52+
keeper license-consumption-report --feature pam --format csv --output pam_licenses.csv
53+
```
54+
Exports results in CSV format for further analysis in spreadsheet applications.
55+
56+
### Comprehensive Analysis Examples
57+
```bash
58+
# All features with detailed breakdown
59+
keeper license-consumption-report --feature all --details --include-teams
60+
61+
# PAM users with details, including teams, export to CSV
62+
keeper license-consumption-report --feature pam --details --include-teams --format csv --output pam_detailed.csv
63+
64+
# Quick overview of all license consumption
65+
keeper license-consumption-report --feature all
66+
```
67+
68+
### Individual Feature Types
69+
```bash
70+
keeper license-consumption-report --feature secrets-manager
71+
keeper license-consumption-report --feature connection-manager
72+
keeper license-consumption-report --feature breachwatch
73+
```
74+
75+
## Report Output
76+
77+
### Columns Included
78+
79+
#### Single Feature Reports
80+
| Column | Description |
81+
|--------|-------------|
82+
| Username | User's email address |
83+
| Display Name | User's full name |
84+
| Node | Organization node path |
85+
| Status | User account status |
86+
| Direct Roles | Roles directly assigned to user |
87+
| Team Roles | Roles assigned through team membership |
88+
| [FEATURE] Features | Feature count by default, detailed names with `--details` |
89+
| Feature Count* | Number of feature enforcement policies |
90+
91+
*Feature Count column only appears when NOT using `--details` (to avoid redundancy)
92+
93+
#### All Features Report
94+
| Column | Description |
95+
|--------|-------------|
96+
| Username | User's email address |
97+
| Display Name | User's full name |
98+
| Node | Organization node path |
99+
| Status | User account status |
100+
| Direct Roles | Roles directly assigned to user |
101+
| Team Roles | Roles assigned through team membership |
102+
| Pam Features* | PAM feature details (if `--details` flag used) |
103+
| Pam Count** | Number of PAM features |
104+
| Secrets Manager Count** | Number of Secrets Manager features |
105+
| Connection Manager Count** | Number of Connection Manager features |
106+
| Breachwatch Count** | Number of BreachWatch features |
107+
| Total Features | Sum of all feature counts (always shown) |
108+
109+
*Feature detail columns only appear when using `--details` flag
110+
**Individual count columns only appear when NOT using `--details` (to avoid redundancy)
111+
112+
### Sample Output
113+
114+
#### Default Output (Feature Counts Only)
115+
```
116+
PAM License Consumption Report - 15 Users Found
117+
118+
Username Display Name Node Status Direct Roles Team Roles PAM Features Feature Count
119+
[email protected] John Doe Engineering Active PAM Admin IT Team -> PAM User 2 feature(s) 2
120+
[email protected] Jane Smith IT Active DevOps -> PAM Role 1 feature(s) 1
121+
```
122+
123+
#### With --details Flag (No Redundant Count Column)
124+
```
125+
PAM License Consumption Report - 15 Users Found
126+
127+
Username Display Name Node Status Direct Roles Team Roles PAM Features
128+
[email protected] John Doe Engineering Active PAM Admin IT Team -> PAM User PAM Gateway, Configure RBI
129+
[email protected] Jane Smith IT Active DevOps -> PAM Role Launch PAM Tunnels
130+
```
131+
132+
#### All Features Report (Default - Counts Only)
133+
```
134+
All Features License Consumption Report - 15 Users Found
135+
136+
Username Display Name Node Status Direct Roles Pam Count Secrets Manager Count Connection Manager Count Breachwatch Count Total Features
137+
[email protected] John Doe Engineering Active PAM Admin 10 1 1 0 12
138+
[email protected] Jane Smith IT Active DevOps 0 1 0 1 2
139+
```
140+
141+
#### All Features Report (With --details - No Redundant Count Columns)
142+
```
143+
All Features License Consumption Report - 15 Users Found
144+
145+
Username Display Name Node Status Direct Roles Pam Features Secrets Manager Features Total Features
146+
[email protected] John Doe Engineering Active PAM Admin PAM Gateway, Configure RBI, ... Secrets Manager 12
147+
[email protected] Jane Smith IT Active DevOps Secrets Manager 2
148+
```
149+
150+
## This Report Addresses the Following Questions:
151+
152+
### ✅ **"Which users are consuming PAM licenses?"**
153+
The report identifies all users with any of the 13 PAM enforcement checkboxes enabled in their roles.
154+
155+
### ✅ **"No simple command in commander"**
156+
Now available as `license-consumption-report` with alias `lcr`.
157+
158+
### ✅ **"Users from teams assigned to roles"**
159+
The `--include-teams` flag captures users who get PAM access through team membership.
160+
161+
### ✅ **"Unique users from all roles"**
162+
Automatically deduplicates users who appear in multiple roles or teams.
163+
164+
### ✅ **"Format option for enterprise-team"**
165+
Provides CSV, JSON, and other output formats for analysis.
166+
167+
## Command Alias
168+
169+
The command is available as both:
170+
- `license-consumption-report` (full name)
171+
- `lcr` (alias for quick access)
172+
173+
### Quick Examples with Alias
174+
```bash
175+
# Quick PAM report with counts only
176+
lcr --feature pam
177+
178+
# All features overview
179+
lcr --feature all
180+
181+
# Detailed PAM report including teams
182+
lcr --feature pam --details --include-teams
183+
```

0 commit comments

Comments
 (0)